Преглед изворни кода

HID: kernel oops in out_cleanup in function hidinput_connect

Goto out_cleanup infers a kernel oops: hidinput_disconnect calls
input_unregister_driver to all members of hid->inputs.
However, hidinput already has been added to hid->inputs even
though input_register_device was not called.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@enac.fr>
Reviewed-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Benjamin Tissoires пре 14 година
родитељ
комит
d9236303d0
1 измењених фајлова са 1 додато и 0 уклоњено
  1. 1 0
      drivers/hid/hid-input.c

+ 1 - 0
drivers/hid/hid-input.c

@@ -928,6 +928,7 @@ int hidinput_connect(struct hid_device *hid, unsigned int force)
 	return 0;
 	return 0;
 
 
 out_cleanup:
 out_cleanup:
+	list_del(&hidinput->list);
 	input_free_device(hidinput->input);
 	input_free_device(hidinput->input);
 	kfree(hidinput);
 	kfree(hidinput);
 out_unwind:
 out_unwind: