From nobody Fri Jun 19 09:06:06 2026 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E5C6C3CA4BF for ; Fri, 24 Apr 2026 13:22:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777036924; cv=none; b=gFlJS9OuIn/5XKfEXaE6SheYdnD0vuCVCccrsreV7Pmc1svkGRDox6j//eaB/53+ofqveUOqV/oL1OLSf5N1+3m6eMBgE1KQk35wA1jkk8nE5nOCCmbNqypN2qafORbaP019Dq+DEjVu6yR9WPQe6itFT0Q6B8IV5BYOdRjOHjw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777036924; c=relaxed/simple; bh=eTYYUYoBCUJYd6cOvj5WMnAu4WIx1W9ruVTfxT+rW2I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=pGj5FF8u9Jfj7b41sm/tuovMIrQ9h02wLK5MPWlZap/bwR+SxbW8/CsUA+4CUGqhpcM2jYTwU2LvuOJnfRQES+blfgHulSD5aoFNbgSZ9ziZ3XleJCMiHEnPRwa+bxJhSoENGZ/s2X7T4/2yVdJX1DV//V0vl0eeMTj0Mpw3k2Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Dh+aCNsi; arc=none smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Dh+aCNsi" Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2b7d3ecc10dso934965ad.2 for ; Fri, 24 Apr 2026 06:22:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1777036922; x=1777641722; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=ybrSWmSvBg9HMhpBAZRFHbe/rCyD4fuA5/9B69lAdq8=; b=Dh+aCNsiDgxJuE3pAkIHdFua6DtTlEGMsHTWQJAGOEUODJNC95MJsiexaW38edR73S IjUkvJmUjXJ7ya7r6GuuHWeiBSotgcNJTAfdNuA0vGaorkbR18UVOt244kdLymxRzcG9 94xjTyJEHtTIB1odu6Bk9VzoDWJkuqDpgPbaj+Pd+aGxQY7CDK7OVnME4+c4p7fnw6j8 8Q5o+tUZxwy3y8OCLMJig623HeZR6S0UvRn+PlPg+62H5mvE2VH7BEv39oOuuAxxo3LL MILFHnI6CFOO1bMbUxCgZ4PggbVryyN2IesThAWWQv9OCbckH0NXxqXZN/waN01YeLdE duWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777036922; x=1777641722; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=ybrSWmSvBg9HMhpBAZRFHbe/rCyD4fuA5/9B69lAdq8=; b=itaXS1uvuQPF55TYbfd74VIi/mKxRgqcscKwG1hH+PNCMr1OlPP5/bX3se8CvUid0A CsbFI1CP0+EbdsKlKbOOmGsXbgq6X9zxLrmCRTrTRO8SFWFK+lxdI0uNU3g5akxExEPi k1d0qFQibd/kYX/zfnID/M1SZNnuaB1XmM0nh7tw8OREhbVV+/KLSlbVBsVNb7vubkq5 34lWbseYrEn2eHFhgydjdxOCW9dF/jJBYklKGBPj+xgW29cJHVA/w63cZlgHsF7jSSKx eXd/fLcn2CRzv6p4ltqwzC/tQ55WxmCwvdcBCEf/2ccxv48RWLL7COJwC/MckC5AX0HI kTqw== X-Forwarded-Encrypted: i=1; AFNElJ8PgcI8FDE4X7O0VOXlgodoBrD6kjSrDtL/f/ishn8LdOYrOK7cQHeGo1SV8NZ2KxUXiCh6Nelhpx0MQGw=@vger.kernel.org X-Gm-Message-State: AOJu0YyMK3bAaARzAf19YmW56Olyps+yh9gJA+kSuW5mykDDYjI5AzeB 7M0xxejW3AxGt1ZohTyzy8P2Lj6XgwW+t3au9IIh8AWbu2ucys+waDRrBHDmMuCYfg== X-Gm-Gg: AeBDieucgGs5wQS/peOdlm2SOOh6iu308DSzzHmJsQW1hkN0FFd1iXcGC9QZYMJVOJ2 m91iIGvBUB5scMnHiMkfiz5/7yAbsuysXWBLans/xcfcLIVn/kexebK6c3mrFUbyNj96h51Ydha 1431ylS+QlkuXcwdntSMl2tA+xi6h4n9YtNLW25kpiu0ZYrWID8Fs71aFWvh7IJ67GNDLCQ7nT5 0rmxp2qGGMyIa5IqLuejua/TP8eMm7r52N8xUxjWEHj3nOsmrhG8dGn76LjwRvim8ZKU7pI13/l 