| Message ID | 20220416073721.3954-1-linmq006@gmail.com |
|---|---|
| State | Accepted |
| Commit | 1af20714fedad238362571620be0bd690ded05b6 |
| Headers | show |
| Series | HID: elan: Fix potential double free in elan_input_configured | expand |
On Sat, Apr 16, 2022 at 9:37 AM Miaoqian Lin <linmq006@gmail.com> wrote: > > 'input' is a managed resource allocated with devm_input_allocate_device(), > so there is no need to call input_free_device() explicitly or > there will be a double free. > > According to the doc of devm_input_allocate_device(): > * Managed input devices do not need to be explicitly unregistered or > * freed as it will be done automatically when owner device unbinds from > * its driver (or binding fails). > > Fixes: b7429ea53d6c ("HID: elan: Fix memleak in elan_input_configured") > Fixes: 9a6a4193d65b ("HID: Add driver for USB ELAN Touchpad") > Signed-off-by: Miaoqian Lin <linmq006@gmail.com> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Thanks for the patch! Cheers, Benjamin > --- > drivers/hid/hid-elan.c | 2 -- > 1 file changed, 2 deletions(-) > > diff --git a/drivers/hid/hid-elan.c b/drivers/hid/hid-elan.c > index 3091355d48df..8e4a5528e25d 100644 > --- a/drivers/hid/hid-elan.c > +++ b/drivers/hid/hid-elan.c > @@ -188,7 +188,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi) > ret = input_mt_init_slots(input, ELAN_MAX_FINGERS, INPUT_MT_POINTER); > if (ret) { > hid_err(hdev, "Failed to init elan MT slots: %d\n", ret); > - input_free_device(input); > return ret; > } > > @@ -200,7 +199,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi) > hid_err(hdev, "Failed to register elan input device: %d\n", > ret); > input_mt_destroy_slots(input); > - input_free_device(input); > return ret; > } > > -- > 2.17.1 >
On Thu, 21 Apr 2022, Benjamin Tissoires wrote: > On Sat, Apr 16, 2022 at 9:37 AM Miaoqian Lin <linmq006@gmail.com> wrote: > > > > 'input' is a managed resource allocated with devm_input_allocate_device(), > > so there is no need to call input_free_device() explicitly or > > there will be a double free. > > > > According to the doc of devm_input_allocate_device(): > > * Managed input devices do not need to be explicitly unregistered or > > * freed as it will be done automatically when owner device unbinds from > > * its driver (or binding fails). > > > > Fixes: b7429ea53d6c ("HID: elan: Fix memleak in elan_input_configured") > > Fixes: 9a6a4193d65b ("HID: Add driver for USB ELAN Touchpad") > > Signed-off-by: Miaoqian Lin <linmq006@gmail.com> > > Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> > > Thanks for the patch! Hmm, this patch never seems to have reached my inbox, but we've had some trouble with our mailserver over the Easter weekend, so that could be it. Thanks for the fix indeed, applied now to hid.git#for-5.18/upstream-fixes
diff --git a/drivers/hid/hid-elan.c b/drivers/hid/hid-elan.c index 3091355d48df..8e4a5528e25d 100644 --- a/drivers/hid/hid-elan.c +++ b/drivers/hid/hid-elan.c @@ -188,7 +188,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi) ret = input_mt_init_slots(input, ELAN_MAX_FINGERS, INPUT_MT_POINTER); if (ret) { hid_err(hdev, "Failed to init elan MT slots: %d\n", ret); - input_free_device(input); return ret; } @@ -200,7 +199,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi) hid_err(hdev, "Failed to register elan input device: %d\n", ret); input_mt_destroy_slots(input); - input_free_device(input); return ret; }
'input' is a managed resource allocated with devm_input_allocate_device(), so there is no need to call input_free_device() explicitly or there will be a double free. According to the doc of devm_input_allocate_device(): * Managed input devices do not need to be explicitly unregistered or * freed as it will be done automatically when owner device unbinds from * its driver (or binding fails). Fixes: b7429ea53d6c ("HID: elan: Fix memleak in elan_input_configured") Fixes: 9a6a4193d65b ("HID: Add driver for USB ELAN Touchpad") Signed-off-by: Miaoqian Lin <linmq006@gmail.com> --- drivers/hid/hid-elan.c | 2 -- 1 file changed, 2 deletions(-)