diff mbox

HID: sony: Fix input device leak when connecting a DS4 twice using USB/BT

Message ID 20170223235613.5112-2-roderick@gaikai.com (mailing list archive)
State New, archived
Headers show

Commit Message

Roderick Colenbrander Feb. 23, 2017, 11:56 p.m. UTC
From: Roderick Colenbrander <roderick.colenbrander@sony.com>

When a user connects a DS4 twice using USB and BT, we reject the
second device connection after the setup work. We then perform
a cleanup, but during cleanup we are not removing the touchpad
device. This leads to leakage of an input device, which we would
never remove. It can likely result into a kernel oops as well
when the touchpad evdev node is accessed and the underlaying HID
device has been removed from the system.
---
 drivers/hid/hid-sony.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Jiri Kosina Feb. 24, 2017, 7:02 a.m. UTC | #1
On Thu, 23 Feb 2017, Roderick Colenbrander wrote:

> From: Roderick Colenbrander <roderick.colenbrander@sony.com>
> 
> When a user connects a DS4 twice using USB and BT, we reject the
> second device connection after the setup work. We then perform
> a cleanup, but during cleanup we are not removing the touchpad
> device. This leads to leakage of an input device, which we would
> never remove. It can likely result into a kernel oops as well
> when the touchpad evdev node is accessed and the underlaying HID
> device has been removed from the system.

Hi Roderick,

thanks for the fix. Could you please ammend and resend with:

- proper Signed-off-by: line
- ideally 'Fixes:' tag as well

Thanks,
diff mbox

Patch

diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index f405b07..740996f 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -2632,6 +2632,8 @@  static int sony_input_configured(struct hid_device *hdev,
 		sony_leds_remove(sc);
 	if (sc->quirks & SONY_BATTERY_SUPPORT)
 		sony_battery_remove(sc);
+	if (sc->touchpad)
+		sony_unregister_touchpad(sc);
 	sony_cancel_work_sync(sc);
 	kfree(sc->output_report_dmabuf);
 	sony_remove_dev_list(sc);