[PATCH] Input: appletouch - fix use-after-free in work handler during disconnect

[Haowen Tu <tuhaowen@uniontech.com>]

The atp_reinit work item is initialized in atp_probe() and scheduled
from atp_complete() URB callback when the device becomes idle. During
device disconnection, the current implementation calls usb_kill_urb()
in atp_disconnect() but fails to prevent the work from being executed
after the atp structure has been freed.

Although usb_kill_urb() terminates the URB and its callbacks, there is
a critical race window: if schedule_work() is called in atp_complete()
just before usb_kill_urb() takes effect, the work item can still be
queued. Since atp_disconnect() immediately proceeds to free the atp
structure without canceling pending work, this leads to a use-after-free
vulnerability when the work handler executes.

The race condition:

CPU 0 (disconnect path)      | CPU 1 (URB completion)
atp_disconnect()             |
  usb_kill_urb(dev->urb)     | atp_complete()
                             |   schedule_work(&dev->work)
  input_unregister_device()  |
  usb_free_coherent()        |
  usb_free_urb()             |
  kfree(dev);      // FREE   | atp_reinit()
                             |   dev = container_of(...) // USE
                             |   atp_geyser_init(dev) // USE
                             |   dev->urb // USE
                             |   dev->intf // USE

Fix this by adding disable_work_sync() in atp_disconnect() after
usb_kill_urb() to ensure the work is properly canceled and cannot
be rescheduled before the atp structure is freed.

Signed-off-by: Haowen Tu <tuhaowen@uniontech.com>
---
 drivers/input/mouse/appletouch.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/mouse/appletouch.c b/drivers/input/mouse/appletouch.c
index e669f86f1882..aa2870a87eee 100644
--- a/drivers/input/mouse/appletouch.c
+++ b/drivers/input/mouse/appletouch.c
@@ -946,6 +946,7 @@ static void atp_disconnect(struct usb_interface *iface)
 	usb_set_intfdata(iface, NULL);
 	if (dev) {
 		usb_kill_urb(dev->urb);
+		disable_work_sync(&dev->work);
 		input_unregister_device(dev->input);
 		usb_free_coherent(dev->udev, dev->info->datalen,
 				  dev->data, dev->urb->transfer_dma);
-- 
2.20.1