[PATCH] platform/x86: acer-wmi: fix UAF after accelerometer registration failure

[Guangshuo Li]

When input_register_device() fails in acer_wmi_accel_setup(), the error
path frees acer_wmi_accel_dev but leaves the global pointer non-NULL.

Since acer_wmi_init() ignores the accelerometer setup failure and
continues initialization, a later driver removal or initialization
failure can call input_unregister_device() on the dangling pointer,
resulting in a use-after-free.

Set acer_wmi_accel_dev to NULL after freeing it so that the cleanup
paths do not attempt to unregister the already-freed input device.

This issue was found by our static analysis tool under development.

Fixes: 1eb3fe1d3b6b ("ACER: Add support for accelerometer sensor")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 drivers/platform/x86/acer-wmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 61ae622c93d9..26e17aa04abb 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -2681,6 +2681,7 @@ static int __init acer_wmi_accel_setup(void)
 
 err_free_dev:
 	input_free_device(acer_wmi_accel_dev);
+	acer_wmi_accel_dev = NULL;
 	return err;
 }
 
-- 
2.43.0