AZL-99600

In the Linux kernel, the following vulnerability has been resolved:

HID: magicmouse: do not keep a stale msc->input if no input is claimed

magicmouseinputmapping() caches the first hidinput's inputdev in msc->input while the report descriptor is parsed, and the rest of the driver treats a non-NULL msc->input as proof that an input device was registered.

That does not hold on the hid-input error path. If hidinputconnect() fails -- for instance because inputregisterdevice() returns an error -- it unwinds through hidinputdisconnect(), which frees every input_dev it created, including the one cached in msc->input.

The failure does not abort the probe. hid_connect() only skips the claim:

if ((connect_mask & HID_CONNECT_HIDINPUT) && !hidinput_connect(hdev,
            connect_mask & HID_CONNECT_HIDINPUT_FORCE))
    hdev->claimed |= HID_CLAIMED_INPUT;

and the "device has no listeners" bailout below it does not fire for this driver, which sets ->rawevent; on the USB Magic Mouse 2 / Magic Trackpad 2 paths hidraw and hiddev are claimed as well. hidhwstart() therefore returns 0 and magicmouseprobe() continues with msc->input pointing at freed memory. Being non-NULL, it passes the "input not registered" check in probe and the NULL checks in ->raw_event and ->event, so the next input report dereferences freed memory.

Clear msc->input when the HID core did not claim an input device, so the existing NULL checks cover this case as well.