Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755095AbdC1Mkp (ORCPT ); Tue, 28 Mar 2017 08:40:45 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:60038 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753777AbdC1Mkf (ORCPT ); Tue, 28 Mar 2017 08:40:35 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Roderick Colenbrander , Benjamin Tissoires , Jiri Kosina Subject: [PATCH 4.10 025/111] HID: sony: Fix input device leak when connecting a DS4 twice using USB/BT Date: Tue, 28 Mar 2017 14:30:11 +0200 Message-Id: <20170328122916.718963594@linuxfoundation.org> X-Mailer: git-send-email 2.12.1 In-Reply-To: <20170328122915.640228468@linuxfoundation.org> References: <20170328122915.640228468@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1407 Lines: 39 4.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Roderick Colenbrander commit a687c5765b5ae19fe559e14615ddc87ebb46d409 upstream. When a user connects a DS4 twice using USB and BT, we reject the second device connection after the setup work. We then perform a cleanup, but during cleanup we are not removing the touchpad device. This leads to leakage of an input device, which we would never remove. It can likely result into a kernel oops as well when the touchpad evdev node is accessed and the underlaying HID device has been removed from the system. [jkosina@suse.cz: added stable annotation] Fixes: ac797b95f532 ("HID: sony: Make the DS4 touchpad a separate device") Signed-off-by: Roderick Colenbrander Reviewed-by: Benjamin Tissoires Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman --- drivers/hid/hid-sony.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/hid/hid-sony.c +++ b/drivers/hid/hid-sony.c @@ -2632,6 +2632,8 @@ err_stop: sony_leds_remove(sc); if (sc->quirks & SONY_BATTERY_SUPPORT) sony_battery_remove(sc); + if (sc->touchpad) + sony_unregister_touchpad(sc); sony_cancel_work_sync(sc); kfree(sc->output_report_dmabuf); sony_remove_dev_list(sc);