[PATCH] Input: sur40 - fix use-after-free in sur40_open()

If any of the registration steps after input_register_device() fail
(v4l2_device_register(), vb2_queue_init(), ctrl handler setup,
video_register_device()), the error path frees sur40 via
input_free_device() + kfree() without ever calling
input_unregister_device(). Since the input device was already
registered, it remains live and openable, so a racing open() (e.g.
from udevd) can dereference the freed sur40 via sur40_open().

Split the unwind so that once input_register_device() has succeeded,
the failure path properly calls input_unregister_device() before
freeing sur40 and its buffer.

Fixes: 08b936012964 ("Input: sur40 - switch to using polled mode of input devices")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=683f6c071b5abfc266c1
Tested-by: [email protected]
Signed-off-by: Deepanshu Kartikey <[email protected]>
---
 drivers/input/touchscreen/sur40.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
index fe63d53d56db..b0958422ff76 100644
--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c
@@ -808,6 +808,10 @@ static int sur40_probe(struct usb_interface *interface,
 	video_unregister_device(&sur40->vdev);
 err_unreg_v4l2:
 	v4l2_device_unregister(&sur40->v4l2);
+	input_unregister_device(input);
+	kfree(sur40->bulk_in_buffer);
+	kfree(sur40);
+	return error;
 err_free_buffer:
 	kfree(sur40->bulk_in_buffer);
 err_free_input:
-- 
2.34.1