Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f486d9db authored by Peter Wu's avatar Peter Wu Committed by Jiri Kosina
Browse files

HID: logitech-hidpp: disable io in probe error path 



Balance a hid_device_io_start() call with hid_device_io_stop() in the
error path. This avoids processing of HID reports when the probe fails
which possibly leads to invalid memory access in hid_device_probe() as
report_enum->report_id_hash might already be freed via
hid_close_report().

hid_set_drvdata() is called before wtp_allocate, be consistent and clear
drvdata too on the error path of wtp_allocate.

Signed-off-by: default avatarPeter Wu <peter@lekensteyn.nl>
Reviewed-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 3a034a7a

drivers/hid/hid-logitech-hidpp.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -1121,7 +1121,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) 
	if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {

	if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {

		ret = wtp_allocate(hdev, id);

		ret = wtp_allocate(hdev, id);

		if (ret)

		if (ret)

			return ret;

			goto wtp_allocate_fail;

	}

	}





	INIT_WORK(&hidpp->work, delayed_work_cb);

	INIT_WORK(&hidpp->work, delayed_work_cb);
@@ -1141,6 +1141,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) 
	if (id->group != HID_GROUP_LOGITECH_DJ_DEVICE) {

	if (id->group != HID_GROUP_LOGITECH_DJ_DEVICE) {

		if (!connected) {

		if (!connected) {

			hid_err(hdev, "Device not connected");

			hid_err(hdev, "Device not connected");

			hid_device_io_stop(hdev);

			goto hid_parse_fail;

			goto hid_parse_fail;

		}

		}
@@ -1186,6 +1187,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) 
hid_parse_fail:

hid_parse_fail:

	cancel_work_sync(&hidpp->work);

	cancel_work_sync(&hidpp->work);

	mutex_destroy(&hidpp->send_mutex);

	mutex_destroy(&hidpp->send_mutex);

wtp_allocate_fail:

	hid_set_drvdata(hdev, NULL);

	hid_set_drvdata(hdev, NULL);

	return ret;

	return ret;

}

}