Re: [syzbot] [input?] [usb?] KASAN: slab-use-after-free Read in steam_input_open

[Edward Adam Davis]

#syz test

diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
index c9e65e9088b3..2317c3f7e037 100644
--- a/drivers/hid/hid-steam.c
+++ b/drivers/hid/hid-steam.c
@@ -596,6 +596,7 @@ static int steam_input_open(struct input_dev *dev)
 	unsigned long flags;
 	bool set_lizard_mode;
 
+	printk("steam: %p, %s\n", steam, __func__);
 	/*
 	 * Disabling lizard mode automatically is only done on the Steam
 	 * Controller. On the Steam Deck, this is toggled manually by holding
@@ -1086,6 +1087,10 @@ static void steam_work_unregister_cb(struct work_struct *work)
 	connected = steam->connected;
 	spin_unlock_irqrestore(&steam->lock, flags);
 
+	printk("steam: %p, client_hdev: %p, opened: %d, connected: %d, input: %p, %s\n", steam, steam->client_hdev, opened, connected, input, __func__);
+	if (!steam->client_hdev)
+		return;
+
 	if (connected) {
 		if (opened) {
 			steam_sensors_unregister(steam);
@@ -1153,11 +1158,10 @@ static void steam_client_ll_close(struct hid_device *hdev)
 	struct steam_device *steam = hdev->driver_data;
 
 	unsigned long flags;
-	bool connected;
 
 	spin_lock_irqsave(&steam->lock, flags);
-	steam->client_opened--;
-	connected = steam->connected && !steam->client_opened;
+	if (steam->client_opened > 0)
+		steam->client_opened--;
 	spin_unlock_irqrestore(&steam->lock, flags);
 
 	schedule_work(&steam->unregister_work);
@@ -1322,6 +1326,7 @@ static void steam_remove(struct hid_device *hdev)
 {
 	struct steam_device *steam = hid_get_drvdata(hdev);
 
+	printk("steam: %p, hid device is group steam %d, %s\n", steam, hdev->group == HID_GROUP_STEAM, __func__);
 	if (!steam || hdev->group == HID_GROUP_STEAM) {
 		hid_hw_stop(hdev);
 		return;