lkml.org 
[lkml]   [2019]   [May]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 60/81] Input: synaptics-rmi4 - fix possible double free
    Date
    From: Pan Bian <bianpan2016@163.com>

    [ Upstream commit bce1a78423961fce676ac65540a31b6ffd179e6d ]

    The RMI4 function structure has been released in rmi_register_function
    if error occurs. However, it will be released again in the function
    rmi_create_function, which may result in a double-free bug.

    Signed-off-by: Pan Bian <bianpan2016@163.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/input/rmi4/rmi_driver.c | 6 +-----
    1 file changed, 1 insertion(+), 5 deletions(-)

    diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
    index fc3ab93b7aea..7fb358f96195 100644
    --- a/drivers/input/rmi4/rmi_driver.c
    +++ b/drivers/input/rmi4/rmi_driver.c
    @@ -860,7 +860,7 @@ static int rmi_create_function(struct rmi_device *rmi_dev,

    error = rmi_register_function(fn);
    if (error)
    - goto err_put_fn;
    + return error;

    if (pdt->function_number == 0x01)
    data->f01_container = fn;
    @@ -870,10 +870,6 @@ static int rmi_create_function(struct rmi_device *rmi_dev,
    list_add_tail(&fn->node, &data->function_list);

    return RMI_SCAN_CONTINUE;
    -
    -err_put_fn:
    - put_device(&fn->dev);
    - return error;
    }

    void rmi_enable_irq(struct rmi_device *rmi_dev, bool clear_wake)
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-05-07 07:57    [W:2.571 / U:0.508 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site