[PATCH] HID: elan: Fix potential double free in elan_input_configured

Miaoqian Lin posted 1 patch 4 years, 2 months ago
drivers/hid/hid-elan.c | 2 --
1 file changed, 2 deletions(-)
[PATCH] HID: elan: Fix potential double free in elan_input_configured
Posted by Miaoqian Lin 4 years, 2 months ago
'input' is a managed resource allocated with devm_input_allocate_device(),
so there is no need to call input_free_device() explicitly or
there will be a double free.

According to the doc of devm_input_allocate_device():
 * Managed input devices do not need to be explicitly unregistered or
 * freed as it will be done automatically when owner device unbinds from
 * its driver (or binding fails).

Fixes: b7429ea53d6c ("HID: elan: Fix memleak in elan_input_configured")
Fixes: 9a6a4193d65b ("HID: Add driver for USB ELAN Touchpad")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
---
 drivers/hid/hid-elan.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/hid/hid-elan.c b/drivers/hid/hid-elan.c
index 3091355d48df..8e4a5528e25d 100644
--- a/drivers/hid/hid-elan.c
+++ b/drivers/hid/hid-elan.c
@@ -188,7 +188,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
 	ret = input_mt_init_slots(input, ELAN_MAX_FINGERS, INPUT_MT_POINTER);
 	if (ret) {
 		hid_err(hdev, "Failed to init elan MT slots: %d\n", ret);
-		input_free_device(input);
 		return ret;
 	}
 
@@ -200,7 +199,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
 		hid_err(hdev, "Failed to register elan input device: %d\n",
 			ret);
 		input_mt_destroy_slots(input);
-		input_free_device(input);
 		return ret;
 	}
 
-- 
2.17.1
Re: [PATCH] HID: elan: Fix potential double free in elan_input_configured
Posted by Benjamin Tissoires 4 years, 1 month ago
On Sat, Apr 16, 2022 at 9:37 AM Miaoqian Lin <linmq006@gmail.com> wrote:
>
> 'input' is a managed resource allocated with devm_input_allocate_device(),
> so there is no need to call input_free_device() explicitly or
> there will be a double free.
>
> According to the doc of devm_input_allocate_device():
>  * Managed input devices do not need to be explicitly unregistered or
>  * freed as it will be done automatically when owner device unbinds from
>  * its driver (or binding fails).
>
> Fixes: b7429ea53d6c ("HID: elan: Fix memleak in elan_input_configured")
> Fixes: 9a6a4193d65b ("HID: Add driver for USB ELAN Touchpad")
> Signed-off-by: Miaoqian Lin <linmq006@gmail.com>

Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>

Thanks for the patch!

Cheers,
Benjamin

> ---
>  drivers/hid/hid-elan.c | 2 --
>  1 file changed, 2 deletions(-)
>
> diff --git a/drivers/hid/hid-elan.c b/drivers/hid/hid-elan.c
> index 3091355d48df..8e4a5528e25d 100644
> --- a/drivers/hid/hid-elan.c
> +++ b/drivers/hid/hid-elan.c
> @@ -188,7 +188,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
>         ret = input_mt_init_slots(input, ELAN_MAX_FINGERS, INPUT_MT_POINTER);
>         if (ret) {
>                 hid_err(hdev, "Failed to init elan MT slots: %d\n", ret);
> -               input_free_device(input);
>                 return ret;
>         }
>
> @@ -200,7 +199,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
>                 hid_err(hdev, "Failed to register elan input device: %d\n",
>                         ret);
>                 input_mt_destroy_slots(input);
> -               input_free_device(input);
>                 return ret;
>         }
>
> --
> 2.17.1
>
Re: [PATCH] HID: elan: Fix potential double free in elan_input_configured
Posted by Jiri Kosina 4 years, 1 month ago
On Thu, 21 Apr 2022, Benjamin Tissoires wrote:

> On Sat, Apr 16, 2022 at 9:37 AM Miaoqian Lin <linmq006@gmail.com> wrote:
> >
> > 'input' is a managed resource allocated with devm_input_allocate_device(),
> > so there is no need to call input_free_device() explicitly or
> > there will be a double free.
> >
> > According to the doc of devm_input_allocate_device():
> >  * Managed input devices do not need to be explicitly unregistered or
> >  * freed as it will be done automatically when owner device unbinds from
> >  * its driver (or binding fails).
> >
> > Fixes: b7429ea53d6c ("HID: elan: Fix memleak in elan_input_configured")
> > Fixes: 9a6a4193d65b ("HID: Add driver for USB ELAN Touchpad")
> > Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
> 
> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
> 
> Thanks for the patch!

Hmm, this patch never seems to have reached my inbox, but we've had some 
trouble with our mailserver over the Easter weekend, so that could be it.

Thanks for the fix indeed, applied now to hid.git#for-5.18/upstream-fixes

-- 
Jiri Kosina
SUSE Labs