Input: synaptics-rmi4 - fix possible double free (bce1a784) · Commits · 戴 / test

The RMI4 function structure has been released in rmi_register_function if error occurs. However, it will be released again in the function rmi_create_function, which may result in a double-free bug. Signed-off-by:

Pan Bian <bianpan2016@163.com> Signed-off-by:

Dmitry Torokhov <dmitry.torokhov@gmail.com>

drivers/input/rmi4/rmi_driver.c

+1 −5

Original line number	Diff line number	Diff line
		@@ -860,7 +860,7 @@ static int rmi_create_function(struct rmi_device *rmi_dev,

		error = rmi_register_function(fn);
		if (error)
		goto err_put_fn;
		return error;

		if (pdt->function_number == 0x01)
		data->f01_container = fn;
		@@ -870,10 +870,6 @@ static int rmi_create_function(struct rmi_device *rmi_dev,
		list_add_tail(&fn->node, &data->function_list);

		return RMI_SCAN_CONTINUE;

		err_put_fn:
		put_device(&fn->dev);
		return error;
		}

		void rmi_enable_irq(struct rmi_device *rmi_dev, bool clear_wake)

Admin message