HID: u2fzero: free allocated URB on probe errors

u2fzero_fill_in_urb() allocates dev->urb with usb_alloc_urb(), but
u2fzero_probe() ignored its return value and only freed the URB from
u2fzero_remove().

If LED or hwrng registration fails after the URB allocation, probe returns
an error and the driver core does not call .remove(), leaking the URB. A
failed URB setup was also allowed to continue probing with an unusable
device.

Check the URB setup result and add the missing probe-error unwind so the
URB is freed before returning from later errors.

Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

diff --git a/drivers/hid/hid-u2fzero.c b/drivers/hid/hid-u2fzero.c
index 744a91e6e78c5d9d0a41a17b1687101463edaa62..82404b6e2d253d3ff16c29dc2ed923cd60c11101 100644 (file)
--- a/drivers/hid/hid-u2fzero.c
+++ b/drivers/hid/hid-u2fzero.c
@@ -341,29 +341,33 @@ static int u2fzero_probe(struct hid_device *hdev,
        if (ret)
                return ret;
 
-       u2fzero_fill_in_urb(dev);
+       ret = u2fzero_fill_in_urb(dev);
+       if (ret)
+               goto err_hid_hw_stop;
 
        dev->present = true;
 
        minor = ((struct hidraw *) hdev->hidraw)->minor;
 
        ret = u2fzero_init_led(dev, minor);
-       if (ret) {
-               hid_hw_stop(hdev);
-               return ret;
-       }
+       if (ret)
+               goto err_free_urb;
 
        hid_info(hdev, "%s LED initialised\n", hw_configs[dev->hw_revision].name);
 
        ret = u2fzero_init_hwrng(dev, minor);
-       if (ret) {
-               hid_hw_stop(hdev);
-               return ret;
-       }
+       if (ret)
+               goto err_free_urb;
 
        hid_info(hdev, "%s RNG initialised\n", hw_configs[dev->hw_revision].name);
 
        return 0;
+
+err_free_urb:
+       usb_free_urb(dev->urb);
+err_hid_hw_stop:
+       hid_hw_stop(hdev);
+       return ret;
 }
 
 static void u2fzero_remove(struct hid_device *hdev)