Re: [PATCH v9 3/3] HID: nintendo: Add unified report format support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] LED class devices registered with devm_led_classdev_register() outlive their containing switch2_controller structure, leading to a UAF if accessed via sysfs after the device is unplugged.
--

commit 84beb320490de870df51e881a9a77c861e3838ca
Author: Vicki Pfau <vi@endrift.com>

HID: nintendo: Add unified report format support

This adds support for the "unified" report format that all controllers also
support, which has overlapping fields for like buttons and axes between
them.

> diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c
> index 96463e1586bbd..b406e6cfd221f 100644
> --- a/drivers/hid/hid-nintendo.c
> +++ b/drivers/hid/hid-nintendo.c

[ ... ]

[Severity: Critical]
This is a pre-existing issue, but can this lead to a use-after-free when the
device is unplugged?

Looking at switch2_init_input(), LEDs are registered with a devm action tied to
input->dev:

drivers/hid/hid-nintendo.c:switch2_init_input() {
    ...
    ret = devm_led_classdev_register(&input->dev, led);
    ...
}

This means their teardown action is delayed until the input device's kobject is
released.

However, the ns2 structure containing the leds array is freed manually in
switch2_kref_put() upon device removal:

drivers/hid/hid-nintendo.c:switch2_kref_put() {
    ...
    kfree(ns2);
    ...
}

Because the LED sysfs device is a child of input->dev, it prevents input->dev
from being released until it is unregistered. This creates a circular dependency
where the devm cleanup is never triggered.

If a process keeps the LED sysfs file open, input->dev remains alive, but ns2
is freed. Does this leave the LED sysfs endpoints pointing to freed memory,
potentially executing function pointers from the freed ns2 structure when
writing to the LED sysfs brightness file?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260701065606.4169999-1-vi@endrift.com?part=3