Re: [syzbot] [input?] [usb?] KASAN: slab-use-after-free Read in steam_input_open

[Edward Adam Davis <eadavis@qq.com>]

#syz test

diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
index c9e65e9088b3..4a70ca5eeb1a 100644
--- a/drivers/hid/hid-steam.c
+++ b/drivers/hid/hid-steam.c
@@ -1086,6 +1086,7 @@ static void steam_work_unregister_cb(struct work_struct *work)
 	connected = steam->connected;
 	spin_unlock_irqrestore(&steam->lock, flags);
 
+	printk("steam: %p, opened: %d, connected: %d, %s\n", steam, opened, connected, __func__);
 	if (connected) {
 		if (opened) {
 			steam_sensors_unregister(steam);
@@ -1153,11 +1154,10 @@ static void steam_client_ll_close(struct hid_device *hdev)
 	struct steam_device *steam = hdev->driver_data;
 
 	unsigned long flags;
-	bool connected;
 
 	spin_lock_irqsave(&steam->lock, flags);
-	steam->client_opened--;
-	connected = steam->connected && !steam->client_opened;
+	if (steam->client_opened > 0)
+		steam->client_opened--;
 	spin_unlock_irqrestore(&steam->lock, flags);
 
 	schedule_work(&steam->unregister_work);
@@ -1322,6 +1322,7 @@ static void steam_remove(struct hid_device *hdev)
 {
 	struct steam_device *steam = hid_get_drvdata(hdev);
 
+	printk("steam: %p, hid device is group steam %d, %s\n", steam, hdev->group == HID_GROUP_STEAM, __func__);
 	if (!steam || hdev->group == HID_GROUP_STEAM) {
 		hid_hw_stop(hdev);
 		return;