[PATCH v8 0/2] HID: multitouch: fix use-after-free of haptic data on delayed input release

[Aldo Ariel Panzardo]

v8 fixes issues found by Sashiko on v5-v7.

Patch 1 keeps input_set_capability(EV_FF) before input_ff_create()
(ff->ffbit needs the bit), but clears both bits on failure via a new
ff_cap_clear label so a masked error from the caller does not leave
EV_FF set with a NULL dev->ff.

Patch 2 keeps the devm_add_action() design.  Changes since v5:
  - module_put in hid_haptic_destroy (not devm_release) so the module
    stays loaded until FF is done; __module_get for devm_release itself
  - guard against double-init (return 0 when haptic->wq is set)
  - NULL haptic->hdev and haptic->input_dev after put in devm_release
  - restore dev->flush/event on devm_add_action failure

v7: https://lore.kernel.org/linux-input/20261016163349.3293666-1-qwe.aldo@xxxxxxxxx/
v5: https://lore.kernel.org/linux-input/20261016135516.2957381-1-qwe.aldo@xxxxxxxxx/
v4: https://lore.kernel.org/linux-input/20261009103333.2476105-1-qwe.aldo@xxxxxxxxx/
v1: https://lore.kernel.org/linux-input/20261009031207.3233206-1-qwe.aldo@xxxxxxxxx/

Aldo Ariel Panzardo (2):
  HID: haptic: reorder try_module_get/get_device before input_ff_create
  HID: multitouch: fix use-after-free of haptic data on delayed input
    release

 drivers/hid/hid-haptic.c | 108 +++++++++++++++++++++++++++++++++------
 1 file changed, 82 insertions(+), 26 deletions(-)

--
2.53.0