From: Hanno Zulla <abos@hanno.de>
To: Jiri Kosina <jikos@kernel.org>,
Benjamin Tissoires <benjamin.tissoires@redhat.com>,
linux-input@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 1/3] HID: hid-bigbenff: fix general protection fault caused by double kfree
Date: Mon, 17 Feb 2020 16:25:54 +0100 [thread overview]
Message-ID: <798ec119-ce24-e1e3-17c9-b6018b04d75f@hanno.de> (raw)
In-Reply-To: <ae5eee33-9dfc-0609-1bf8-33fd773b9bd5@hanno.de>
HID: hid-bigbenff: fix general protection fault caused by double kfree
The struct *bigben was allocated via devm_kzalloc() and then used as a
parameter in input_ff_create_memless(). This caused a double kfree
during removal of the device, since both the managed resource API and
ml_ff_destroy() in drivers/input/ff-memless.c would call kfree() on it.
Signed-off-by: Hanno Zulla <kontakt@hanno.de>
---
drivers/hid/hid-bigbenff.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c
index 3f6abd190df4..f7e85bacb688 100644
--- a/drivers/hid/hid-bigbenff.c
+++ b/drivers/hid/hid-bigbenff.c
@@ -220,10 +220,16 @@ static void bigben_worker(struct work_struct *work)
static int hid_bigben_play_effect(struct input_dev *dev, void *data,
struct ff_effect *effect)
{
- struct bigben_device *bigben = data;
+ struct hid_device *hid = input_get_drvdata(dev);
+ struct bigben_device *bigben = hid_get_drvdata(hid);
u8 right_motor_on;
u8 left_motor_force;
+ if (!bigben) {
+ hid_err(hid, "no device data\n");
+ return 0;
+ }
+
if (effect->type != FF_RUMBLE)
return 0;
@@ -341,7 +347,7 @@ static int bigben_probe(struct hid_device *hid,
INIT_WORK(&bigben->worker, bigben_worker);
- error = input_ff_create_memless(hidinput->input, bigben,
+ error = input_ff_create_memless(hidinput->input, NULL,
hid_bigben_play_effect);
if (error)
return error;
--
2.20.1
next prev parent reply other threads:[~2020-02-17 15:45 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-17 15:24 [PATCH 0/3] HID: hid-bigbenff: fixing three crash bugs in a gamepad driver Hanno Zulla
2020-02-17 15:25 ` Hanno Zulla [this message]
2020-02-17 15:26 ` [PATCH 2/3] HID: hid-bigbenff: call hid_hw_stop() in case of error Hanno Zulla
2020-02-17 15:27 ` [PATCH 3/3] HID: hid-bigbenff: fix race condition for scheduled work during removal Hanno Zulla
2020-02-18 10:40 ` [PATCH 0/3] HID: hid-bigbenff: fixing three crash bugs in a gamepad driver Benjamin Tissoires
2020-02-18 11:30 ` [PATCH v2 " Hanno Zulla
2020-02-18 11:37 ` [PATCH v2 1/3] HID: hid-bigbenff: fix general protection fault caused by double kfree Hanno Zulla
2020-02-18 11:38 ` [PATCH v2 2/3] HID: hid-bigbenff: call hid_hw_stop() in case of error Hanno Zulla
2020-02-18 11:39 ` [PATCH v2 3/3] HID: hid-bigbenff: fix race condition for scheduled work during removal Hanno Zulla
2020-02-19 7:54 ` [PATCH v2 0/3] HID: hid-bigbenff: fixing three crash bugs in a gamepad driver Benjamin Tissoires
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=798ec119-ce24-e1e3-17c9-b6018b04d75f@hanno.de \
--to=abos@hanno.de \
--cc=benjamin.tissoires@redhat.com \
--cc=jikos@kernel.org \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).