Re: [PATCH v4 2/6] HID: steam: Initial 2026 Steam Controller support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-After-Free (UAF) of the `steam` struct due to uncancelled delayed works when asynchronous registration fails.
--

--- Patch [2]: [PATCH v4 2/6] HID: steam: Initial 2026 Steam Controller support ---
commit 1d87ff75b79e456dee7ec00f38dd2bafa9555a17
Author: Vicki Pfau <vi@endrift.com>

HID: steam: Initial 2026 Steam Controller support

This brings support for the 2026 Steam Controller, comparably featureful to
the existing support for the Steam Deck.

> diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
> index 5deeff2db266e..ec7ccbe5aba09 100644
> --- a/drivers/hid/hid-steam.c
> +++ b/drivers/hid/hid-steam.c

[ ... ]

> @@ -1210,7 +1440,6 @@ static void steam_unregister(struct steam_device *steam)
>  	mutex_lock(&steam_devices_lock);
>  	list_del_init(&steam->list);
>  	mutex_unlock(&steam_devices_lock);
> -	steam->serial_no[0] = 0;
>  }

[Severity: High]
Can this result in a use-after-free of the steam struct?

If a controller connects asynchronously and steam_register() is called,
it registers the input device. If a subsequent step like
steam_sensors_register() fails, the error path is taken:

drivers/hid/hid-steam.c:steam_register() {
...
	ret = steam_sensors_register(steam);
	if (ret != 0)
		goto steam_register_sensors_fail;

	steam->registered = true;
...
steam_register_sensors_fail:
	steam_input_unregister(steam);
...
}

Because steam->registered is never set to true, any delayed works scheduled
during the brief window the input device was active (such as mode_switch
or rumble_work) might still be pending.

Later, when the device is removed, steam_unregister() is called but
returns early without canceling those works:

drivers/hid/hid-steam.c:steam_unregister() {
	if (!steam->registered)
		return;
...
}

When devres frees the steam struct at the end of steam_remove(), wouldn't
the still-pending works execute and access freed memory?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260807232339.2799205-1-vi@endrift.com?part=2