Re: [PATCH 1/2] HID: corsair: fix use-after-free by reordering remove sequence
From: sashiko-bot@kernel.org
Date: 2026-07-27 01:46:05
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [High] Race condition in k90_init_macro_functions() error path leading to Use-After-Free in corsair_event(). --
--- Patch [1]: [PATCH 1/2] HID: corsair: fix use-after-free by reordering remove sequence ---commit bca54ac8929144d32ee56dbe443017efaac3d7f5 Author: Chen Changcheng [off-list ref] HID: corsair: fix use-after-free by reordering remove sequence This commit prevents a use-after-free during driver removal by reordering corsair_remove() to call hid_hw_stop() before cleaning up device data. It also explicitly nullifies the drvdata->k90 pointer after freeing it.
quoted hunk ↗ jump to hunk
diff --git a/drivers/hid/hid-corsair.c b/drivers/hid/hid-corsair.c index 21cd8b12a7572..ac12877a6db7b 100644 --- a/drivers/hid/hid-corsair.c +++ b/drivers/hid/hid-corsair.c@@ -545,6 +545,7 @@ static void k90_cleanup_macro_functions(struct hid_device *dev) kfree(k90->record_led.cdev.name); kfree(k90); + drvdata->k90 = NULL;
[Severity: High]
This is a pre-existing issue, but does the initialization error path you are
mirroring here contain a race condition?
The commit message notes this matches the pattern in
k90_init_macro_functions(), but in corsair_probe(), hid_hw_start() is called
before k90_init_macro_functions(), meaning device events are fully active
during initialization.
If k90_init_macro_functions() encounters an error, the error path frees k90
but delays setting drvdata->k90 to NULL:
drivers/hid/hid-corsair.c:k90_init_macro_functions() {
...
fail_record_led_alloc:
kfree(k90);
fail_drvdata:
drvdata->k90 = NULL;
return ret;
}
Could an incoming USB interrupt trigger corsair_event() concurrently, causing
it to write to the freed drvdata->k90 pointer before it gets nullified?
drivers/hid/hid-corsair.c:corsair_event() {
...
if (!drvdata->k90)
return 0;
switch (usage->hid & HID_USAGE) {
case CORSAIR_USAGE_MACRO_RECORD_START:
drvdata->k90->record_led.brightness = 1;
...
}
} }
-- Sashiko AI review · https://sashiko.dev/#/patchset/20260727013500.23435-1-chenchangcheng@kylinos.cn?part=1