Re: [PATCH] Input: wacom_w8001 - compose the device basename in one place

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Calling `input_free_device()` on a successfully registered device pointer during the error path, leading to a double-free.
--

--- Patch [1]: [PATCH] Input: wacom_w8001 - compose the device basename in one place ---
commit c5b975c9cd0e7f7aaa34347ef2a6ab2d8f4d90b0
Author: Ian Bridges <icb@fastmail.org>

Input: wacom_w8001 - compose the device basename in one place
    
This commit simplifies the device basename composition in the wacom_w8001
driver. It removes the append helper and instead records the touch name
suffix in the device structure, allowing the basename to be assembled in a
single step using scnprintf(). The patch resolves format truncation
warnings while keeping the produced names identical.

Link: https://lore.kernel.org/r/20260716103236.28c1b5bb@pumpkin

> diff --git a/drivers/input/touchscreen/wacom_w8001.c b/drivers/input/touchscreen/wacom_w8001.c
> --- a/drivers/input/touchscreen/wacom_w8001.c
> +++ b/drivers/input/touchscreen/wacom_w8001.c

[ ... ]

> @@ -654,8 +648,8 @@ static int w8001_connect(struct serio *serio, struct serio_driver *drv)
>  	}
>  
>  	if (!err_touch) {
> -		snprintf(w8001->touch_name, sizeof(w8001->touch_name),
> -			 "%s Finger", basename);
> +		scnprintf(w8001->touch_name, sizeof(w8001->touch_name),
> +			  "%s Finger", basename);
>  		input_dev_touch->name = w8001->touch_name;
>  
>  		w8001_set_devdata(input_dev_touch, w8001, serio);

[Severity: High]
This is a pre-existing issue, but I noticed a potential double-free in the
error handling path of w8001_connect() that occurs just after this code block.

If input_register_device(w8001->touch_dev) fails, the code jumps to the fail4
label:

fail4:
        if (w8001->pen_dev)
                input_unregister_device(w8001->pen_dev);
fail3:
        serio_close(serio);
fail2:
        serio_set_drvdata(serio, NULL);
fail1:
        input_free_device(input_dev_pen);
        input_free_device(input_dev_touch);

Since input_unregister_device() manages dropping the reference count for
successfully registered devices, falling through to fail1 calls
input_free_device(input_dev_pen) on the same non-NULL pointer, which will
drop the reference count a second time.

Could this cause a double-free of the input_dev structure? Would it be safer
to set input_dev_pen = NULL in the fail4 block after unregistering?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/amqGsb0A6_dr9JLA@dev?part=1