From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f175.google.com (mail-dy1-f175.google.com [74.125.82.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A96263CE4BA for ; Tue, 16 Jun 2026 05:12:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781586771; cv=none; b=i+CS9aLYnFNVXdGp2sxdXmJ6J2HhEVIOHPqgKIgROEUQ18d3KIu/PwcdWn1Hbgf03hO/5GOhB9WAoxAEfbeb3ZmTB1NX9Byq8CcMX/SO45AS+E9aO1v6N+pi7Qv32WxARAg/oj5ZfCRzIYbPSMMfvMViuaD52EnegGOs/7B3xAA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781586771; c=relaxed/simple; bh=jRm5BKdrWbSx6QhorT2ZQ9qmT3GuxjxZKNXk1rRkeIg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YLbfz/Zr4zxTEf6HmJqtcs35SE1rLfIpMavMcItZF1hfxCeEu+AGFbqEIfTn2m9TgK4naE22xMeYVPBuxKK4jMUujwQLEHJcldosLy8D0IZ6zr9m0vsfk/wRlbYKoS8bfpju/tc880Bcscs4uMaTJhxUhyGJwgf0sNAR0kYlKhc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SYbSRDn7; arc=none smtp.client-ip=74.125.82.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SYbSRDn7" Received: by mail-dy1-f175.google.com with SMTP id 5a478bee46e88-304fb780deaso4274381eec.1 for ; Mon, 15 Jun 2026 22:12:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781586769; x=1782191569; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=9a06GnFTgOZ8VawHWEGB4YwWHIzCduqDiZ9BtHLrmlk=; b=SYbSRDn7p18XwSc57xUoJivPTMTs23UorX5eoCd+3F40Rpm1Mn4YhzUtDmAzT7vvHb 9wybNBIzJJYhV6vEJObGAqvHOXnya41pjHm09DEYpNDwZI6cTO3hdMq5ZdywzzhAJ7IT CRYF7tUln3jAzsu+t+pdO4xl2sOK/B4vJu+9qXPufnYj/smWnJGMjunEGHCUnZAfXpZY GXiDO51tMpDboqs9XBXU5aIe47rVmYaSKJ+zbpR3ANFGoPSdfRs/winGWhIH4eU0uYbF M8a4eBsS60tA9lhk0ket2fCJjAKN5j68YdEUfDcuMPDOQZI9QZ2If0Sig/ZNfZT9il6H SAQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781586769; x=1782191569; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=9a06GnFTgOZ8VawHWEGB4YwWHIzCduqDiZ9BtHLrmlk=; b=jPpdMm5/UqRtvpuX0SkaZS3M5zu6NcSZxVf+kbBfYzFteRcYI8iN6z1/K9SCd46UHV +Rf31WzzfZWKLukCHYvQBonQbf7IA+ZK21vLujz3/wCNF+5E+C6yoRUa4fxqm+STcn6F j/JumG1rPdDssD6gYiP0RKYjMFcjynSlvwalpysjASW+0cUaQ/WRreGI5/mOeRDTH28Z 3dCfkqljmGU6VBQZ+9hx8caEZZLoS9ldznsrlVYJHz58z2pRZoG01pTtbwzdA9LuYawC tyzdG+RS5g1tWTg+VJvnnCQnrsyC+vA7tli3Pg0ujJsjjaS3LZVAWZrkc5SrNEqENkfd vgZg== X-Gm-Message-State: AOJu0Yz1nYL6xejtmxdYyfZ+Wi4a8E980u///F/IuB/9XJdQgjat//ei sXA3FDia6AX3aBiA1qELaoTSRFR06XCNhDMg0/xrmodo0lKgPBTHCvdK X-Gm-Gg: Acq92OG7pil41chqnQHJc9WHre8L7Fcr1hLNsBZMmJDvqPehAtxOVklXecEvtRLmxlG 8D/6mFMK3OJ3gVNFACqx4PLkoGHtKmdUQomrXy2InzNC84MF5t1o4Ii9BJqi3vmL0Rsa05+7Az+ NpMRCBEBlokxK2ZWVsPcTUPzObtIafBeVcUiXjbyBstWcZLCCL2EgUYDJ3SSwQ5+ONcaDqERBky FajTwPngxWDaPEa1KOa7CDyLvS3ik7Q8qQLtp826fEN1yfTFA8KskKEF0aBNO6R54CRND8MzRB+ XebmKdpfL0ctKjWn9F0yXFYn52e9Gnm8j2qkfjX7p0z9bdqK3I60iY8cvCXKMrngewhTUrNzCvt BDvM4y5X8a0W/kNt1zHELkn+XzUiG+iTlW+LlBvZLLCrpLsV1tvq6TqFgUvhRpyxEVCK7Z0r3T1 7N5ltraCGOyxXDxvOnEUgyZ7rDIJW47zWWo5jL/xMq2w7HTnFP3B+FxI6Cmc1IrJNfM8WRqOkQS v8oaTv69B1HO4M= X-Received: by 2002:a05:7300:8b84:b0:304:e587:5063 with SMTP id 5a478bee46e88-3081ff7ca07mr9443416eec.12.1781586768879; Mon, 15 Jun 2026 22:12:48 -0700 (PDT) Received: from dtor-ws.sjc.corp.google.com ([2a00:79e0:2ebe:8:3714:f5c2:9b83:3df1]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3081ea43b80sm16726052eec.21.2026.06.15.22.12.