[PATCH] HID: hidpp: fix potential UAF in hidpp_connect_event()

[Jiri Kosina]

From: Jiri Kosina <jkosina@xxxxxxxx>

If input_register_device() fails, we call input_free_device(), but keep 
stale pointer to the old device in hidpp->input, which could potentially 
lead to UAF. Fix that by resetting it to NULL before returning from 
hidpp_connect_event().

Reported-by: zdi-disclosures@xxxxxxxxxxxxxx
Signed-off-by: Jiri Kosina <jkosina@xxxxxxxx>

diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 1990ba5b26ea..e0dfb7051966 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -4295,6 +4295,7 @@ static void hidpp_connect_event(struct work_struct *work)
 	ret = input_register_device(input);
 	if (ret) {
 		input_free_device(input);
+		hidpp->input = NULL;
 		return;
 	}

-- 
Jiri Kosina
SUSE Labs