Input: cm109 - do not stomp on control URB

commit 82e06090473289ce63e23fdeb8737aad59b10645 upstream.

We need to make sure we are not stomping on the control URB that was
issued when opening the device when attempting to toggle buzzer.
To do that we need to mark it as pending in cm109_open().

Reported-and-tested-by: syzbot+150f793ac5bc18eee150@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
index 50a7faa504f722a9157a65b6ef76ccc900b77e0d..c8c6650b9140bdb7319c5b76f22205a9b526b50a 100644 (file)
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -546,12 +546,15 @@ static int cm109_input_open(struct input_dev *idev)
        dev->ctl_data->byte[HID_OR2] = dev->keybit;
        dev->ctl_data->byte[HID_OR3] = 0x00;
 
+       dev->ctl_urb_pending = 1;
        error = usb_submit_urb(dev->urb_ctl, GFP_KERNEL);
-       if (error)
+       if (error) {
+               dev->ctl_urb_pending = 0;
                dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n",
                        __func__, error);
-       else
+       } else {
                dev->open = 1;
+       }
 
        mutex_unlock(&dev->pm_mutex);