Re: [PATCH v2] HID: hyperx-headset: Add support for HyperX headset devices

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing power supply unregister on the `hid_hw_start` failure path causes a resource leak and Use-After-Free.
--

commit 100439ac6279809f99a9f4158c6fe4a272508223
Author: Sofia Schneider <sofia@schn.dev>

HID: hyperx-headset: Add support for HyperX headset devices

Introduce a HID driver for HyperX Cloud III Wireless headsets,
supporting battery reporting and connection status.

> diff --git a/drivers/hid/hid-hyperx-headset.c b/drivers/hid/hid-hyperx-headset.c
> new file mode 100644
> index 0000000000000..b77931d4dfb08
> --- /dev/null
> +++ b/drivers/hid/hid-hyperx-headset.c

[ ... ]

> +static int hyperx_headset_probe(struct hid_device *hdev,
> +				const struct hid_device_id *id)
> +{

[ ... ]

> +	ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
> +	if (ret != 0) {
> +		hid_err(hdev, "hw_start failed\n");
> +		cancel_work_sync(&drvdata->battery_work);

[Severity: High]
Does this error path leak the power supply if it was already registered?

If the device sends a connected event early during hid_hw_start(),
battery_work may execute concurrently. It can register the power supply
and store it in drvdata->battery. If hid_hw_start() subsequently fails
(e.g. during hid_connect), this error path cancels the work but fails
to unregister drvdata->battery.

Because drvdata is managed by devm, it will be freed when probe returns
an error. This leaves the registered power supply with a dangling pointer
to drvdata, which can lead to a use-after-free if its sysfs attributes
are accessed.

Should this path check and unregister drvdata->battery before returning?

> +		return ret;
> +	}
> +
> +	schedule_delayed_work(&drvdata->poll_work, 0);
> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260627203948.1053589-1-sofia@schn.dev?part=1