Re: [PATCH] Input: ims-pcu - fix use-after-free in probe error path

[Dmitry Torokhov]

On Mon, May 25, 2026 at 11:14:10PM +0800, Zhian Liang wrote:
> If the driver fails during init (e.g. in ims_pcu_init_application_mode),the error path frees the pcu struct without clearing the interface data.
> 
> If the device is disconnected while in this state, the disconnect handler will retrieve the stale pointer from
> usb_get_intfdata() and trigger a use-after-free

This does not make sense. How will disconnect handler run if probe has
not completed?

> 
> Fix this by setting the interface data to NULL in the probe before freeing the pcu struct.
> 
> Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
> Cc: <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: Zhian Liang <liangzhan5dev@xxxxxxxxx>
> ---
>  drivers/input/misc/ims-pcu.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
> index 4c022a36dbe8..fce3232ebf07 100644
> --- a/drivers/input/misc/ims-pcu.c
> +++ b/drivers/input/misc/ims-pcu.c
> @@ -2063,6 +2063,10 @@ static int ims_pcu_probe(struct usb_interface *intf,
>  	ims_pcu_buffers_free(pcu);
>  err_unclaim_intf:
>  	usb_driver_release_interface(&ims_pcu_driver, pcu->data_intf);
> +	goto err_clear_intfdata;
> +err_clear_intfdata:
> +	if (pcu->ctrl_intf)
> +		usb_set_intfdata(pcu->ctrl_intf, NULL);
>  err_free_mem:
>  	kfree(pcu);
>  	return error;

Thanks.

-- 
Dmitry