UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

HID: fix possible double-free on error path in hid parser 

Freeing of device->collection is properly done in hid_free_device() (as
this function is supposed to free all the device resources and could be
called from transport specific code, e.g. usb_hid_configure()).

Remove all kfree() calls preceeding the hid_free_device() call.

Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This commit is contained in:
Jiri Kosina 2007-02-21 17:18:03 +01:00
parent 4330eb2e5f
commit 776c0e96ed
1 changed files with 0 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/hid/hid-core.c
View File

@ -667,7 +667,6 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size)
if (item.format != HID_ITEM_FORMAT_SHORT) { if (item.format != HID_ITEM_FORMAT_SHORT) {
dbg("unexpected long global item"); dbg("unexpected long global item");
kfree(device->collection);
hid_free_device(device); hid_free_device(device);
kfree(parser); kfree(parser);
return NULL; return NULL;
@ -676,7 +675,6 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size)
if (dispatch_type[item.type](parser, &item)) { if (dispatch_type[item.type](parser, &item)) {
dbg("item %u %u %u %u parsing failed\n", dbg("item %u %u %u %u parsing failed\n",
item.format, (unsigned)item.size, (unsigned)item.type, (unsigned)item.tag); item.format, (unsigned)item.size, (unsigned)item.type, (unsigned)item.tag);
kfree(device->collection);
hid_free_device(device); hid_free_device(device);
kfree(parser); kfree(parser);
return NULL; return NULL;
@ -685,14 +683,12 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size)
if (start == end) { if (start == end) {
if (parser->collection_stack_ptr) { if (parser->collection_stack_ptr) {
dbg("unbalanced collection at end of report description"); dbg("unbalanced collection at end of report description");
kfree(device->collection);
hid_free_device(device); hid_free_device(device);
kfree(parser); kfree(parser);
return NULL; return NULL;
} }
if (parser->local.delimiter_depth) { if (parser->local.delimiter_depth) {
dbg("unbalanced delimiter at end of report description"); dbg("unbalanced delimiter at end of report description");
kfree(device->collection);
hid_free_device(device); hid_free_device(device);
kfree(parser); kfree(parser);
return NULL; return NULL;
@ -703,7 +699,6 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size)
} }
dbg("item fetching failed at offset %d\n", (int)(end - start)); dbg("item fetching failed at offset %d\n", (int)(end - start));
kfree(device->collection);
hid_free_device(device); hid_free_device(device);
kfree(parser); kfree(parser);
return NULL; return NULL;