For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] Input: sur40 - fix use-after-free in sur40_open()
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master



If any of the registration steps after input_register_device()
fail (v4l2_device_register(), vb2_queue_init(), ctrl handler setup,
video_register_device()), the error path frees sur40 via
input_free_device() + kfree() without ever calling
input_unregister_device(). Since the input device was already
registered, it remains live and openable, so a racing open() (e.g.
from udevd) can dereference the freed sur40 via sur40_open().

Split the unwind so that once input_register_device() has
succeeded, the failure path properly calls input_unregister_device()
before freeing sur40 and its buffer.

Reported-by: syzbot+683f6c071b5abfc266c1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=683f6c071b5abfc266c1
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/input/touchscreen/sur40.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
index 77ec2c94b91f..4b3a4d5386e4 100644
--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c
@@ -808,6 +808,10 @@ static int sur40_probe(struct usb_interface *interface,
 	video_unregister_device(&sur40->vdev);
 err_unreg_v4l2:
 	v4l2_device_unregister(&sur40->v4l2);
+	input_unregister_device(input);
+	kfree(sur40->bulk_in_buffer);
+	kfree(sur40);
+	return error;
 err_free_buffer:
 	kfree(sur40->bulk_in_buffer);
 err_free_input:
-- 
2.43.0