[PATCH] usb-storage: onetouch: Fix potential use-after-free on input failure

[PATCH] usb-storage: onetouch: Fix potential use-after-free on input failure

[Guangshuo Li]

If input_register_device() fails, onetouch_connect_input() frees the
onetouch state but leaves it installed in ss->extra. USB-storage cleanup
then calls onetouch_release_input() on the freed state.

Install the extra state and callbacks only after input registration
succeeds.

This issue was found by our static analysis tool under development.

Fixes: 17efe155253e ("USB: onetouch - handle errors from input_register_device()")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
 drivers/usb/storage/onetouch.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/storage/onetouch.c b/drivers/usb/storage/onetouch.c
index 49d281f7bef6..e09b3c6b9a6a 100644
--- a/drivers/usb/storage/onetouch.c
+++ b/drivers/usb/storage/onetouch.c
@@ -237,16 +237,16 @@ static int onetouch_connect_input(struct us_data *ss)
 	onetouch->irq->transfer_dma = onetouch->data_dma;
 	onetouch->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 
+	error = input_register_device(onetouch->dev);
+	if (error)
+		goto fail3;
+
 	ss->extra_destructor = onetouch_release_input;
 	ss->extra = onetouch;
 #ifdef CONFIG_PM
 	ss->suspend_resume_hook = usb_onetouch_pm_hook;
 #endif
 
-	error = input_register_device(onetouch->dev);
-	if (error)
-		goto fail3;
-
 	return 0;
 
  fail3:	usb_free_urb(onetouch->irq);

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0