HID: logitech-hidpp: Fix FF device cleanup on init failure

hidpp_ff_init() creates the input force-feedback device with
input_ff_create(), then allocates the HID++ FF private data,
effect ID array, and workqueue.

If any of those allocations fail after input_ff_create() succeeds,
the function returns an error without destroying the FF device.
Add an unwind path that frees the private allocations made by
hidpp_ff_init() and calls input_ff_destroy() for failures after
input_ff_create() succeeds.

Fixes: ff21a635dd ("HID: logitech-hidpp: Force feedback support for the Logitech G920")
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Reviewed-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
This commit is contained in:
Haoxiang Li 2026-06-23 14:52:00 +08:00 committed by Jiri Kosina
parent 2a767bd3e0
commit dd5be4d9ce

View File

@ -2861,18 +2861,19 @@ static int hidpp_ff_init(struct hidpp_device *hidpp,
* ownership to FF core
*/
data = kmemdup(data, sizeof(*data), GFP_KERNEL);
if (!data)
return -ENOMEM;
if (!data) {
error = -ENOMEM;
goto err_destroy_ff;
}
data->effect_ids = kzalloc_objs(int, num_slots);
if (!data->effect_ids) {
kfree(data);
return -ENOMEM;
error = -ENOMEM;
goto err_free_data;
}
data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue");
if (!data->wq) {
kfree(data->effect_ids);
kfree(data);
return -ENOMEM;
error = -ENOMEM;
goto err_free_effect_ids;
}
data->hidpp = hidpp;
@ -2902,6 +2903,14 @@ static int hidpp_ff_init(struct hidpp_device *hidpp,
version);
return 0;
err_free_effect_ids:
kfree(data->effect_ids);
err_free_data:
kfree(data);
err_destroy_ff:
input_ff_destroy(dev);
return error;
}
/* ************************************************************************** */