* [PATCH] Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_alloc()
@ 2026-05-22 8:54 Thomas Fourier
2026-05-23 5:05 ` Dmitry Torokhov
0 siblings, 1 reply; 2+ messages in thread
From: Thomas Fourier @ 2026-05-22 8:54 UTC (permalink / raw)
Cc: Thomas Fourier, stable, Dmitry Torokhov, Dan Carpenter,
Seungjin Bae, Sanghoon Choi, Kees Cook, linux-input, linux-kernel
The input buffer size is pcu->max_in_size, but pcu->max_out_size is
passed to usb_free_coherent().
Change size to match the allocation size.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
---
drivers/input/misc/ims-pcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index 4c022a36dbe8..7a1cb9333f53 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1624,7 +1624,7 @@ static void ims_pcu_buffers_free(struct ims_pcu *pcu)
usb_kill_urb(pcu->urb_in);
usb_free_urb(pcu->urb_in);
- usb_free_coherent(pcu->udev, pcu->max_out_size,
+ usb_free_coherent(pcu->udev, pcu->max_in_size,
pcu->urb_in_buf, pcu->read_dma);
kfree(pcu->urb_out_buf);
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_alloc()
2026-05-22 8:54 [PATCH] Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_alloc() Thomas Fourier
@ 2026-05-23 5:05 ` Dmitry Torokhov
0 siblings, 0 replies; 2+ messages in thread
From: Dmitry Torokhov @ 2026-05-23 5:05 UTC (permalink / raw)
To: Thomas Fourier
Cc: stable, Dan Carpenter, Seungjin Bae, Sanghoon Choi, Kees Cook,
linux-input, linux-kernel
On Fri, May 22, 2026 at 10:54:04AM +0200, Thomas Fourier wrote:
> The input buffer size is pcu->max_in_size, but pcu->max_out_size is
> passed to usb_free_coherent().
>
> Change size to match the allocation size.
>
> Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Applied, thank you.
--
Dmitry
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-05-23 5:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-22 8:54 [PATCH] Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_alloc() Thomas Fourier
2026-05-23 5:05 ` Dmitry Torokhov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox