github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-31 02:24:24 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

HID: u2fzero: free allocated URB on probe errors

Browse Source 
u2fzero_fill_in_urb() allocates dev->urb with usb_alloc_urb(), but
u2fzero_probe() ignored its return value and only freed the URB from
u2fzero_remove().

If LED or hwrng registration fails after the URB allocation, probe returns
an error and the driver core does not call .remove(), leaking the URB. A
failed URB setup was also allowed to continue probing with an unusable
device.

Check the URB setup result and add the missing probe-error unwind so the
URB is freed before returning from later errors.

Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
This commit is contained in:
Myeonghun Pak 2026-04-24 22:21:31 +09:00 committed by Benjamin Tissoires
parent 64ffa2e5e0
commit 2e78b21864
1 changed files with 13 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/hid/hid-u2fzero.c
View File

@ -341,29 +341,33 @@ static int u2fzero_probe(struct hid_device *hdev,
if (ret)
return ret;
u2fzero_fill_in_urb(dev);
ret = u2fzero_fill_in_urb(dev);
if (ret)
goto err_hid_hw_stop;
dev->present = true;
minor = ((struct hidraw *) hdev->hidraw)->minor;
ret = u2fzero_init_led(dev, minor);
if (ret) {
hid_hw_stop(hdev);
return ret;
}
if (ret)
goto err_free_urb;
hid_info(hdev, "%s LED initialised\n", hw_configs[dev->hw_revision].name);
ret = u2fzero_init_hwrng(dev, minor);
if (ret) {
hid_hw_stop(hdev);
return ret;
}
if (ret)
goto err_free_urb;
hid_info(hdev, "%s RNG initialised\n", hw_configs[dev->hw_revision].name);
return 0;
err_free_urb:
usb_free_urb(dev->urb);
err_hid_hw_stop:
hid_hw_stop(hdev);
return ret;
}
static void u2fzero_remove(struct hid_device *hdev)