Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7ce4e491 authored by Anirudh Rayabharam's avatar Anirudh Rayabharam Committed by Greg Kroah-Hartman
Browse files

HID: usbhid: free raw_report buffers in usbhid_stop 

commit f7744fa16b96da57187dc8e5634152d3b63d72de upstream.

Free the unsent raw_report buffers when the device is removed.

Fixes a memory leak reported by syzbot at:
https://syzkaller.appspot.com/bug?id=7b4fa7cb1a7c2d3342a2a8a6c53371c8c418ab47



Reported-by: default avatar <syzbot+47b26cd837ececfc666d@syzkaller.appspotmail.com>
Tested-by: default avatar <syzbot+47b26cd837ececfc666d@syzkaller.appspotmail.com>
Signed-off-by: default avatarAnirudh Rayabharam <mail@anirudhrb.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent c55127a1

drivers/hid/usbhid/hid-core.c

+12 −1
Original line number Diff line number Diff line
@@ -500,7 +500,7 @@ static void hid_ctrl(struct urb *urb) 


	if (unplug) {

		usbhid->ctrltail = usbhid->ctrlhead;

	} else {

	} else if (usbhid->ctrlhead != usbhid->ctrltail) {

		usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1);



		if (usbhid->ctrlhead != usbhid->ctrltail &&
@@ -1185,9 +1185,20 @@ static void usbhid_stop(struct hid_device *hid) 
		usbhid->intf->needs_remote_wakeup = 0;



	clear_bit(HID_STARTED, &usbhid->iofl);



	spin_lock_irq(&usbhid->lock);	/* Sync with error and led handlers */

	set_bit(HID_DISCONNECTED, &usbhid->iofl);

	while (usbhid->ctrltail != usbhid->ctrlhead) {

		if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_OUT) {

			kfree(usbhid->ctrl[usbhid->ctrltail].raw_report);

			usbhid->ctrl[usbhid->ctrltail].raw_report = NULL;

		}



		usbhid->ctrltail = (usbhid->ctrltail + 1) &

			(HID_CONTROL_FIFO_SIZE - 1);

	}

	spin_unlock_irq(&usbhid->lock);



	usb_kill_urb(usbhid->urbin);

	usb_kill_urb(usbhid->urbout);

	usb_kill_urb(usbhid->urbctrl);