HID: hid-bigbenff: fix general protection fault caused by double kfree (789a2c25) · Commits · 戴 / test

The struct *bigben was allocated via devm_kzalloc() and then used as a parameter in input_ff_create_memless(). This caused a double kfree during removal of the device, since both the managed resource API and ml_ff_destroy() in drivers/input/ff-memless.c would call kfree() on it. Signed-off-by:

Hanno Zulla <kontakt@hanno.de> Signed-off-by:

Benjamin Tissoires <benjamin.tissoires@redhat.com>

drivers/hid/hid-bigbenff.c

+8 −2

Original line number	Diff line number	Diff line
		@@ -220,10 +220,16 @@ static void bigben_worker(struct work_struct *work)
		static int hid_bigben_play_effect(struct input_dev dev, void data,
		struct ff_effect *effect)
		{
		struct bigben_device *bigben = data;
		struct hid_device *hid = input_get_drvdata(dev);
		struct bigben_device *bigben = hid_get_drvdata(hid);
		u8 right_motor_on;
		u8 left_motor_force;

		if (!bigben) {
		hid_err(hid, "no device data\n");
		return 0;
		}

		if (effect->type != FF_RUMBLE)
		return 0;

		@@ -341,7 +347,7 @@ static int bigben_probe(struct hid_device *hid,

		INIT_WORK(&bigben->worker, bigben_worker);

		error = input_ff_create_memless(hidinput->input, bigben,
		error = input_ff_create_memless(hidinput->input, NULL,
		hid_bigben_play_effect);
		if (error)
		return error;

Admin message