Input: sur40 - fix input device registration ordering

In sur40_probe(), input_register_device() was previously called early before
the V4L2 video device and vb2_queue components were fully initialized. If
userspace opened the input device immediately upon registration, sur40_open()
would trigger and start the sur40_poll() worker thread. This worker thread
invokes sur40_process_video() and accesses the uninitialized vb2_queue
structure, leading to a data race and potential system crash.

Furthermore, if V4L2 or video registration failed after input_register_device()
succeeded, the error path fell through to calling input_free_device() on a
successfully registered device instead of input_unregister_device(), corrupting
input core state.

Move input_register_device() to the very end of sur40_probe(). This ensures
the V4L2 and video queue structures are fully initialized before polling can
start, and naturally resolves the error path bug since input_free_device()
is now only called when input registration has not yet occurred.

To maintain strict LIFO (Last-In, First-Out) teardown ordering, also move
input_unregister_device() to the very beginning of sur40_disconnect(). This
guarantees that the input polling worker thread is stopped before V4L2
video components or control handlers are unregistered.

Reported-by: sashiko-bot@kernel.org
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260616051235.1549517-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
index fe63d53d56db00e8ba659500141ac4854f4c49d6..8639ec3ad703855897291f6de7c890d3cb0cd007 100644 (file)
--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c
@@ -725,21 +725,13 @@ static int sur40_probe(struct usb_interface *interface,
                goto err_free_input;
        }
 
-       /* register the polled input device */
-       error = input_register_device(input);
-       if (error) {
-               dev_err(&interface->dev,
-                       "Unable to register polled input device.");
-               goto err_free_buffer;
-       }
-
        /* register the video master device */
        snprintf(sur40->v4l2.name, sizeof(sur40->v4l2.name), "%s", DRIVER_LONG);
        error = v4l2_device_register(sur40->dev, &sur40->v4l2);
        if (error) {
                dev_err(&interface->dev,
                        "Unable to register video master device.");
-               goto err_unreg_v4l2;
+               goto err_free_buffer;
        }
 
        /* initialize the lock and subdevice */
@@ -798,6 +790,14 @@ static int sur40_probe(struct usb_interface *interface,
                goto err_unreg_video;
        }
 
+       /* register the polled input device */
+       error = input_register_device(input);
+       if (error) {
+               dev_err(&interface->dev,
+                       "Unable to register polled input device.");
+               goto err_unreg_video;
+       }
+
        /* we can register the device now, as it is ready */
        usb_set_intfdata(interface, sur40);
        dev_dbg(&interface->dev, "%s is now attached\n", DRIVER_DESC);
@@ -823,11 +823,12 @@ static void sur40_disconnect(struct usb_interface *interface)
 {
        struct sur40_state *sur40 = usb_get_intfdata(interface);
 
+       input_unregister_device(sur40->input);
+
        v4l2_ctrl_handler_free(&sur40->hdl);
        video_unregister_device(&sur40->vdev);
        v4l2_device_unregister(&sur40->v4l2);
 
-       input_unregister_device(sur40->input);
        kfree(sur40->bulk_in_buffer);
        kfree(sur40);