[PATCH v2 2/2] HID: usbhid: free unsent raw output reports in usbhid_stop()
Dmitry Antipov <[email protected]>
| Newsgroups | org.kernel.vger.linux-input,org.kernel.vger.linux-usb |
|---|---|
| Message-ID | <[email protected]> |
When HID device is stalled or disconnected, there might be an
unsent (i.e. never passed via 'hid_submit_out()') output reports.
So free their raw buffers in 'usbhid_stop()' to avoid memory leaks.
This is a companion of commit f7744fa16b96 ("HID: usbhid: free
raw_report buffers in usbhid_stop") and inspired by that one.
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=e2c057ea576d2644e2be
Fixes: c500c9714011 ("HID: hid, make parsing event driven")
Assisted-by: Sashiko:gemini/gemini-3.1-pro-preview
Signed-off-by: Dmitry Antipov <[email protected]>
---
v2: adjust loop to match actual FIFO size and tweak commit message
---
drivers/hid/usbhid/hid-core.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 96b0181cf819..60662616fd2a 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -1253,6 +1253,14 @@ static void usbhid_stop(struct hid_device *hid)
usbhid->ctrltail = (usbhid->ctrltail + 1) &
(HID_CONTROL_FIFO_SIZE - 1);
}
+
+ while (usbhid->outtail != usbhid->outhead) {
+ kfree(usbhid->out[usbhid->outtail].raw_report);
+ usbhid->out[usbhid->outtail].raw_report = NULL;
+
+ usbhid->outtail = (usbhid->outtail + 1) &
+ (HID_OUTPUT_FIFO_SIZE - 1);
+ }
spin_unlock_irq(&usbhid->lock);
usb_kill_urb(usbhid->urbin);
--
2.55.0