uclogic_input_configured() caches the pen input_dev in
drvdata->pen_input before input_register_device() is called for it.
The in-range timeout handler uclogic_inrange_timeout() later
dereferences this pointer, guarded only by a NULL check.

If hidinput_connect() fails while bringing up the HID inputs (e.g. an
input_register_device() failure, or an input left unpopulated), it
unwinds via hidinput_disconnect() and frees the input_dev, but the
driver's cached drvdata->pen_input is not cleared and is left dangling.

Because this driver installs a ->raw_event callback and the hidraw
interface is claimed, hid_connect() still returns success even though
HID input was not claimed, so hid_hw_start() and probe() succeed. The
device stays live, and a subsequent in-range pen report re-arms
inrange_timer via uclogic_raw_event_pen(). When the timer fires,
uclogic_inrange_timeout() dereferences the freed input_dev: the NULL
check does not help because the pointer is dangling, not NULL. This is
a use-after-free distinct from the timer-teardown case.

Clear drvdata->pen_input after hid_hw_start() when HID input was not
claimed, so the cached pointer never outlives the input_dev and the
existing NULL check in the timeout handler becomes effective.

Found by 0sec (https://0sec.ai).

Fixes: 01309e29eb95 ("HID: uclogic: Support in-range reporting emulation")
Cc: stable@vger.kernel.org
Assisted-by: 0sec
Signed-off-by: Doruk Tan Ozturk <redacted>
---
 drivers/hid/hid-uclogic-core.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c
index b73f09d26688..396d46b0b88e 100644
--- a/drivers/hid/hid-uclogic-core.c
+++ b/drivers/hid/hid-uclogic-core.c

@@ -262,6 +262,19 @@ static int uclogic_probe(struct hid_device *hdev,
 		goto failure;
 	}
 
+	/*
+	 * hid_hw_start() -> hid_connect() returns success even when
+	 * hidinput_connect() failed, because this driver provides a
+	 * ->raw_event callback and the hidraw interface was claimed.  In that
+	 * case the input_dev that ->input_configured() cached in
+	 * drvdata->pen_input has already been freed by hidinput_connect()'s
+	 * error unwinding, leaving a dangling pointer that the in-range timer
+	 * would dereference.  Drop it so uclogic_inrange_timeout()'s NULL
+	 * check takes effect.
+	 */
+	if (!(hdev->claimed & HID_CLAIMED_INPUT))
+		drvdata->pen_input = NULL;
+
 	return 0;
 failure:
 	/* Assume "remove" might not be called if "probe" failed */

-- 
2.43.0