Re: [PATCH v4 1/6] HID: steam: Refactor registration

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-After-Free of steam_device due to orphaned work items on device removal after partial registration failure.
--

--- Patch [1]: [PATCH v4 1/6] HID: steam: Refactor registration ---
commit 2f71fd5dc6effb1149cad5cc15145d4c5b501691
Author: Vicki Pfau <vi@endrift.com>

HID: steam: Refactor registration

This refactors and simplifies the registration/unregistration flow, replacing
the previous assumption that a serial number means the device is registered
with a single purpose boolean, and fixes a power_supply object leak on error
paths.

> diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
> --- a/drivers/hid/hid-steam.c
> +++ b/drivers/hid/hid-steam.c
> @@ -1149,66 +1147,60 @@ static int steam_register(struct steam_device *steam)

[ ... ]

>  steam_register_sensors_fail:
>  	steam_input_unregister(steam);
>  steam_register_input_fail:
> +	steam_battery_unregister(steam);
>  	return ret;
>  }
>  
>  static void steam_unregister(struct steam_device *steam)
>  {
> -	if (!steam->serial_no[0])
> +	if (!steam->registered)
>  		return;

[Severity: High]
Could this early return cause a use-after-free of the steam_device structure
if steam_register() partially fails?

If steam_register() successfully registers the input device but then fails
during steam_sensors_register(), incoming HID reports processed by
steam_raw_event() can schedule the mode_switch delayed work during that short
window.

The error path in steam_register() unregisters the input device but leaves
steam->registered as false without cancelling any scheduled work items.

When the device is later disconnected, steam_remove() calls
steam_unregister(). Because steam->registered is false, it returns
immediately and skips cancelling the work items.

After steam_remove() returns and the steam_device structure is freed by
devres, could the pending delayed work fire and dereference the freed pointer?

>  
>  	hid_info(steam->hdev, "Steam Controller '%s' disconnected",
>  			steam->serial_no);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260807232339.2799205-1-vi@endrift.com?part=1