[lvc-project] [PATCH] input: sur40: fix error recovery in sur40_probe()

[Vasileios Almpanis]

> Since an input device which has passed 'input_register_device()' should
> be released with 'input_unregister_device()', adjust 'sur40_probe()'
> to do so and call 'input_free_device()' to handle device register error
> only. To avoid V4L2 memory leak, ensure that 'v4l2_ctrl_handler_free()'
> is called on all error handling paths, including the one after
> 'video_register_device()' failure.
> 
> Reported-by: syzbot+2a123f6269da57ffefaa at syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=2a123f6269da57ffefaa
> Fixes: 08b936012964 ("Input: sur40 - switch to using polled mode of input devices")
> Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>
>
> diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
> index fe63d53d56db..fe675b937b35 100644
> --- a/drivers/input/touchscreen/sur40.c
> +++ b/drivers/input/touchscreen/sur40.c
> @@ -730,6 +730,8 @@ static int sur40_probe(struct usb_interface *interface,
>  	if (error) {
>  		dev_err(&interface->dev,
>  			"Unable to register polled input device.");
> +		input_free_device(input);
> +		input = NULL;
>  		goto err_free_buffer;
>  	}
>  
> @@ -786,9 +788,8 @@ static int sur40_probe(struct usb_interface *interface,
>  	if (sur40->hdl.error) {
>  		dev_err(&interface->dev,
>  			"Unable to register video controls.");
> -		v4l2_ctrl_handler_free(&sur40->hdl);
>  		error = sur40->hdl.error;
> -		goto err_unreg_v4l2;
> +		goto err_unreg_ctrl;
>  	}
>  
>  	error = video_register_device(&sur40->vdev, VFL_TYPE_TOUCH, -1);
> @@ -806,12 +807,15 @@ static int sur40_probe(struct usb_interface *interface,
>  
>  err_unreg_video:
>  	video_unregister_device(&sur40->vdev);
> +err_unreg_ctrl:
> +	v4l2_ctrl_handler_free(&sur40->hdl);
>  err_unreg_v4l2:
>  	v4l2_device_unregister(&sur40->v4l2);
>  err_free_buffer:
>  	kfree(sur40->bulk_in_buffer);
>  err_free_input:
> -	input_free_device(input);
This label is shared by three other gotos which run before input_register_device.
So for example if kmalloc(sur40->bulk_in_size) fails we will go to err_free_input
which will call input_unregister_device with a device that was never registered,
and could potentially lead to some NULL-ptr deref.

-- 
Vasileios Almpanis <vasilisalmpanis at gmail.com>