Input: cm109 - do not stomp on control URB

We need to make sure we are not stomping on the control URB that was
issued when opening the device when attempting to toggle buzzer.
To do that we need to mark it as pending in cm109_open().

Reported-and-tested-by: syzbot+150f793ac5bc18eee150@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
index e413801f04910b581f8238d149486d1f8be451d6..f515fae465c35a9385defc26fcfda9e2e198efe6 100644 (file)
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -568,12 +568,15 @@ static int cm109_input_open(struct input_dev *idev)
        dev->ctl_data->byte[HID_OR2] = dev->keybit;
        dev->ctl_data->byte[HID_OR3] = 0x00;
 
+       dev->ctl_urb_pending = 1;
        error = usb_submit_urb(dev->urb_ctl, GFP_KERNEL);
-       if (error)
+       if (error) {
+               dev->ctl_urb_pending = 0;
                dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n",
                        __func__, error);
-       else
+       } else {
                dev->open = 1;
+       }
 
        mutex_unlock(&dev->pm_mutex);