diff options
| author | Hanno Zulla <kontakt@hanno.de> | 2020-02-18 12:37:47 +0100 |
|---|---|---|
| committer | Benjamin Tissoires <benjamin.tissoires@redhat.com> | 2020-02-18 14:43:45 +0100 |
| commit | 789a2c250340666220fa74bc6c8f58497e3863b3 (patch) | |
| tree | 8f4e8b7be70806234ce887305a629abcf44b2638 /drivers/hid/hid-bigbenff.c | |
| parent | be0aba826c4a6ba5929def1962a90d6127871969 (diff) | |
| download | linux-789a2c250340666220fa74bc6c8f58497e3863b3.tar.gz linux-789a2c250340666220fa74bc6c8f58497e3863b3.tar.bz2 linux-789a2c250340666220fa74bc6c8f58497e3863b3.zip | |
HID: hid-bigbenff: fix general protection fault caused by double kfree
The struct *bigben was allocated via devm_kzalloc() and then used as a
parameter in input_ff_create_memless(). This caused a double kfree
during removal of the device, since both the managed resource API and
ml_ff_destroy() in drivers/input/ff-memless.c would call kfree() on it.
Signed-off-by: Hanno Zulla <kontakt@hanno.de>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Diffstat (limited to 'drivers/hid/hid-bigbenff.c')
| -rw-r--r-- | drivers/hid/hid-bigbenff.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c index 3f6abd190df4..f7e85bacb688 100644 --- a/drivers/hid/hid-bigbenff.c +++ b/drivers/hid/hid-bigbenff.c @@ -220,10 +220,16 @@ static void bigben_worker(struct work_struct *work) static int hid_bigben_play_effect(struct input_dev *dev, void *data, struct ff_effect *effect) { - struct bigben_device *bigben = data; + struct hid_device *hid = input_get_drvdata(dev); + struct bigben_device *bigben = hid_get_drvdata(hid); u8 right_motor_on; u8 left_motor_force; + if (!bigben) { + hid_err(hid, "no device data\n"); + return 0; + } + if (effect->type != FF_RUMBLE) return 0; @@ -341,7 +347,7 @@ static int bigben_probe(struct hid_device *hid, INIT_WORK(&bigben->worker, bigben_worker); - error = input_ff_create_memless(hidinput->input, bigben, + error = input_ff_create_memless(hidinput->input, NULL, hid_bigben_play_effect); if (error) return error; |