Input: cm109 - do not stomp on control URB

commit 82e06090473289ce63e23fdeb8737aad59b10645 upstream.

We need to make sure we are not stomping on the control URB that was
issued when opening the device when attempting to toggle buzzer.
To do that we need to mark it as pending in cm109_open().

Reported-and-tested-by: syzbot+150f793ac5bc18eee150@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
index 23c191a2a0715abe9584760742327b25f058d53b..cf4d507efaf6d13404691d6c955eb3e6ca1f77e2 100644 (file)
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -571,12 +571,15 @@ static int cm109_input_open(struct input_dev *idev)
        dev->ctl_data->byte[HID_OR2] = dev->keybit;
        dev->ctl_data->byte[HID_OR3] = 0x00;
 
+       dev->ctl_urb_pending = 1;
        error = usb_submit_urb(dev->urb_ctl, GFP_KERNEL);
-       if (error)
+       if (error) {
+               dev->ctl_urb_pending = 0;
                dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n",
                        __func__, error);
-       else
+       } else {
                dev->open = 1;
+       }
 
        mutex_unlock(&dev->pm_mutex);