[PATCH] HID: core: Avoid leaking field ordering on repeated connect

[Nazarii Tupitsa]

hid_connect() builds report->field_entries for every input report. Some
drivers stop and restart the same parsed HID device. Wacom wireless does
this when the connected tablet changes. Each subsequent hid_connect()
overwrites field_entries and leaks the previous allocation.

No physical Wacom device was available, so the reproducer was built with a
Raspberry Pi Pico. It emulates the affected wireless receiver lifecycle and
repeats the tablet connect/disconnect sequence.

The ordering is owned by the parsed struct hid_report and remains valid
until hid_free_report() destroys the report. Skip initialization when the
ordering has already been built. If allocation fails, field_entries remains
NULL so a later connect can retry.

On Linux 7.2.3, the Pico emulated a Wacom 056a:0084 wireless receiver. An
unpatched run with repeated tablet connect/disconnect cycles left multiple
unreferenced 512-byte allocations in a kmemleak scan. With this change,
repeated cycles successfully recreated the Pen, Pad and Finger devices, and
scans after removing the receiver found no leaks.

A representative kmemleak entry was:

  unreferenced object (size 512):
    backtrace:
      __kmalloc_noprof
      hid_connect
      hid_hw_start
      wacom_parse_and_register [wacom]
      wacom_wireless_work [wacom]

Fixes: 22f4b026c3dd ("HID: compute an ordered list of input fields to process")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Codex:GPT-5
Signed-off-by: Nazarii Tupitsa <nazarii.tupitsa@xxxxxxxxx>
---
 drivers/hid/hid-core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index a3ff0514f..9f4ba5f60 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1802,6 +1802,9 @@ static void hid_report_process_ordering(struct hid_device *hid,
 	unsigned int a, u, usages;
 	unsigned int count = 0;
 
+	if (report->field_entries)
+		return;
+
 	/* count the number of individual fields in the report */
 	for (a = 0; a < report->maxfield; a++) {
 		field = report->field[a];

base-commit: 23da087d9a636d9b2046f3aa3b7470ae51b89c8a
-- 
2.50.1