9AQ0bhvjAFfb3R3QfBhQbyLxzZIxuw3xmmmTloNCxjbJxE61J1Q/exBmnYJERhnV8Sf9Wddg1dM YS2DcqzNQWuLKcVlxd39Y8KLFgU1UY34NcbPlnOL9o8svrC9dt1I62NjbEVFnIKyyabWOFqtpp2 KkDBsOOjWSj2NqK5VNr2U1IeaUSz9uB/UDPiYaDKRhWUkVVbjJ+hpbfVt+9p8jGTlx4rhL9b4O+ QueuHwOfg90sv8= X-Received: by 2002:a17:903:37c3:b0:2b7:aba0:ac10 with SMTP id d9443c01a7336-2b7aba0aea6mr72508065ad.11.1777036922129; Fri, 24 Apr 2026 06:22:02 -0700 (PDT) Received: from localhost.localdomain ([1.226.165.54]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b5fab30f29sm224955695ad.68.2026.04.24.06.22.00 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 24 Apr 2026 06:22:01 -0700 (PDT) From: Myeonghun Pak To: Jiri Kosina , Benjamin Tissoires Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Myeonghun Pak Subject: [PATCH] HID: u2fzero: free allocated URB on probe errors Date: Fri, 24 Apr 2026 22:21:31 +0900 Message-ID: <20260424-u2fzero-probe-urb-unwind-v1-1-mhun512@gmail.com> X-Mailer: git-send-email 2.47.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" u2fzero_fill_in_urb() allocates dev->urb with usb_alloc_urb(), but u2fzero_probe() ignored its return value and only freed the URB from u2fzero_remove(). If LED or hwrng registration fails after the URB allocation, probe returns an error and the driver core does not call .remove(), leaking the URB. A failed URB setup was also allowed to continue probing with an unusable device. Check the URB setup result and add the missing probe-error unwind so the URB is freed before returning from later errors. Signed-off-by: Myeonghun Pak --- drivers/hid/hid-u2fzero.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/drivers/hid/hid-u2fzero.c b/drivers/hid/hid-u2fzero.c index 744a91e6e7..82404b6e2d 100644 --- a/drivers/hid/hid-u2fzero.c +++ b/drivers/hid/hid-u2fzero.c @@ -341,29 +341,33 @@ static int u2fzero_probe(struct hid_device *hdev, if (ret) return ret; =20 - u2fzero_fill_in_urb(dev); + ret =3D u2fzero_fill_in_urb(dev); + if (ret) + goto err_hid_hw_stop; =20 dev->present =3D true; =20 minor =3D ((struct hidraw *) hdev->hidraw)->minor; =20 ret =3D u2fzero_init_led(dev, minor); - if (ret) { - hid_hw_stop(hdev); - return ret; - } + if (ret) + goto err_free_urb; =20 hid_info(hdev, "%s LED initialised\n", hw_configs[dev->hw_revision].name); =20 ret =3D u2fzero_init_hwrng(dev, minor); - if (ret) { - hid_hw_stop(hdev); - return ret; - } + if (ret) + goto err_free_urb; =20 hid_info(hdev, "%s RNG initialised\n", hw_configs[dev->hw_revision].name); =20 return 0; + +err_free_urb: + usb_free_urb(dev->urb); +err_hid_hw_stop: + hid_hw_stop(hdev); + return ret; } =20 static void u2fzero_remove(struct hid_device *hdev) --=20 2.50.1