redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

HID: hid-bigbenff: fix general protection fault caused by double kfree 

[ Upstream commit 789a2c2503 ]

The struct *bigben was allocated via devm_kzalloc() and then used as a
parameter in input_ff_create_memless(). This caused a double kfree
during removal of the device, since both the managed resource API and
ml_ff_destroy() in drivers/input/ff-memless.c would call kfree() on it.

Signed-off-by: Hanno Zulla <kontakt@hanno.de>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
5.4-rM2-2.2.x-imx-squashed
Hanno Zulla 2020-02-18 12:37:47 +01:00 committed by Greg Kroah-Hartman
parent 190e929e6c
commit 1bc271dd39
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/hid/hid-bigbenff.c
View File

@ -220,10 +220,16 @@ static void bigben_worker(struct work_struct *work)
static int hid_bigben_play_effect(struct input_dev *dev, void *data,
struct ff_effect *effect)
{
struct bigben_device *bigben = data;
struct hid_device *hid = input_get_drvdata(dev);
struct bigben_device *bigben = hid_get_drvdata(hid);
u8 right_motor_on;
u8 left_motor_force;
if (!bigben) {
hid_err(hid, "no device data\n");
return 0;
}
if (effect->type != FF_RUMBLE)
return 0;
@ -341,7 +347,7 @@ static int bigben_probe(struct hid_device *hid,
INIT_WORK(&bigben->worker, bigben_worker);
error = input_ff_create_memless(hidinput->input, bigben,
error = input_ff_create_memless(hidinput->input, NULL,
hid_bigben_play_effect);
if (error)
return error;