Re: [PATCH] HID: corsair: do not re-schedule LED worker after it has been cancelled

[Jiri Kosina]

On Mon, 31 Aug 2026, Chen Changcheng wrote:

> Commit eb51c9f8cb4f0 ("HID: corsair: cancel worker before unregistering
> LED to fix use-after-free") moved cancel_work_sync() ahead of
> led_classdev_unregister() in k90_cleanup_backlight() and
> k90_cleanup_macro_functions().  led_classdev_unregister() internally
> calls led_set_brightness(LED_OFF), which reaches the driver's
> k90_brightness_set() callback.  Since that callback schedules the worker
> unconditionally, the worker was re-queued after cancel_work_sync() had
> drained it, and the subsequent kfree() freed a still-active work_struct:
> 
>     ODEBUG: free active (active state 0) object type: work_struct
>             hint: k90_record_led_work
> 
> The removed flag check inside the worker itself only stops it from
> dereferencing freed memory once it runs; it cannot prevent the re-queue.
> 
> Fix this by making k90_brightness_set() a no-op once removed is set, so
> the LED_OFF update issued from led_classdev_unregister() can no longer
> re-schedule the worker after it has been cancelled.  Also apply the
> cancel-before-unregister ordering to the probe error path
> (k90_init_macro_functions() fail_sysfs) for consistency.
> 
> Fixes: eb51c9f8cb4f0 ("HID: corsair: cancel worker before unregistering LED to fix use-after-free")
> Reported-by: syzbot+0a031a76585d1c7e737d@xxxxxxxxxxxxxxxxxxxxxxxxx
> Reported-by: syzbot+0b8bff5929865345b29e@xxxxxxxxxxxxxxxxxxxxxxxxx
> https://lore.kernel.org/all/6a937393.1d9ded08.62e62.0113.GAE@xxxxxxxxxx/
> Signed-off-by: Chen Changcheng <chenchangcheng@xxxxxxxxxx>
> ---
>  drivers/hid/hid-corsair.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/hid/hid-corsair.c b/drivers/hid/hid-corsair.c
> index 278c6efb565d..73b3c1ff78c6 100644
> --- a/drivers/hid/hid-corsair.c
> +++ b/drivers/hid/hid-corsair.c
> @@ -194,6 +194,9 @@ static void k90_brightness_set(struct led_classdev *led_cdev,
>  {
>  	struct k90_led *led = container_of(led_cdev, struct k90_led, cdev);
>  
> +	if (led->removed)
> +		return;
> +

Sashiko is right here about the race. Can you please fix that and 
resubmit? Thanks,

-- 
Jiri Kosina
SUSE Labs