linux-kernel - [PATCH 3/3] HID: wacom: Fix double free on managed resource

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220422161709.30198-3-jose.exposito89@gmail.com>
Date:   Fri, 22 Apr 2022 18:17:09 +0200
From:   José Expósito <jose.exposito89@...il.com>
To:     hadess@...ess.net
Cc:     hdegoede@...hat.com, dmitry.torokhov@...il.com,
        rydberg@...math.org, lains@...eup.net, jikos@...nel.org,
        benjamin.tissoires@...hat.com, linux-input@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        José Expósito <jose.exposito89@...il.com>
Subject: [PATCH 3/3] HID: wacom: Fix double free on managed resource

As described in the documentation for devm_input_allocate_device():

  Managed input devices do not need to be explicitly unregistered or
  freed as it will be done automatically when owner device unbinds from
  its driver (or binding fails).

However this driver was explicitly freeing the input device, allocated
using devm_input_allocate_device() through wacom_allocate_input().

Remove the calls to input_free_device() to avoid a possible double free
error.

Fixes: d2d13f18aaa51 ("Input: wacom - create a separate input device for pads")
Signed-off-by: José Expósito <jose.exposito89@...il.com>
---
 drivers/hid/wacom_sys.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 066c567dbaa2..164c0f7cb796 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -2098,7 +2098,6 @@ static int wacom_register_inputs(struct wacom *wacom)
 	error = wacom_setup_pen_input_capabilities(pen_input_dev, wacom_wac);
 	if (error) {
 		/* no pen in use on this interface */
-		input_free_device(pen_input_dev);
 		wacom_wac->pen_input = NULL;
 		pen_input_dev = NULL;
 	} else {
@@ -2110,7 +2109,6 @@ static int wacom_register_inputs(struct wacom *wacom)
 	error = wacom_setup_touch_input_capabilities(touch_input_dev, wacom_wac);
 	if (error) {
 		/* no touch in use on this interface */
-		input_free_device(touch_input_dev);
 		wacom_wac->touch_input = NULL;
 		touch_input_dev = NULL;
 	} else {
@@ -2122,7 +2120,6 @@ static int wacom_register_inputs(struct wacom *wacom)
 	error = wacom_setup_pad_input_capabilities(pad_input_dev, wacom_wac);
 	if (error) {
 		/* no pad in use on this interface */
-		input_free_device(pad_input_dev);
 		wacom_wac->pad_input = NULL;
 		pad_input_dev = NULL;
 	} else {
-- 
2.25.1