lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Staging: ste_rmi4: use after input_unregister_device()

Browse Source 
The original code called input_free_device(rmi4_data->input_dev) after
input_unregister_device(rmi4_data->input_dev) and that's a double free.
This is described in the comments to input_unregister_device().

The normal way to handle this is to make input_register_device() the
last function in the probe which can fail.  That way you can avoid the
call to input_unregister_device() entirely.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Dan Carpenter
2010-12-23 00:07:33 +03:00
committed by Greg Kroah-Hartman
parent 64911e4b13
commit f32b8453e5
1 changed files with 9 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c
View File

@@ -986,12 +986,6 @@ static int __devinit synaptics_rmi4_probe
input_set_abs_params(rmi4_data->input_dev, ABS_MT_TOUCH_MAJOR, 0, input_set_abs_params(rmi4_data->input_dev, ABS_MT_TOUCH_MAJOR, 0,
MAX_TOUCH_MAJOR, 0, 0); MAX_TOUCH_MAJOR, 0, 0);
retval = input_register_device(rmi4_data->input_dev);
if (retval) {
dev_err(&client->dev, "%s:input register failed\n", __func__);
goto err_input_register;
}
/* Clear interrupts */ /* Clear interrupts */
synaptics_rmi4_i2c_block_read(rmi4_data, synaptics_rmi4_i2c_block_read(rmi4_data,
rmi4_data->fn01_data_base_addr + 1, intr_status, rmi4_data->fn01_data_base_addr + 1, intr_status,
@@ -1003,15 +997,20 @@ static int __devinit synaptics_rmi4_probe
if (retval) { if (retval) {
dev_err(&client->dev, "%s:Unable to get attn irq %d\n", dev_err(&client->dev, "%s:Unable to get attn irq %d\n",
__func__, platformdata->irq_number); __func__, platformdata->irq_number);
goto err_request_irq; goto err_unset_clientdata;
}
retval = input_register_device(rmi4_data->input_dev);
if (retval) {
dev_err(&client->dev, "%s:input register failed\n", __func__);
goto err_free_irq;
} }
return retval; return retval;
err_request_irq: err_free_irq:
free_irq(platformdata->irq_number, rmi4_data); free_irq(platformdata->irq_number, rmi4_data);
input_unregister_device(rmi4_data->input_dev); err_unset_clientdata:
err_input_register:
i2c_set_clientdata(client, NULL); i2c_set_clientdata(client, NULL);
err_query_dev: err_query_dev:
if (platformdata->regulator_en) { if (platformdata->regulator_en) {