HID: magicmouse: Fix an error handling path in magicmouse_probe()

If the timer introduced by the commit below is started, then it must be
deleted in the error handling of the probe. Otherwise it would trigger
once the driver is no more.

Fixes: 0b91b4e4dae6 ("HID: magicmouse: Report battery level over USB")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Tested-by: José Expósito <jose.exposito89@gmail.com>
Reported-by: <syzbot+a437546ec71b04dfb5ac@syzkaller.appspotmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index 167b6a5..39d7956 100644 (file)
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -870,6 +870,7 @@ static int magicmouse_probe(struct hid_device *hdev,
 
        return 0;
 err_stop_hw:
+       del_timer_sync(&msc->battery_timer);
        hid_hw_stop(hdev);
        return ret;
 }