This series fixes two issues in the hid-alps driver related to the
separate input device ("DualPoint Stick", input2) that is allocated in
alps_input_configured() but not registered in hdev->inputs:

  Patch 1: input2 is never unregistered on remove.
           The driver struct has no .remove handler, and input2 is not
           tracked in hdev->inputs, so the default remove path
           (hid_hw_stop -> hidinput_disconnect) skips it.  Result: every
           device removal leaks one struct input_dev.

  Patch 2: data->input2 is stored before registration, and on
           registration failure the dangling pointer is read by
           u1_raw_event() (URBs are already active because
           alps_input_configured() calls hid_hw_open() before
           allocating input2) -> use-after-free.

Both patches apply against linux.git master at 7.2-rc7.

---
Chen Changcheng (2):
  HID: alps: unregister DualPoint Stick input device on remove
  HID: alps: fix use-after-free on input2 registration failure

 drivers/hid/hid-alps.c | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

Thanks,
Chen Changcheng
-- 
2.25.1