[PATCH] HID: sony: fix use-after-free when removing GHL devices

The GHL poke timer and its control URB re-arm each other: the timer
callback submits the URB, and the URB completion re-arms the timer.

sony_remove() only called timer_delete_sync(), which waits for a running
callback but does not stop a URB the callback already submitted and does
not stop the completion from re-arming the timer.  The sony_sc structure
is devm-allocated and freed after sony_remove() returns, so on removal
the completion or the re-armed timer can run on freed memory.

Use timer_shutdown_sync() instead, which also detaches the callback so
the completion can no longer re-arm the timer, and add usb_kill_urb()
before usb_free_urb() to drain any URB the callback submitted.  The URB
is driver-private and not anchored, so hid_hw_stop() does not touch it.

Found by a static analysis tool.

Fixes: fb1a79a6b6e1 ("HID: sony: fix freeze when inserting ghlive ps3/wii dongles")
Cc: [email protected]
Cc: Pascal Giard <[email protected]>
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <[email protected]>
---
 drivers/hid/hid-sony.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index b966e4044238..bbd95adfbed6 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -2164,7 +2164,8 @@ static void sony_remove(struct hid_device *hdev)
 	struct sony_sc *sc = hid_get_drvdata(hdev);
 
 	if (sc->quirks & (GHL_GUITAR_PS3WIIU | GHL_GUITAR_PS4)) {
-		timer_delete_sync(&sc->ghl_poke_timer);
+		timer_shutdown_sync(&sc->ghl_poke_timer);
+		usb_kill_urb(sc->ghl_urb);
 		usb_free_urb(sc->ghl_urb);
 	}
 
-- 
2.34.1