korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-28 22:54:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

HID: multitouch: prevent memleak with the allocated name

Browse Source 
mt_free_input_name() was never called during .remove():
hid_hw_stop() removes the hid_input items in hdev->inputs, and so the
list is therefore empty after the call. In the end, we never free the
special names that has been allocated during .probe().

Restore the original name before freeing it to avoid acessing already
freed pointer.

This fixes a regression introduced by 49a5a827a ("HID: multitouch: append " Pen" to
the name of the stylus input")

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This commit is contained in:
Benjamin Tissoires 2013-05-29 10:45:09 +02:00 committed by Jiri Kosina
parent 1deb9d341d
commit 5939212df8
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/hid/hid-multitouch.c
View File

@ -264,9 +264,12 @@ static struct mt_class mt_classes[] = {
static void mt_free_input_name(struct hid_input *hi) static void mt_free_input_name(struct hid_input *hi)
{ {
struct hid_device *hdev = hi->report->device; struct hid_device *hdev = hi->report->device;
const char *name = hi->input->name;
if (hi->input->name != hdev->name) if (name != hdev->name) {
kfree(hi->input->name); hi->input->name = hdev->name;
kfree(name);
}
} }
static ssize_t mt_show_quirks(struct device *dev, static ssize_t mt_show_quirks(struct device *dev,
@ -1040,11 +1043,11 @@ static void mt_remove(struct hid_device *hdev)
struct hid_input *hi; struct hid_input *hi;
sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group); sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group);
hid_hw_stop(hdev);
list_for_each_entry(hi, &hdev->inputs, list) list_for_each_entry(hi, &hdev->inputs, list)
mt_free_input_name(hi); mt_free_input_name(hi);
hid_hw_stop(hdev);
kfree(td); kfree(td);
hid_set_drvdata(hdev, NULL); hid_set_drvdata(hdev, NULL);
} }