[PATCH] Input: wacom_w8001 - avoid double release of pen input device

[PATCH] Input: wacom_w8001 - avoid double release of pen input device

[Guangshuo Li]

When registering the touch input device fails after the pen input device
has already been registered, w8001_connect() jumps to fail4 and
unregisters w8001->pen_dev.  It then falls through to fail1 where
input_dev_pen is passed to input_free_device().

Once input_register_device() has succeeded, the device must be released
with input_unregister_device(), and input_free_device() must not be used
on the same object afterwards.  Since input_dev_pen still aliases
w8001->pen_dev, this can result in a use-after-free or kref underflow.

Clear the local and container aliases after unregistering the pen device
so that the common cleanup path does not try to free it again.

This issue was found by a static analysis tool I am developing.

Fixes: e0361b70175f0 ("Input: wacom_w8001 - split the touch and pen devices into two devices")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/input/touchscreen/wacom_w8001.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/wacom_w8001.c b/drivers/input/touchscreen/wacom_w8001.c
index 45930d731873..a3b283c59cdd 100644
--- a/drivers/input/touchscreen/wacom_w8001.c
+++ b/drivers/input/touchscreen/wacom_w8001.c
@@ -665,8 +665,11 @@ static int w8001_connect(struct serio *serio, struct serio_driver *drv)
 	return 0;
 
 fail4:
-	if (w8001->pen_dev)
+	if (w8001->pen_dev) {
 		input_unregister_device(w8001->pen_dev);
+		input_dev_pen = NULL;
+		w8001->pen_dev = NULL;
+	}
 fail3:
 	serio_close(serio);
 fail2:
-- 
2.43.0

Re: [PATCH] Input: wacom_w8001 - avoid double release of pen input device

[Peter Hutterer]

On Thu, Apr 30, 2026 at 03:13:11PM +0800, Guangshuo Li wrote:
> When registering the touch input device fails after the pen input device
> has already been registered, w8001_connect() jumps to fail4 and
> unregisters w8001->pen_dev.  It then falls through to fail1 where
> input_dev_pen is passed to input_free_device().
> 
> Once input_register_device() has succeeded, the device must be released
> with input_unregister_device(), and input_free_device() must not be used
> on the same object afterwards.  Since input_dev_pen still aliases
> w8001->pen_dev, this can result in a use-after-free or kref underflow.
> 
> Clear the local and container aliases after unregistering the pen device
> so that the common cleanup path does not try to free it again.
> 
> This issue was found by a static analysis tool I am developing.
> 
> Fixes: e0361b70175f0 ("Input: wacom_w8001 - split the touch and pen devices into two devices")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>

thanks

Cheers,
  Peter

> ---
>  drivers/input/touchscreen/wacom_w8001.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/input/touchscreen/wacom_w8001.c b/drivers/input/touchscreen/wacom_w8001.c
> index 45930d731873..a3b283c59cdd 100644
> --- a/drivers/input/touchscreen/wacom_w8001.c
> +++ b/drivers/input/touchscreen/wacom_w8001.c
> @@ -665,8 +665,11 @@ static int w8001_connect(struct serio *serio, struct serio_driver *drv)
>  	return 0;
>  
>  fail4:
> -	if (w8001->pen_dev)
> +	if (w8001->pen_dev) {
>  		input_unregister_device(w8001->pen_dev);
> +		input_dev_pen = NULL;
> +		w8001->pen_dev = NULL;
> +	}
>  fail3:
>  	serio_close(serio);
>  fail2:
> -- 
> 2.43.0
>