[PATCH] platform/x86: acer-wmi: fix UAF after accelerometer registration failure

[PATCH] platform/x86: acer-wmi: fix UAF after accelerometer registration failure

[Guangshuo Li]

When input_register_device() fails in acer_wmi_accel_setup(), the error
path frees acer_wmi_accel_dev but leaves the global pointer non-NULL.

Since acer_wmi_init() ignores the accelerometer setup failure and
continues initialization, a later driver removal or initialization
failure can call input_unregister_device() on the dangling pointer,
resulting in a use-after-free.

Set acer_wmi_accel_dev to NULL after freeing it so that the cleanup
paths do not attempt to unregister the already-freed input device.

This issue was found by our static analysis tool under development.

Fixes: 1eb3fe1d3b6b ("ACER: Add support for accelerometer sensor")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/platform/x86/acer-wmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 61ae622c93d9..26e17aa04abb 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -2681,6 +2681,7 @@ static int __init acer_wmi_accel_setup(void)
 
 err_free_dev:
 	input_free_device(acer_wmi_accel_dev);
+	acer_wmi_accel_dev = NULL;
 	return err;
 }
 
-- 
2.43.0

Re: [PATCH] platform/x86: acer-wmi: fix UAF after accelerometer registration failure

[Krzysztof Kozlowski]

On 26/10/2026 12:11, Guangshuo Li wrote:
> When input_register_device() fails in acer_wmi_accel_setup(), the error
> path frees acer_wmi_accel_dev but leaves the global pointer non-NULL.
> 
> Since acer_wmi_init() ignores the accelerometer setup failure and
> continues initialization, a later driver removal or initialization
> failure can call input_unregister_device() on the dangling pointer,
> resulting in a use-after-free.
> 
> Set acer_wmi_accel_dev to NULL after freeing it so that the cleanup
> paths do not attempt to unregister the already-freed input device.
> 
> This issue was found by our static analysis tool under development.
> 
> Fixes: 1eb3fe1d3b6b ("ACER: Add support for accelerometer sensor")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---

So you just keep ignoring and ignoring our feedback. It's just bot, so
little point to discuss with bot.

Best regards,
Krzysztof

Re: [PATCH] platform/x86: acer-wmi: fix UAF after accelerometer registration failure

[Guangshuo Li]

Hi Krzysztof,

On Tue, 27 Oct 2026 at 23:33, Krzysztof Kozlowski <krzk@kernel.org> wrote:
>
> On 26/10/2026 12:11, Guangshuo Li wrote:
> > When input_register_device() fails in acer_wmi_accel_setup(), the error
> > path frees acer_wmi_accel_dev but leaves the global pointer non-NULL.
> >
> > Since acer_wmi_init() ignores the accelerometer setup failure and
> > continues initialization, a later driver removal or initialization
> > failure can call input_unregister_device() on the dangling pointer,
> > resulting in a use-after-free.
> >
> > Set acer_wmi_accel_dev to NULL after freeing it so that the cleanup
> > paths do not attempt to unregister the already-freed input device.
> >
> > This issue was found by our static analysis tool under development.
> >
> > Fixes: 1eb3fe1d3b6b ("ACER: Add support for accelerometer sensor")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> > ---
>
> So you just keep ignoring and ignoring our feedback. It's just bot, so
> little point to discuss with bot.
>
> Best regards,
> Krzysztof

Thank you for your feedback, and I apologize if our recent submissions
gave the impression that we were ignoring your previous comments.

We did take your earlier suggestions into account and subsequently
submitted a patch series accordingly.

For the more recent patches, however, since they address issues in
different drivers, we thought it would be more appropriate to submit
them separately rather than group them into a single series.

We certainly did not intend to disregard your feedback. We appreciate
your time and guidance, and we will be more careful with our future
submissions.

Thank you for your understanding.

Best regards,
Guangshuo Li