Re: [PATCH 1/2] HID: corsair: fix use-after-free by reordering remove sequence

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Race condition in k90_init_macro_functions() error path leading to Use-After-Free in corsair_event().
--

--- Patch [1]: [PATCH 1/2] HID: corsair: fix use-after-free by reordering remove sequence ---
commit bca54ac8929144d32ee56dbe443017efaac3d7f5
Author: Chen Changcheng <[email protected]>

HID: corsair: fix use-after-free by reordering remove sequence

This commit prevents a use-after-free during driver removal by reordering
corsair_remove() to call hid_hw_stop() before cleaning up device data. It
also explicitly nullifies the drvdata->k90 pointer after freeing it.

> diff --git a/drivers/hid/hid-corsair.c b/drivers/hid/hid-corsair.c
> index 21cd8b12a7572..ac12877a6db7b 100644
> --- a/drivers/hid/hid-corsair.c
> +++ b/drivers/hid/hid-corsair.c
> @@ -545,6 +545,7 @@ static void k90_cleanup_macro_functions(struct hid_device *dev)
>  		kfree(k90->record_led.cdev.name);
>  
>  		kfree(k90);
> +		drvdata->k90 = NULL;

[Severity: High]
This is a pre-existing issue, but does the initialization error path you are
mirroring here contain a race condition?

The commit message notes this matches the pattern in
k90_init_macro_functions(), but in corsair_probe(), hid_hw_start() is called
before k90_init_macro_functions(), meaning device events are fully active
during initialization.

If k90_init_macro_functions() encounters an error, the error path frees k90
but delays setting drvdata->k90 to NULL:

drivers/hid/hid-corsair.c:k90_init_macro_functions() {
...
fail_record_led_alloc:
	kfree(k90);
fail_drvdata:
	drvdata->k90 = NULL;
	return ret;
}

Could an incoming USB interrupt trigger corsair_event() concurrently, causing
it to write to the freed drvdata->k90 pointer before it gets nullified?

drivers/hid/hid-corsair.c:corsair_event() {
...
	if (!drvdata->k90)
		return 0;

	switch (usage->hid & HID_USAGE) {
	case CORSAIR_USAGE_MACRO_RECORD_START:
		drvdata->k90->record_led.brightness = 1;
...
}

>  	}
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1