diff options
| author | Benjamin Tissoires <bentiss@kernel.org> | 2023-08-31 10:37:00 +0200 |
|---|---|---|
| committer | Benjamin Tissoires <bentiss@kernel.org> | 2023-08-31 10:37:00 +0200 |
| commit | 1ba893a112eb042147b0b4072912bb4f4c5b42d2 (patch) | |
| tree | abe9ebc5e607f63109151095e68f5e7ed875e9ed /drivers/hid | |
| parent | 11438237ade7128ee7a39c404145cecf85318e7a (diff) | |
| parent | 197d3143520fec9fde89aebabc9f0d7464f08e50 (diff) | |
Merge branch 'for-6.6/devm-fixes' into for-linus
Fix a wrong devm attachment to the input device which
now triggers a use after free with a recent devm change
by Rahul Rameshbabu.
Diffstat (limited to 'drivers/hid')
| -rw-r--r-- | drivers/hid/hid-multitouch.c | 13 | ||||
| -rw-r--r-- | drivers/hid/hid-nvidia-shield.c | 2 | ||||
| -rw-r--r-- | drivers/hid/hid-uclogic-core.c | 13 |
3 files changed, 7 insertions, 21 deletions
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c index e31be0cb8b85..521b2ffb4244 100644 --- a/drivers/hid/hid-multitouch.c +++ b/drivers/hid/hid-multitouch.c @@ -1594,7 +1594,6 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app) static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) { struct mt_device *td = hid_get_drvdata(hdev); - char *name; const char *suffix = NULL; struct mt_report_data *rdata; struct mt_application *mt_application = NULL; @@ -1645,15 +1644,9 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) break; } - if (suffix) { - name = devm_kzalloc(&hi->input->dev, - strlen(hdev->name) + strlen(suffix) + 2, - GFP_KERNEL); - if (name) { - sprintf(name, "%s %s", hdev->name, suffix); - hi->input->name = name; - } - } + if (suffix) + hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL, + "%s %s", hdev->name, suffix); return 0; } diff --git a/drivers/hid/hid-nvidia-shield.c b/drivers/hid/hid-nvidia-shield.c index a928ad2be62d..084179a6be86 100644 --- a/drivers/hid/hid-nvidia-shield.c +++ b/drivers/hid/hid-nvidia-shield.c @@ -164,7 +164,7 @@ static struct input_dev *shield_allocate_input_dev(struct hid_device *hdev, idev->id.product = hdev->product; idev->id.version = hdev->version; idev->uniq = hdev->uniq; - idev->name = devm_kasprintf(&idev->dev, GFP_KERNEL, "%s %s", hdev->name, + idev->name = devm_kasprintf(&hdev->dev, GFP_KERNEL, "%s %s", hdev->name, name_suffix); if (!idev->name) goto err_name; diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c index f67835f9ed4c..ad74cbc9a0aa 100644 --- a/drivers/hid/hid-uclogic-core.c +++ b/drivers/hid/hid-uclogic-core.c @@ -85,10 +85,8 @@ static int uclogic_input_configured(struct hid_device *hdev, { struct uclogic_drvdata *drvdata = hid_get_drvdata(hdev); struct uclogic_params *params = &drvdata->params; - char *name; const char *suffix = NULL; struct hid_field *field; - size_t len; size_t i; const struct uclogic_params_frame *frame; @@ -146,14 +144,9 @@ static int uclogic_input_configured(struct hid_device *hdev, } } - if (suffix) { - len = strlen(hdev->name) + 2 + strlen(suffix); - name = devm_kzalloc(&hi->input->dev, len, GFP_KERNEL); - if (name) { - snprintf(name, len, "%s %s", hdev->name, suffix); - hi->input->name = name; - } - } + if (suffix) + hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL, + "%s %s", hdev->name, suffix); return 0; } |