This reverts commit 87ddb2fc29f10cf689ff0dfb88a19b7d3687006b. In carl9170_usb_disconnect(), the driver calls carl9170_unregister() followed immediately by carl9170_free(), freeing struct ar9170 inside .disconnect(), while devres resources are released only after .disconnect() returns (and devres on &ar->udev->dev is not released at all on interface unbind or registration failure), leaving the WPS input device registered with input->name and input->phys pointing into freed memory. Fixes: 87ddb2fc29f1 ("carl9170: devres-ing input_allocate_device") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Dmitry Torokhov --- drivers/net/wireless/ath/carl9170/main.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c index 61c7a1288743..702b6d113b18 100644 --- a/drivers/net/wireless/ath/carl9170/main.c +++ b/drivers/net/wireless/ath/carl9170/main.c @@ -1500,7 +1500,7 @@ static int carl9170_register_wps_button(struct ar9170 *ar) if (!(ar->features & CARL9170_WPS_BUTTON)) return 0; - input = devm_input_allocate_device(&ar->udev->dev); + input = input_allocate_device(); if (!input) return -ENOMEM; @@ -1518,8 +1518,10 @@ static int carl9170_register_wps_button(struct ar9170 *ar) input_set_capability(input, EV_KEY, KEY_WPS_BUTTON); err = input_register_device(input); - if (err) + if (err) { + input_free_device(input); return err; + } ar->wps.pbc = input; return 0; @@ -2044,6 +2046,13 @@ void carl9170_unregister(struct ar9170 *ar) carl9170_debugfs_unregister(ar); #endif /* CONFIG_CARL9170_DEBUGFS */ +#ifdef CONFIG_CARL9170_WPC + if (ar->wps.pbc) { + input_unregister_device(ar->wps.pbc); + ar->wps.pbc = NULL; + } +#endif /* CONFIG_CARL9170_WPC */ + carl9170_cancel_worker(ar); cancel_work_sync(&ar->restart_work); -- 2.56.0.385.gd3acb90ef8-goog