Messages in this thread | | | Date | Mon, 03 Aug 2015 13:57:55 +0900 | From | Krzysztof Kozlowski <> | Subject | Re: [PATCH v2] HID: hid-input: Fix accessing freed memory during device disconnect |
| |
On 03.08.2015 09:01, Krzysztof Kozlowski wrote: > During unbinding the driver was dereferencing a pointer to memory > already freed by power_supply_unregister(). > > Driver was freeing its internal description of battery through pointers > stored in power_supply structure. However, because the core owns the > power supply instance, after calling power_supply_unregister() this > memory is freed and the driver cannot access these members. > > Fix this by storing the pointer to internal description of battery in a > local variable before calling power_supply_unregister(), so the pointer > remains valid. > > Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com> > Reported-by: H.J. Lu <hjl.tools@gmail.com> > Fixes: 297d716f6260 ("power_supply: Change ownership from driver to core") > Cc: <stable@vger.kernel.org> > > --- > Changes since v1: > 1. Re-work idea, use local variable instead of devm-like functions > (pointed out by Dmitry Torokhov). > 2. Adjusted subject and commit message.
I missed the warning: drivers/hid/hid-input.c:470:11: warning: assignment discards ‘const’ qualifier from pointer target type
I'll fix this and send v3.
Best regards, Krzysztof
| |