Re: [PATCH] input: sur40: fix error recovery in sur40_probe()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Calling `input_unregister_device()` on an unregistered input device during early probe failures leads to a kernel crash.
--

--- Patch [1]: [PATCH] input: sur40: fix error recovery in sur40_probe() ---
commit ae7595899669d474b491f275a114a4cdae739843
Author: Dmitry Antipov <[email protected]>

input: sur40: fix error recovery in sur40_probe()

This commit modifies the error recovery path in sur40_probe() by
unregistering the input device instead of freeing it. It also ensures
that the v4l2 control handler is freed on all error paths.

Link: https://syzkaller.appspot.com/bug?extid=2a123f6269da57ffefaa

> diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
> index 77ec2c94b91fd..9f32208b94fd7 100644
> --- a/drivers/input/touchscreen/sur40.c
> +++ b/drivers/input/touchscreen/sur40.c
[ ... ]
> @@ -806,12 +807,15 @@ static int sur40_probe(struct usb_interface *interface,
>  
>  err_unreg_video:
>  	video_unregister_device(&sur40->vdev);
> +err_unreg_ctrl:
> +	v4l2_ctrl_handler_free(&sur40->hdl);
>  err_unreg_v4l2:
>  	v4l2_device_unregister(&sur40->v4l2);
>  err_free_buffer:
>  	kfree(sur40->bulk_in_buffer);
>  err_free_input:
> -	input_free_device(input);
> +	if (input)
> +		input_unregister_device(input);

[Severity: High]
Can this cause a kernel panic if an error occurs before
input_register_device() is called?

During sur40_probe(), if an early initialization step like
sur40_input_setup_events() or kmalloc() for sur40->bulk_in_buffer fails,
the code jumps to err_free_input. At that point, input is non-NULL but
input_register_device() has not been called yet.

Calling input_unregister_device() on an allocated but unregistered device
attempts to remove it from the sysfs hierarchy, which can lead to a NULL
pointer dereference since device_add() was never called.

>  err_free_dev:
>  	kfree(sur40);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1