Re: [PATCH 2/5] HID: steam: Fix wording of connect/disconnect logs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The error path in steam_register() fails to unregister the battery, leading to a leaked power supply and subsequent use-after-free if probe fails.
--

--- Patch [2]: [PATCH 2/5] HID: steam: Fix wording of connect/disconnect logs ---
commit 86b8e9ab8ffc7b90075c933cefda13a663141100
Author: Vicki Pfau <vi@endrift.com>

HID: steam: Fix wording of connect/disconnect logs
    
It always said Controller, even on Deck. Since we special-case other
instances of Controller vs. Deck in strings, let's be consistent here too.

> diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
> index 111e57926d049..fdf32722c8b31 100644
> --- a/drivers/hid/hid-steam.c
> +++ b/drivers/hid/hid-steam.c
> @@ -1397,7 +1397,8 @@ static int steam_register(struct steam_device *steam)
>  			"%s:steam_get_attributes failed with error %d\n",
>  			__func__, ret);
>  
> -	hid_info(steam->hdev, "Steam Controller '%s' connected",
> +	hid_info(steam->hdev, "Steam %s '%s' connected",
> +			steam->quirks & STEAM_QUIRK_DECK ? "Deck" : "Controller",
>  			steam->serial_no);
>  
>  	/* ignore battery errors, we can live without it */

[Severity: High]
This is a pre-existing issue, but I noticed a potential use-after-free
issue regarding the battery registration near this log message.

If steam_battery_register() is called, but a subsequent registration fails:

drivers/hid/hid-steam.c:steam_register() {
    ...
	if (steam->quirks & (STEAM_QUIRK_WIRELESS | STEAM_QUIRK_IBEX))
		steam_battery_register(steam);
    ...
	ret = steam_input_register(steam);
	if (ret != 0)
		goto steam_register_input_fail;
	ret = steam_sensors_register(steam);
	if (ret != 0)
		goto steam_register_sensors_fail;
    ...
steam_register_sensors_fail:
	steam_input_unregister(steam);
steam_register_input_fail:
	return ret;
}

Could this error path leave the power supply registered when steam_register()
returns an error?

If probe fails, the driver core will release devres allocations, freeing the
steam_device struct. A user querying sysfs for battery properties could then
trigger a use-after-free since the power supply subsystem would still have
the freed pointer.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260805015116.3884465-1-vi@endrift.com?part=2