From 776c0e96edecf77f827a62d2a1641cc2ca479043 Mon Sep 17 00:00:00 2001 From: Jiri Kosina Date: Wed, 21 Feb 2007 17:18:03 +0100 Subject: [PATCH] HID: fix possible double-free on error path in hid parser Freeing of device->collection is properly done in hid_free_device() (as this function is supposed to free all the device resources and could be called from transport specific code, e.g. usb_hid_configure()). Remove all kfree() calls preceeding the hid_free_device() call. Signed-off-by: Jiri Kosina --- drivers/hid/hid-core.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index aeeb6798e2f1..f4ee1afe488f 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -667,7 +667,6 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size) if (item.format != HID_ITEM_FORMAT_SHORT) { dbg("unexpected long global item"); - kfree(device->collection); hid_free_device(device); kfree(parser); return NULL; @@ -676,7 +675,6 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size) if (dispatch_type[item.type](parser, &item)) { dbg("item %u %u %u %u parsing failed\n", item.format, (unsigned)item.size, (unsigned)item.type, (unsigned)item.tag); - kfree(device->collection); hid_free_device(device); kfree(parser); return NULL; @@ -685,14 +683,12 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size) if (start == end) { if (parser->collection_stack_ptr) { dbg("unbalanced collection at end of report description"); - kfree(device->collection); hid_free_device(device); kfree(parser); return NULL; } if (parser->local.delimiter_depth) { dbg("unbalanced delimiter at end of report description"); - kfree(device->collection); hid_free_device(device); kfree(parser); return NULL; @@ -703,7 +699,6 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size) } dbg("item fetching failed at offset %d\n", (int)(end - start)); - kfree(device->collection); hid_free_device(device); kfree(parser); return NULL; -- 2.30.2