Input: cm109 - do not stomp on control URB (82e06090) · Commits · 戴 / test

We need to make sure we are not stomping on the control URB that was issued when opening the device when attempting to toggle buzzer. To do that we need to mark it as pending in cm109_open(). Reported-and-tested-by:

<syzbot+150f793ac5bc18eee150@syzkaller.appspotmail.com> Cc: stable@vger.kernel.org Signed-off-by:

Dmitry Torokhov <dmitry.torokhov@gmail.com>

drivers/input/misc/cm109.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -568,12 +568,15 @@ static int cm109_input_open(struct input_dev *idev)
		dev->ctl_data->byte[HID_OR2] = dev->keybit;
		dev->ctl_data->byte[HID_OR3] = 0x00;

		dev->ctl_urb_pending = 1;
		error = usb_submit_urb(dev->urb_ctl, GFP_KERNEL);
		if (error)
		if (error) {
		dev->ctl_urb_pending = 0;
		dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n",
		__func__, error);
		else
		} else {
		dev->open = 1;
		}

		mutex_unlock(&dev->pm_mutex);

Admin message