Re: [STABLE v5.15-v5.10 3/6] HID: steam: Fully unregister controller when hidraw is opened

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] hid: steam: Use-after-free of battery name in class iterators
--

commit ac4de628ad44ddc16c1b1fd80453897f658181f6
Author: Vicki Pfau <vi@endrift.com>

    HID: steam: Fully unregister controller when hidraw is opened

To avoid conflicts between anything touching the hidraw and the driver, this
commit changes the driver to fully unregister the controller internally when
hidraw is opened. It also unifies the unregister and connect callbacks.

> diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
> index 78104e1246e82..cf1a3da36478c 100644
> --- a/drivers/hid/hid-steam.c
> +++ b/drivers/hid/hid-steam.c
[ ... ]
> @@ -494,12 +495,15 @@ static void steam_battery_unregister(struct steam_device *steam)
>  	RCU_INIT_POINTER(steam->battery, NULL);
>  	synchronize_rcu();
>  	power_supply_unregister(battery);
> +	devm_kfree(&steam->hdev->dev, steam->battery_desc.name);
>  }

[Severity: High]
Can this introduce a use-after-free for the battery name string?

steam_battery_unregister() calls power_supply_unregister(battery), which
eventually delegates to device_del() and klist_del().

klist_del() drops the hierarchy reference asynchronously and does not block
waiting for active class iterators to finish.

If a concurrent caller to power_supply_get_by_name() iterates over the
power_supply_class, it will call power_supply_match_device_by_name() which
executes strcmp(psy->desc->name, name). 

Since devm_kfree() explicitly frees steam->battery_desc.name immediately
after unregistering, couldn't this dereference the freed name string and
cause a use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013091215.529531-1-lee@kernel.org?part=3