lkml.org 
[lkml]   [2020]   [Aug]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] input: atmel_mxt_ts: fix double free
Date
From: Tom Rix <trix@redhat.com>

Clang static analysis reports this error

atmel_mxt_ts.c:1850:2: warning: Attempt to free released memory
kfree(id_buf);
^~~~~~~~~~~~~

The problem is with this code block

data->raw_info_block = id_buf;
...
error = mxt_parse_object_table(data, id_buf + MXT_OBJECT_START);
if (error) {
dev_err(&client->dev, "Error %d parsing object table\n", error);
mxt_free_object_table(data);
goto err_free_mem;
}

mxt_free_object_table() frees id_buf

kfree(data->raw_info_block);

So skip over the second free

Fixes: 068bdb67ef74 ("Input: atmel_mxt_ts - fix the firmware update")

Signed-off-by: Tom Rix <trix@redhat.com>
---
drivers/input/touchscreen/atmel_mxt_ts.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 6b71b0aff115..1cc0f492f4f4 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -1839,7 +1839,7 @@ static int mxt_read_info_block(struct mxt_data *data)
if (error) {
dev_err(&client->dev, "Error %d parsing object table\n", error);
mxt_free_object_table(data);
- goto err_free_mem;
+ goto err_free_mem1;
}

data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
@@ -1848,6 +1848,7 @@ static int mxt_read_info_block(struct mxt_data *data)

err_free_mem:
kfree(id_buf);
+err_free_mem1:
return error;
}

--
2.18.1
\
 
 \ /
  Last update: 2020-08-03 15:49    [W:0.030 / U:0.976 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site