| From 82e06090473289ce63e23fdeb8737aad59b10645 Mon Sep 17 00:00:00 2001 |
| From: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
| Date: Wed, 9 Dec 2020 20:13:24 -0800 |
| Subject: Input: cm109 - do not stomp on control URB |
| |
| From: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
| |
| commit 82e06090473289ce63e23fdeb8737aad59b10645 upstream. |
| |
| We need to make sure we are not stomping on the control URB that was |
| issued when opening the device when attempting to toggle buzzer. |
| To do that we need to mark it as pending in cm109_open(). |
| |
| Reported-and-tested-by: syzbot+150f793ac5bc18eee150@syzkaller.appspotmail.com |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/input/misc/cm109.c | 7 +++++-- |
| 1 file changed, 5 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/input/misc/cm109.c |
| +++ b/drivers/input/misc/cm109.c |
| @@ -546,12 +546,15 @@ static int cm109_input_open(struct input |
| dev->ctl_data->byte[HID_OR2] = dev->keybit; |
| dev->ctl_data->byte[HID_OR3] = 0x00; |
| |
| + dev->ctl_urb_pending = 1; |
| error = usb_submit_urb(dev->urb_ctl, GFP_KERNEL); |
| - if (error) |
| + if (error) { |
| + dev->ctl_urb_pending = 0; |
| dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n", |
| __func__, error); |
| - else |
| + } else { |
| dev->open = 1; |
| + } |
| |
| mutex_unlock(&dev->pm_mutex); |
| |
