function dualshock4_get_calibration_data allocates memory to pointer
buf. however the function may exit prematurely due to transfer_failure
in this case it does not handle freeing memory.

this patch handles memory deallocation at exit.

Reported-by: syzbot+4f5f81e1456a1f645bf8@syzkaller.appspotmail.com
Tested-by: syzbot+4f5f81e1456a1f645bf8@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/691560c4.a70a0220.3124cb.0019.GAE@google.com/T/
Fixes: 947992c7fa9e0 ("HID: playstation: DS4: Fix calibration workaround for clone devices")
Signed-off-by: Eslam Khafagy <eslam.medhat1993@gmail.com>
---
 drivers/hid/hid-playstation.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-playstation.c b/drivers/hid/hid-playstation.c
index 63f6eb9030d1..fef81b7e27c1 100644
--- a/drivers/hid/hid-playstation.c
+++ b/drivers/hid/hid-playstation.c
@@ -1992,9 +1992,6 @@ static int dualshock4_get_calibration_data(struct dualshock4 *ds4)
 	acc_z_plus       = get_unaligned_le16(&buf[31]);
 	acc_z_minus      = get_unaligned_le16(&buf[33]);
 
-	/* Done parsing the buffer, so let's free it. */
-	kfree(buf);
-
 	/*
 	 * Set gyroscope calibration and normalization parameters.
 	 * Data values will be normalized to 1/DS4_GYRO_RES_PER_DEG_S degree/s.
@@ -2041,6 +2038,10 @@ static int dualshock4_get_calibration_data(struct dualshock4 *ds4)
 	ds4->accel_calib_data[2].sens_denom = range_2g;
 
 transfer_failed:
+	/* First free buf if still allocated */
+	if(buf)
+		kfree(buf);
+
 	/*
 	 * Sanity check gyro calibration data. This is needed to prevent crashes
 	 * during report handling of virtual, clone or broken devices not implementing
-- 
2.43.0

Thank you Eslam for catching this!

That mistake was mine, and your fix looks good to me.


Reviewed-by: Max Staudt <max@enpas.org>



I think your patch may be a candidate for the -stable tree:

  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst



Thank you for your help :)

Max

On 11/15/25 15:22, Max Staudt wrote:
> Thank you Eslam for catching this!
>
> That mistake was mine, and your fix looks good to me.
>
>
> Reviewed-by: Max Staudt <max@enpas.org>
>
>
>
> I think your patch may be a candidate for the -stable tree:
>
>  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst 
>
>
>
>
> Thank you for your help :)
>
> Max
>
>
I'll send v2 for this to cc stable mailing list.

On 11/15/25 15:22, Max Staudt wrote:
> Thank you Eslam for catching this!
>
> That mistake was mine, and your fix looks good to me.
>
>
> Reviewed-by: Max Staudt <max@enpas.org>
>
>
>
> I think your patch may be a candidate for the -stable tree:
>
>  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst 
>
>
sure, will submit a backport there too.
>
>
> Thank you for your help :)
No thank you :)
>
> Max
>
>

On 11/15/25 15:22, Max Staudt wrote:
> Thank you Eslam for catching this!
>
> That mistake was mine, and your fix looks good to me.
>
>
> Reviewed-by: Max Staudt <max@enpas.org>
>
>
>
> I think your patch may be a candidate for the -stable tree:
>
>  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst 
>
>
>
sure, will submit a backport there too.
>
> Thank you for your help :)
>
No thank you 🙂
> Max
>
>