From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f72.google.com (mail-oo1-f72.google.com [209.85.161.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76FD23BBA0A for ; Mon, 10 Aug 2026 14:15:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.72 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786371332; cv=none; b=mvPKYemPlP+rrvfSdNTRjlec8UbIZ09jVn7B5kJS9nr0DejUxa1Pf0mfNpEXCfsh8eYeVZCnenHyV0YMUUSElkS9EhycO43ksjcVgqpyOy3H9w8SXeBmdQcD8BBzZ3YfNbWQCPdRQDDjkTimhu5rzmmWWyxKDjsQp1YT4BTpREM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786371332; c=relaxed/simple; bh=zzqxlRGF95yJtHL0xDyQ0PKbjxyM83bEAsKjGUwNAqc=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=r10v5Sj5PrbBvqNgmZ6rlCDX1yaZn8KnF4vWvzIj/0TtPoYzrf+x9AJeqjZ73kAtttqE7lQ/lTY5FDDFPhMAazHmv/F6wCCBZYQs4ucpV5NSmpSyI5AZXJmyWrw5hZgd24KbmWyhq12MquNwak9J4MIUGEEFeBRYU0+juCnI+fY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f72.google.com with SMTP id 006d021491bc7-6a313ec13ceso858124eaf.2 for ; Mon, 10 Aug 2026 07:15:31 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786371330; x=1786976130; h=content-type:to:from:subject:message-id:in-reply-to:date :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=eu0qHtB+ZAF76stmhQYykbMUaATYHi1NpmGsn8fpI70=; b=THHtos0IPaCtmX7adJKtx7+qFREEwg/jVQFYSq+OMjX8wu2KO7xaSsSS2U0pgPHtiC CRrEvyckksdWgz7AnwewIV/z3xc4znSCXV3JTfZwUtOPb7nOB+WGR351GRVaU+XzUH5M 019oRcKuB9l+UNEcCj9JS9aBoUPLugqYBb1cJbFUuGNY7/1tT2/oQryUcH1mCbe8zX7B ykOumnCIoTvdJXqvZ17bw38kXIZMdIsMFOye4i57aHmYMS8ag9q9eDNGp1pxEBmA6gRm lm0K2ETE2ppudVIMIND8e6WV9ia0Q80YIuHH/jdx2ziH90Xg0q2QWuRCiTH5VyobCySb vl6w== X-Gm-Message-State: AOJu0YyyD9BVnknaI8xyM99dKiS2MjEVQxpgnu8ZKmWIm21mg/4l8s/f ByR1q3EVfXvLTwx/E2weH1zF9CVXJ0f9YJ0QAlo9SldnNvYKi7MM92HBXhJ4V7sWndzczE4v6ql WQitgbkYMxdEbz9r8n9bVEM/dR5onSytK9uPod/7RS5laeqVpcNeLQ1X6DXI= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:2228:b0:6aa:fc98:4256 with SMTP id 006d021491bc7-6ae9702daefmr21307754eaf.31.1786371330134; Mon, 10 Aug 2026 07:15:30 -0700 (PDT) Date: Mon, 10 Aug 2026 07:15:30 -0700 In-Reply-To: <6a784ada.01d0871a.3a0d52.0082.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a79dd02.01d0871a.3a0d52.00ab.GAE@google.com> Subject: Forwarded: Input: sur40: fix use-after-free on probe failure From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: Input: sur40: fix use-after-free on probe failure Author: vasilisalmpanis@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git db2ddb87143519e20a95aa36c60b36107b736a58 diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c index fe63d53d56db..f28536c118aa 100644 --- a/drivers/input/touchscreen/sur40.c +++ b/drivers/input/touchscreen/sur40.c @@ -725,21 +725,13 @@ static int sur40_probe(struct usb_interface *interface, goto err_free_input; } - /* register the polled input device */ - error = input_register_device(input); - if (error) { - dev_err(&interface->dev, - "Unable to register polled input device."); - goto err_free_buffer; - } - /* register the video master device */ snprintf(sur40->v4l2.name, sizeof(sur40->v4l2.name), "%s", DRIVER_LONG); error = v4l2_device_register(sur40->dev, &sur40->v4l2); if (error) { dev_err(&interface->dev, "Unable to register video master device."); - goto err_unreg_v4l2; + goto err_free_buffer; } /* initialize the lock and subdevice */ @@ -786,15 +778,22 @@ static int sur40_probe(struct usb_interface *interface, if (sur40->hdl.error) { dev_err(&interface->dev, "Unable to register video controls."); - v4l2_ctrl_handler_free(&sur40->hdl); error = sur40->hdl.error; - goto err_unreg_v4l2; + goto err_free_hdl; } error = video_register_device(&sur40->vdev, VFL_TYPE_TOUCH, -1); if (error) { dev_err(&interface->dev, "Unable to register video subdevice."); + goto err_free_hdl; + } + + /* register the polled input device */ + error = input_register_device(input); + if (error) { + dev_err(&interface->dev, + "Unable to register polled input device."); goto err_unreg_video; } @@ -806,6 +805,8 @@ static int sur40_probe(struct usb_interface *interface, err_unreg_video: video_unregister_device(&sur40->vdev); +err_free_hdl: + v4l2_ctrl_handler_free(&sur40->hdl); err_unreg_v4l2: v4l2_device_unregister(&sur40->v4l2); err_free_buffer: