[PATCH] input: sur40: fix error recovery in sur40_probe()
From: Dmitry Antipov <hidden>
Date: 2026-08-10 14:13:53
Subsystem:
input (keyboard, mouse, joystick, touchscreen) drivers, the rest · Maintainers:
Dmitry Torokhov, Linus Torvalds
Since an input device which has passed 'input_register_device()' should be released with 'input_unregister_device()', adjust 'sur40_probe()' to do so and call 'input_free_device()' to handle device register error only. To avoid V4L2 memory leak, ensure that 'v4l2_ctrl_handler_free()' is called on all error handling paths, including the one after 'video_register_device()' failure. Reported-by: syzbot+2a123f6269da57ffefaa@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2a123f6269da57ffefaa Fixes: 08b936012964 ("Input: sur40 - switch to using polled mode of input devices") Signed-off-by: Dmitry Antipov <redacted> --- drivers/input/touchscreen/sur40.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
index fe63d53d56db..fe675b937b35 100644
--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c@@ -730,6 +730,8 @@ static int sur40_probe(struct usb_interface *interface, if (error) { dev_err(&interface->dev, "Unable to register polled input device."); + input_free_device(input); + input = NULL; goto err_free_buffer; }
@@ -786,9 +788,8 @@ static int sur40_probe(struct usb_interface *interface, if (sur40->hdl.error) { dev_err(&interface->dev, "Unable to register video controls."); - v4l2_ctrl_handler_free(&sur40->hdl); error = sur40->hdl.error; - goto err_unreg_v4l2; + goto err_unreg_ctrl; } error = video_register_device(&sur40->vdev, VFL_TYPE_TOUCH, -1);
@@ -806,12 +807,15 @@ static int sur40_probe(struct usb_interface *interface, err_unreg_video: video_unregister_device(&sur40->vdev); +err_unreg_ctrl: + v4l2_ctrl_handler_free(&sur40->hdl); err_unreg_v4l2: v4l2_device_unregister(&sur40->v4l2); err_free_buffer: kfree(sur40->bulk_in_buffer); err_free_input: - input_free_device(input); + if (input) + input_unregister_device(input); err_free_dev: kfree(sur40);
--
2.55.0