[PATCH] Input: wacom_w8001 - avoid double release of pen input device

[Guangshuo Li]

When registering the touch input device fails after the pen input device
has already been registered, w8001_connect() jumps to fail4 and
unregisters w8001->pen_dev.  It then falls through to fail1 where
input_dev_pen is passed to input_free_device().

Once input_register_device() has succeeded, the device must be released
with input_unregister_device(), and input_free_device() must not be used
on the same object afterwards.  Since input_dev_pen still aliases
w8001->pen_dev, this can result in a use-after-free or kref underflow.

Clear the local and container aliases after unregistering the pen device
so that the common cleanup path does not try to free it again.

This issue was found by a static analysis tool I am developing.

Fixes: e0361b70175f0 ("Input: wacom_w8001 - split the touch and pen devices into two devices")
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 drivers/input/touchscreen/wacom_w8001.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/wacom_w8001.c b/drivers/input/touchscreen/wacom_w8001.c
index 45930d731873..a3b283c59cdd 100644
--- a/drivers/input/touchscreen/wacom_w8001.c
+++ b/drivers/input/touchscreen/wacom_w8001.c
@@ -665,8 +665,11 @@ static int w8001_connect(struct serio *serio, struct serio_driver *drv)
 	return 0;
 
 fail4:
-	if (w8001->pen_dev)
+	if (w8001->pen_dev) {
 		input_unregister_device(w8001->pen_dev);
+		input_dev_pen = NULL;
+		w8001->pen_dev = NULL;
+	}
 fail3:
 	serio_close(serio);
 fail2:
-- 
2.43.0