linux-kernel - [PATCH 5.15 679/846] HID: magicmouse: Fix an error handling path in magicmouse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220124184124.495603286@linuxfoundation.org>
Date:   Mon, 24 Jan 2022 19:43:16 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org,
        Christophe JAILLET <christophe.jaillet@...adoo.fr>,
        José Expósito <jose.exposito89@...il.com>,
        syzbot+a437546ec71b04dfb5ac@...kaller.appspotmail.com,
        Jiri Kosina <jkosina@...e.cz>
Subject: [PATCH 5.15 679/846] HID: magicmouse: Fix an error handling path in magicmouse_probe()

From: Christophe JAILLET <christophe.jaillet@...adoo.fr>

commit 33812fc7c8d77a43b7e2bf36a0d5a57c277a4b0c upstream.

If the timer introduced by the commit below is started, then it must be
deleted in the error handling of the probe. Otherwise it would trigger
once the driver is no more.

Fixes: 0b91b4e4dae6 ("HID: magicmouse: Report battery level over USB")
Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
Tested-by: José Expósito <jose.exposito89@...il.com>
Reported-by: <syzbot+a437546ec71b04dfb5ac@...kaller.appspotmail.com>
Signed-off-by: Jiri Kosina <jkosina@...e.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
---
 drivers/hid/hid-magicmouse.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -873,6 +873,7 @@ static int magicmouse_probe(struct hid_d
 
 	return 0;
 err_stop_hw:
+	del_timer_sync(&msc->battery_timer);
 	hid_hw_stop(hdev);
 	return ret;
 }