Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 96514706 authored by Anirudh Rayabharam's avatar Anirudh Rayabharam Committed by Greg Kroah-Hartman
Browse files

HID: usbhid: free raw_report buffers in usbhid_stop 

commit f7744fa16b96da57187dc8e5634152d3b63d72de upstream.

Free the unsent raw_report buffers when the device is removed.

Fixes a memory leak reported by syzbot at:
https://syzkaller.appspot.com/bug?id=7b4fa7cb1a7c2d3342a2a8a6c53371c8c418ab47



Reported-by: default avatar <syzbot+47b26cd837ececfc666d@syzkaller.appspotmail.com>
Tested-by: default avatar <syzbot+47b26cd837ececfc666d@syzkaller.appspotmail.com>
Signed-off-by: default avatarAnirudh Rayabharam <mail@anirudhrb.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 6f2f6864

drivers/hid/usbhid/hid-core.c

+12 −1
Original line number Diff line number Diff line
@@ -503,7 +503,7 @@ static void hid_ctrl(struct urb *urb) 


	if (unplug) {

		usbhid->ctrltail = usbhid->ctrlhead;

	} else {

	} else if (usbhid->ctrlhead != usbhid->ctrltail) {

		usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1);



		if (usbhid->ctrlhead != usbhid->ctrltail &&
@@ -1221,9 +1221,20 @@ static void usbhid_stop(struct hid_device *hid) 
	mutex_lock(&usbhid->mutex);



	clear_bit(HID_STARTED, &usbhid->iofl);



	spin_lock_irq(&usbhid->lock);	/* Sync with error and led handlers */

	set_bit(HID_DISCONNECTED, &usbhid->iofl);

	while (usbhid->ctrltail != usbhid->ctrlhead) {

		if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_OUT) {

			kfree(usbhid->ctrl[usbhid->ctrltail].raw_report);

			usbhid->ctrl[usbhid->ctrltail].raw_report = NULL;

		}



		usbhid->ctrltail = (usbhid->ctrltail + 1) &

			(HID_CONTROL_FIFO_SIZE - 1);

	}

	spin_unlock_irq(&usbhid->lock);



	usb_kill_urb(usbhid->urbin);

	usb_kill_urb(usbhid->urbout);

	usb_kill_urb(usbhid->urbctrl);