HID: magicmouse: Fix an error handling path in magicmouse_probe()

If the timer introduced by the commit below is started, then it must be
deleted in the error handling of the probe. Otherwise it would trigger
once the driver is no more.

Fixes: 0b91b4e4dae6 ("HID: magicmouse: Report battery level over USB")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Tested-by: José Expósito <jose.exposito89@gmail.com>
Reported-by: <syzbot+a437546ec71b04dfb5ac@syzkaller.appspotmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index 167b6a5dd226ae73e570738acb7f69007ee6de54..39d7956066cfd0c5d9c7d1028f1c957d7e5a9fff 100644 (file)
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -870,6 +870,7 @@ static int magicmouse_probe(struct hid_device *hdev,
 
        return 0;
 err_stop_hw:
+       del_timer_sync(&msc->battery_timer);
        hid_hw_stop(hdev);
        return ret;
 }