linux-kernel - Re: [PATCH] HID: elan: Fix memleak in elan_input

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <nycvar.YFH.7.76.2008310947070.27422@cbobk.fhfr.pm>
Date:   Mon, 31 Aug 2020 09:48:19 +0200 (CEST)
From:   Jiri Kosina <jikos@...nel.org>
To:     Dinghao Liu <dinghao.liu@....edu.cn>
cc:     kjlu@....edu, Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        Alexandrov Stansilav <neko@....ai>,
        linux-input@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] HID: elan: Fix memleak in elan_input_configured

On Mon, 24 Aug 2020, Dinghao Liu wrote:

> When input_mt_init_slots() fails, input should be
> freed to prevent memleak.
> 
> Fixes: 9a6a4193d65b8 ("HID: Add driver for USB ELAN Touchpad")
> Signed-off-by: Dinghao Liu <dinghao.liu@....edu.cn>
> ---
>  drivers/hid/hid-elan.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/hid/hid-elan.c b/drivers/hid/hid-elan.c
> index 45c4f888b7c4..858442004258 100644
> --- a/drivers/hid/hid-elan.c
> +++ b/drivers/hid/hid-elan.c
> @@ -188,6 +188,7 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
>  	ret = input_mt_init_slots(input, ELAN_MAX_FINGERS, INPUT_MT_POINTER);
>  	if (ret) {
>  		hid_err(hdev, "Failed to init elan MT slots: %d\n", ret);
> +		input_free_device(input);
>  		return ret;

Good catch, but apparently it's not the only memleak there -- 
input_mt_init_slots() allocates the input_mt slots and friends, so we need 
input_mt_destroy_slots() there as well.

Could you please add this to your patch too, while you are at fixing this 
error codepath anyway, and resubmit?

Thanks!

-- 
Jiri Kosina
SUSE Labs