summaryrefslogtreecommitdiff
path: root/drivers/input
diff options
context:
space:
mode:
authorDmitry Torokhov <dmitry.torokhov@gmail.com>2020-12-10 07:13:24 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-12-29 15:46:43 +0300
commitfaed9d0fd9afeb0ff3ccb59d655de4d4ac9a23d0 (patch)
treec369dc5276cf75cfcbfab0658cf1e8b57955d0c6 /drivers/input
parent8de429bb0bc7547ab49bd3b140791d89fcd52a64 (diff)
downloadlinux-faed9d0fd9afeb0ff3ccb59d655de4d4ac9a23d0.tar.xz
Input: cm109 - do not stomp on control URB
commit 82e06090473289ce63e23fdeb8737aad59b10645 upstream. We need to make sure we are not stomping on the control URB that was issued when opening the device when attempting to toggle buzzer. To do that we need to mark it as pending in cm109_open(). Reported-and-tested-by: syzbot+150f793ac5bc18eee150@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/input')
-rw-r--r--drivers/input/misc/cm109.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
index 23c191a2a071..cf4d507efaf6 100644
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -571,12 +571,15 @@ static int cm109_input_open(struct input_dev *idev)
dev->ctl_data->byte[HID_OR2] = dev->keybit;
dev->ctl_data->byte[HID_OR3] = 0x00;
+ dev->ctl_urb_pending = 1;
error = usb_submit_urb(dev->urb_ctl, GFP_KERNEL);
- if (error)
+ if (error) {
+ dev->ctl_urb_pending = 0;
dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n",
__func__, error);
- else
+ } else {
dev->open = 1;
+ }
mutex_unlock(&dev->pm_mutex);