Re: [PATCH 0/2] HID: corsair: fix two use-after-free bugs on device removal

[Chen Changcheng]

Hi Jeffin,

Thanks for the review and for the pointer to the syzbot report.

You are right: led_classdev_unregister() internally calls
led_set_brightness(LED_OFF), which reaches k90_brightness_set() and
re-schedules the worker after cancel_work_sync() has returned, so the
work_struct can still be queued when kfree() is called.  This is the
issue syzbot reported (extid=0a031a76585d1c7e737d).

The follow-up patch below makes k90_brightness_set() a no-op once
removed is set, so the LED_OFF update from led_classdev_unregister()
cannot re-schedule the worker after it has been cancelled.  It also
applies the same cancel-before-unregister ordering to the probe error
path in k90_init_macro_functions() for consistency.

Thanks,
Chen Changcheng