If input_register_device() fails, onetouch_connect_input() frees the onetouch state but leaves it installed in ss->extra. USB-storage cleanup then calls onetouch_release_input() on the freed state. Install the extra state and callbacks only after input registration succeeds. This issue was found by our static analysis tool under development. Fixes: 17efe155253e ("USB: onetouch - handle errors from input_register_device()") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/usb/storage/onetouch.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/usb/storage/onetouch.c b/drivers/usb/storage/onetouch.c index 49d281f7bef6..e09b3c6b9a6a 100644 --- a/drivers/usb/storage/onetouch.c +++ b/drivers/usb/storage/onetouch.c @@ -237,16 +237,16 @@ static int onetouch_connect_input(struct us_data *ss) onetouch->irq->transfer_dma = onetouch->data_dma; onetouch->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; + error = input_register_device(onetouch->dev); + if (error) + goto fail3; + ss->extra_destructor = onetouch_release_input; ss->extra = onetouch; #ifdef CONFIG_PM ss->suspend_resume_hook = usb_onetouch_pm_hook; #endif - error = input_register_device(onetouch->dev); - if (error) - goto fail3; - return 0; fail3: usb_free_urb(onetouch->irq); base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4 -- 2.43.0