2022-04-16 09:24:14

by Miaoqian Lin

[permalink] [raw]
Subject: [PATCH] HID: elan: Fix potential double free in elan_input_configured

'input' is a managed resource allocated with devm_input_allocate_device(),
so there is no need to call input_free_device() explicitly or
there will be a double free.

According to the doc of devm_input_allocate_device():
* Managed input devices do not need to be explicitly unregistered or
* freed as it will be done automatically when owner device unbinds from
* its driver (or binding fails).

Fixes: b7429ea53d6c ("HID: elan: Fix memleak in elan_input_configured")
Fixes: 9a6a4193d65b ("HID: Add driver for USB ELAN Touchpad")
Signed-off-by: Miaoqian Lin <[email protected]>
---
drivers/hid/hid-elan.c | 2 --
1 file changed, 2 deletions(-)

diff --git a/drivers/hid/hid-elan.c b/drivers/hid/hid-elan.c
index 3091355d48df..8e4a5528e25d 100644
--- a/drivers/hid/hid-elan.c
+++ b/drivers/hid/hid-elan.c
@@ -188,7 +188,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
ret = input_mt_init_slots(input, ELAN_MAX_FINGERS, INPUT_MT_POINTER);
if (ret) {
hid_err(hdev, "Failed to init elan MT slots: %d\n", ret);
- input_free_device(input);
return ret;
}

@@ -200,7 +199,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
hid_err(hdev, "Failed to register elan input device: %d\n",
ret);
input_mt_destroy_slots(input);
- input_free_device(input);
return ret;
}

--
2.17.1


2022-04-21 19:29:18

by Benjamin Tissoires

[permalink] [raw]
Subject: Re: [PATCH] HID: elan: Fix potential double free in elan_input_configured

On Sat, Apr 16, 2022 at 9:37 AM Miaoqian Lin <[email protected]> wrote:
>
> 'input' is a managed resource allocated with devm_input_allocate_device(),
> so there is no need to call input_free_device() explicitly or
> there will be a double free.
>
> According to the doc of devm_input_allocate_device():
> * Managed input devices do not need to be explicitly unregistered or
> * freed as it will be done automatically when owner device unbinds from
> * its driver (or binding fails).
>
> Fixes: b7429ea53d6c ("HID: elan: Fix memleak in elan_input_configured")
> Fixes: 9a6a4193d65b ("HID: Add driver for USB ELAN Touchpad")
> Signed-off-by: Miaoqian Lin <[email protected]>

Acked-by: Benjamin Tissoires <[email protected]>

Thanks for the patch!

Cheers,
Benjamin

> ---
> drivers/hid/hid-elan.c | 2 --
> 1 file changed, 2 deletions(-)
>
> diff --git a/drivers/hid/hid-elan.c b/drivers/hid/hid-elan.c
> index 3091355d48df..8e4a5528e25d 100644
> --- a/drivers/hid/hid-elan.c
> +++ b/drivers/hid/hid-elan.c
> @@ -188,7 +188,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
> ret = input_mt_init_slots(input, ELAN_MAX_FINGERS, INPUT_MT_POINTER);
> if (ret) {
> hid_err(hdev, "Failed to init elan MT slots: %d\n", ret);
> - input_free_device(input);
> return ret;
> }
>
> @@ -200,7 +199,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
> hid_err(hdev, "Failed to register elan input device: %d\n",
> ret);
> input_mt_destroy_slots(input);
> - input_free_device(input);
> return ret;
> }
>
> --
> 2.17.1
>

2022-04-22 17:42:58

by Jiri Kosina

[permalink] [raw]
Subject: Re: [PATCH] HID: elan: Fix potential double free in elan_input_configured

On Thu, 21 Apr 2022, Benjamin Tissoires wrote:

> On Sat, Apr 16, 2022 at 9:37 AM Miaoqian Lin <[email protected]> wrote:
> >
> > 'input' is a managed resource allocated with devm_input_allocate_device(),
> > so there is no need to call input_free_device() explicitly or
> > there will be a double free.
> >
> > According to the doc of devm_input_allocate_device():
> > * Managed input devices do not need to be explicitly unregistered or
> > * freed as it will be done automatically when owner device unbinds from
> > * its driver (or binding fails).
> >
> > Fixes: b7429ea53d6c ("HID: elan: Fix memleak in elan_input_configured")
> > Fixes: 9a6a4193d65b ("HID: Add driver for USB ELAN Touchpad")
> > Signed-off-by: Miaoqian Lin <[email protected]>
>
> Acked-by: Benjamin Tissoires <[email protected]>
>
> Thanks for the patch!

Hmm, this patch never seems to have reached my inbox, but we've had some
trouble with our mailserver over the Easter weekend, so that could be it.

Thanks for the fix indeed, applied now to hid.git#for-5.18/upstream-fixes

--
Jiri Kosina
SUSE Labs