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 15 Jun 2026 22:12:48 -0700 (PDT) From: Dmitry Torokhov To: Hans Verkuil , linux-input@vger.kernel.org Cc: linux-kernel@vger.kernel.org, sashiko-bot@kernel.org, stable@vger.kernel.org Subject: [PATCH 4/4] Input: sur40 - fix V4L2 video device lifetime Date: Mon, 15 Jun 2026 22:12:32 -0700 Message-ID: <20260616051235.1549517-4-dmitry.torokhov@gmail.com> X-Mailer: git-send-email 2.54.0.1136.gdb2ca164c4-goog In-Reply-To: <20260616051235.1549517-1-dmitry.torokhov@gmail.com> References: <20260616051235.1549517-1-dmitry.torokhov@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit sur40_disconnect() synchronously frees the sur40_state structure (kfree(sur40)) while userspace might still hold an open file descriptor to the V4L2 video device node. When userspace later accesses or closes the lingering file descriptor, the V4L2 core invokes file operations (such as vb2_fop_release) that dereference the already freed sur40 memory, resulting in a use-after-free vulnerability. Fix this by implementing a V4L2 release callback (sur40_video_release) in sur40_video_device to clean up V4L2 components and free the sur40 structure only when the last video file descriptor is closed. Additionally, update the sur40_probe() error path to call video_unregister_device() and return inline if input initialization fails after video device registration succeeded, allowing the V4L2 release callback to manage cleanup. Also, call v4l2_device_disconnect() in sur40_disconnect() to safely dissociate the V4L2 device from the parent USB device during unplug. Reported-by: sashiko-bot@kernel.org Cc: stable@vger.kernel.org Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Dmitry Torokhov --- drivers/input/touchscreen/sur40.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c index 1ad68131e3a6..2f0efee23d1e 100644 --- a/drivers/input/touchscreen/sur40.c +++ b/drivers/input/touchscreen/sur40.c @@ -806,8 +806,10 @@ static int sur40_probe(struct usb_interface *interface, } error = sur40_init_input(sur40); - if (error) - goto err_unreg_video; + if (error) { + video_unregister_device(&sur40->vdev); + return error; + } /* we can register the device now, as it is ready */ usb_set_intfdata(interface, sur40); @@ -815,8 +817,6 @@ static int sur40_probe(struct usb_interface *interface, return 0; -err_unreg_video: - video_unregister_device(&sur40->vdev); err_free_ctrl: v4l2_ctrl_handler_free(&sur40->hdl); err_unreg_v4l2: @@ -835,13 +835,8 @@ static void sur40_disconnect(struct usb_interface *interface) struct sur40_state *sur40 = usb_get_intfdata(interface); input_unregister_device(sur40->input); - - v4l2_ctrl_handler_free(&sur40->hdl); video_unregister_device(&sur40->vdev); - v4l2_device_unregister(&sur40->v4l2); - - kfree(sur40->bulk_in_buffer); - kfree(sur40); + v4l2_device_disconnect(&sur40->v4l2); usb_set_intfdata(interface, NULL); dev_dbg(&interface->dev, "%s is now disconnected\n", DRIVER_DESC); @@ -1176,11 +1171,21 @@ static const struct v4l2_ioctl_ops sur40_video_ioctl_ops = { .vidioc_streamoff = vb2_ioctl_streamoff, }; +static void sur40_video_release(struct video_device *vdev) +{ + struct sur40_state *sur40 = video_get_drvdata(vdev); + + v4l2_device_unregister(&sur40->v4l2); + v4l2_ctrl_handler_free(&sur40->hdl); + kfree(sur40->bulk_in_buffer); + kfree(sur40); +} + static const struct video_device sur40_video_device = { .name = DRIVER_LONG, .fops = &sur40_video_fops, .ioctl_ops = &sur40_video_ioctl_ops, - .release = video_device_release_empty, + .release = sur40_video_release, .device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TOUCH | V4L2_CAP_READWRITE | V4L2_CAP_STREAMING, }; -- 2.54.0.1136.gdb2ca164c4-goog