From: Christophe JAILLET christophe.jaillet@wanadoo.fr
commit 33812fc7c8d77a43b7e2bf36a0d5a57c277a4b0c upstream.
If the timer introduced by the commit below is started, then it must be deleted in the error handling of the probe. Otherwise it would trigger once the driver is no more.
Fixes: 0b91b4e4dae6 ("HID: magicmouse: Report battery level over USB") Signed-off-by: Christophe JAILLET christophe.jaillet@wanadoo.fr Tested-by: José Expósito jose.exposito89@gmail.com Reported-by: syzbot+a437546ec71b04dfb5ac@syzkaller.appspotmail.com Signed-off-by: Jiri Kosina jkosina@suse.cz Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/hid/hid-magicmouse.c | 1 + 1 file changed, 1 insertion(+)
--- a/drivers/hid/hid-magicmouse.c +++ b/drivers/hid/hid-magicmouse.c @@ -873,6 +873,7 @@ static int magicmouse_probe(struct hid_d
return 0; err_stop_hw: + del_timer_sync(&msc->battery_timer); hid_hw_stop(hdev); return ret; }