Messages in this thread Patch in this message | | | From | trix@redhat ... | Subject | [PATCH] input: atmel_mxt_ts: fix double free | Date | Mon, 3 Aug 2020 06:48:32 -0700 |
| |
From: Tom Rix <trix@redhat.com>
Clang static analysis reports this error
atmel_mxt_ts.c:1850:2: warning: Attempt to free released memory kfree(id_buf); ^~~~~~~~~~~~~
The problem is with this code block
data->raw_info_block = id_buf; ... error = mxt_parse_object_table(data, id_buf + MXT_OBJECT_START); if (error) { dev_err(&client->dev, "Error %d parsing object table\n", error); mxt_free_object_table(data); goto err_free_mem; }
mxt_free_object_table() frees id_buf
kfree(data->raw_info_block);
So skip over the second free
Fixes: 068bdb67ef74 ("Input: atmel_mxt_ts - fix the firmware update")
Signed-off-by: Tom Rix <trix@redhat.com> --- drivers/input/touchscreen/atmel_mxt_ts.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c index 6b71b0aff115..1cc0f492f4f4 100644 --- a/drivers/input/touchscreen/atmel_mxt_ts.c +++ b/drivers/input/touchscreen/atmel_mxt_ts.c @@ -1839,7 +1839,7 @@ static int mxt_read_info_block(struct mxt_data *data) if (error) { dev_err(&client->dev, "Error %d parsing object table\n", error); mxt_free_object_table(data); - goto err_free_mem; + goto err_free_mem1; } data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START); @@ -1848,6 +1848,7 @@ static int mxt_read_info_block(struct mxt_data *data) err_free_mem: kfree(id_buf); +err_free_mem1: return error; } -- 2.18.1
| |