Re: [PATCH] HID: sony: clean up device list on probe failure
Jiri Kosina <[email protected]>
| Newsgroups | gmane.linux.kernel,gmane.linux.kernel.input,gmane.linux.kernel.stable |
|---|---|
| Message-ID | <[email protected]> |
On Sun, 26 Jul 2026, Doruk Tan Ozturk wrote:
> sony_input_configured() adds some controllers to sony_device_list before
> HID core registers their input devices. input_register_device() can fail
> after the callback returns successfully. sony_probe() then observes that
> HID_CLAIMED_INPUT is clear and unwinds, but only stops the HID hardware.
> The devres-managed sony_sc is freed while its list node remains linked, so
> the next matching controller traverses freed memory.
>
> Initialize the list node and device ID to inactive states. Make list
> removal idempotent and run the driver-private cleanup on every probe
> failure path. This also makes a second cleanup safe when
> sony_input_configured() already unwound a partial initialization before
> sony_probe() handles the missing input claim.
>
> Found by 0sec (https://0sec.ai) using automated source analysis;
> verified against the HID input registration and probe unwind paths.
>
> Fixes: 4f967f6d7374 ("HID: sony: Fix memory issue when connecting device using both Bluetooth and USB")
> Cc: [email protected]
> Reported-by: Doruk Tan Ozturk <[email protected]>
> Link: https://lore.kernel.org/linux-input/[email protected]/
> Assisted-by: 0sec:multi-model
> Signed-off-by: Doruk Tan Ozturk <[email protected]>
Applied, thanks.
--
Jiri Kosina
SUSE Labs