Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ecdb33c0 authored by Pan Bian's avatar Pan Bian Committed by Greg Kroah-Hartman
Browse files

Input: synaptics-rmi4 - fix possible double free 



[ Upstream commit bce1a78423961fce676ac65540a31b6ffd179e6d ]

The RMI4 function structure has been released in rmi_register_function
if error occurs. However, it will be released again in the function
rmi_create_function, which may result in a double-free bug.

Signed-off-by: default avatarPan Bian <bianpan2016@163.com>
Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 737b6bcd

drivers/input/rmi4/rmi_driver.c

+1 −5
Original line number Diff line number Diff line
@@ -772,7 +772,7 @@ static int rmi_create_function(struct rmi_device *rmi_dev, 


	error = rmi_register_function(fn);

	if (error)

		goto err_put_fn;

		return error;



	if (pdt->function_number == 0x01)

		data->f01_container = fn;
@@ -780,10 +780,6 @@ static int rmi_create_function(struct rmi_device *rmi_dev, 
	list_add_tail(&fn->node, &data->function_list);



	return RMI_SCAN_CONTINUE;



err_put_fn:

	put_device(&fn->dev);

	return error;

}



int rmi_driver_suspend(struct rmi_device *rmi_dev)