summaryrefslogtreecommitdiff
path: root/drivers/hid
diff options
context:
space:
mode:
authorHanno Zulla <kontakt@hanno.de>2020-02-18 12:37:47 +0100
committerBenjamin Tissoires <benjamin.tissoires@redhat.com>2020-02-18 14:43:45 +0100
commit789a2c250340666220fa74bc6c8f58497e3863b3 (patch)
tree8f4e8b7be70806234ce887305a629abcf44b2638 /drivers/hid
parentbe0aba826c4a6ba5929def1962a90d6127871969 (diff)
HID: hid-bigbenff: fix general protection fault caused by double kfree
The struct *bigben was allocated via devm_kzalloc() and then used as a parameter in input_ff_create_memless(). This caused a double kfree during removal of the device, since both the managed resource API and ml_ff_destroy() in drivers/input/ff-memless.c would call kfree() on it. Signed-off-by: Hanno Zulla <kontakt@hanno.de> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Diffstat (limited to 'drivers/hid')
-rw-r--r--drivers/hid/hid-bigbenff.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c
index 3f6abd190df4..f7e85bacb688 100644
--- a/drivers/hid/hid-bigbenff.c
+++ b/drivers/hid/hid-bigbenff.c
@@ -220,10 +220,16 @@ static void bigben_worker(struct work_struct *work)
static int hid_bigben_play_effect(struct input_dev *dev, void *data,
struct ff_effect *effect)
{
- struct bigben_device *bigben = data;
+ struct hid_device *hid = input_get_drvdata(dev);
+ struct bigben_device *bigben = hid_get_drvdata(hid);
u8 right_motor_on;
u8 left_motor_force;
+ if (!bigben) {
+ hid_err(hid, "no device data\n");
+ return 0;
+ }
+
if (effect->type != FF_RUMBLE)
return 0;
@@ -341,7 +347,7 @@ static int bigben_probe(struct hid_device *hid,
INIT_WORK(&bigben->worker, bigben_worker);
- error = input_ff_create_memless(hidinput->input, bigben,
+ error = input_ff_create_memless(hidinput->input, NULL,
hid_bigben_play_effect);
if (error)
return error;