[PATCH] usb-storage: onetouch: Fix potential use-after-free on input failure

[PATCH] usb-storage: onetouch: Fix potential use-after-free on input failure

[Guangshuo Li]

If input_register_device() fails, onetouch_connect_input() frees the
onetouch state but leaves it installed in ss->extra. USB-storage cleanup
then calls onetouch_release_input() on the freed state.

Install the extra state and callbacks only after input registration
succeeds.

This issue was found by our static analysis tool under development.

Fixes: 17efe155253e ("USB: onetouch - handle errors from input_register_device()")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
 drivers/usb/storage/onetouch.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/storage/onetouch.c b/drivers/usb/storage/onetouch.c
index 49d281f7bef6..e09b3c6b9a6a 100644
--- a/drivers/usb/storage/onetouch.c
+++ b/drivers/usb/storage/onetouch.c
@@ -237,16 +237,16 @@ static int onetouch_connect_input(struct us_data *ss)
 	onetouch->irq->transfer_dma = onetouch->data_dma;
 	onetouch->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 
+	error = input_register_device(onetouch->dev);
+	if (error)
+		goto fail3;
+
 	ss->extra_destructor = onetouch_release_input;
 	ss->extra = onetouch;
 #ifdef CONFIG_PM
 	ss->suspend_resume_hook = usb_onetouch_pm_hook;
 #endif
 
-	error = input_register_device(onetouch->dev);
-	if (error)
-		goto fail3;
-
 	return 0;
 
  fail3:	usb_free_urb(onetouch->irq);

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0

Re: [PATCH] usb-storage: onetouch: Fix potential use-after-free on input failure

[sashiko-bot]

> If input_register_device() fails, onetouch_connect_input() frees the
> onetouch state but leaves it installed in ss->extra. USB-storage cleanup
> then calls onetouch_release_input() on the freed state.
> 
> Install the extra state and callbacks only after input registration
> succeeds.
> 
> This issue was found by our static analysis tool under development.
> 
> Fixes: 17efe155253e ("USB: onetouch - handle errors from input_register_device()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111-e5624093d6-usb-storage@mail.sdu.edu.cn?part=1

Re: [PATCH] usb-storage: onetouch: Fix potential use-after-free on input failure

[Alan Stern]

On Wed, Nov 11, 2026 at 08:23:03PM +0800, Guangshuo Li wrote:
> If input_register_device() fails, onetouch_connect_input() frees the
> onetouch state but leaves it installed in ss->extra. USB-storage cleanup
> then calls onetouch_release_input() on the freed state.
> 
> Install the extra state and callbacks only after input registration
> succeeds.
> 
> This issue was found by our static analysis tool under development.
> 
> Fixes: 17efe155253e ("USB: onetouch - handle errors from input_register_device()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
> ---

Acked-by: Alan Stern <stern@rowland.harvard.edu>

>  drivers/usb/storage/onetouch.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/storage/onetouch.c b/drivers/usb/storage/onetouch.c
> index 49d281f7bef6..e09b3c6b9a6a 100644
> --- a/drivers/usb/storage/onetouch.c
> +++ b/drivers/usb/storage/onetouch.c
> @@ -237,16 +237,16 @@ static int onetouch_connect_input(struct us_data *ss)
>  	onetouch->irq->transfer_dma = onetouch->data_dma;
>  	onetouch->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
>  
> +	error = input_register_device(onetouch->dev);
> +	if (error)
> +		goto fail3;
> +
>  	ss->extra_destructor = onetouch_release_input;
>  	ss->extra = onetouch;
>  #ifdef CONFIG_PM
>  	ss->suspend_resume_hook = usb_onetouch_pm_hook;
>  #endif
>  
> -	error = input_register_device(onetouch->dev);
> -	if (error)
> -		goto fail3;
> -
>  	return 0;
>  
>   fail3:	usb_free_urb(onetouch->irq);
> 
> base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
> -- 
> 2.43.0
>