From fc535ce753aa941af0f658277aa3e026e6db361a Mon Sep 17 00:00:00 2001 From: Dmitry Torokhov Date: Thu, 8 Oct 2026 02:47:33 -0700 Subject: [PATCH] Input: drv2667 - fix input device parent assignment Assigning the I2C bus controller (client->dev.parent) instead of the I2C client (&client->dev) as the parent device after devm_input_allocate_device() causes input_register_device() to attach the devm unregistration action to the parent controller device rather than the client device. This leaves the input device registered on driver unbind, leading to use-after-free. devm_input_allocate_device() already sets input_dev->dev.parent to &client->dev. Drop the redundant and erroneous assignment. Fixes: 1c24622572d6 ("Input: add support for the DRV2667 haptic driver") Assisted-by: LLM Link: https://patch.msgid.link/20261008094736.918137-3-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov --- drivers/input/misc/drv2667.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/input/misc/drv2667.c b/drivers/input/misc/drv2667.c index 97309984fa7c..bbda7b4cbdcb 100644 --- a/drivers/input/misc/drv2667.c +++ b/drivers/input/misc/drv2667.c @@ -357,7 +357,6 @@ static int drv2667_probe(struct i2c_client *client) } haptics->input_dev->name = "drv2667:haptics"; - haptics->input_dev->dev.parent = client->dev.parent; haptics->input_dev->close = drv2667_close; input_set_drvdata(haptics->input_dev, haptics); input_set_capability(haptics->input_dev, EV_FF, FF_RUMBLE);