[PATCH] HID: input: allocate input_dev name/phys/uniq using hid device devres

[Hyeonsu Choi <chlgustn3171@gmail.com>]

input_dev->name, phys, and uniq are directly assigned from hid_device.
It causes a slab-use-after-free bug if the input device outlives the parent HID device during teardown.
Fix this by using devm_kstrdup() tied to &hid->dev for name, phys, and uniq strings.
The string lifetime is tied to the parent HID device, preventing a potential slab-use-after-free bug.
Also add OOM error handling for these allocations.

Reported-by: syzbot+aec1962419768c5caf88@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=aec1962419768c5caf88
Signed-off-by: Hyeonsu Choi <chlgustn3171@gmail.com>
---
 drivers/hid/hid-input.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 3487600cadb4..da6b338f18ba 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -2125,10 +2125,21 @@ static struct hid_input *hidinput_allocate(struct hid_device *hid,
 	input_dev->close = hidinput_close;
 	input_dev->setkeycode = hidinput_setkeycode;
 	input_dev->getkeycode = hidinput_getkeycode;
+        
+	const char *name = hidinput->name ? hidinput->name : hid->name;
+
+	input_dev->name = devm_kstrdup(&hid->dev, name, GFP_KERNEL);
+	if (!input_dev->name)
+		goto fail;
+
+	input_dev->phys = devm_kstrdup(&hid->dev, hid->phys, GFP_KERNEL);
+	if (!input_dev->phys)
+		goto fail;
+
+	input_dev->uniq = devm_kstrdup(&hid->dev, hid->uniq, GFP_KERNEL);
+	if (!input_dev->uniq)
+		goto fail;
 
-	input_dev->name = hidinput->name ? hidinput->name : hid->name;
-	input_dev->phys = hid->phys;
-	input_dev->uniq = hid->uniq;
 	input_dev->id.bustype = hid->bus;
 	input_dev->id.vendor  = hid->vendor;
 	input_dev->id.product = hid->product;
@@ -2144,6 +2155,8 @@ static struct hid_input *hidinput_allocate(struct hid_device *hid,
 	return hidinput;
 
 fail:
+	if (hidinput)
+                kfree(hidinput->name);
 	kfree(hidinput);
 	input_free_device(input_dev);
 	hid_err(hid, "Out of memory during hid input probe\n");
-- 
2.53.0