Commit 501a5250 authored by Dmitry Torokhov's avatar Dmitry Torokhov
Browse files

Input: gtco - fix double kfree in error handling path 



The code would try to free 'report' twice upon input_register_device()
failure.

Reported-by: default avatarJulia Lawall <julia@diku.dk>
Signed-off-by: default avatarDmitry Torokhov <dtor@mail.ru>
parent 471637a5

drivers/input/tablet/gtco.c

+7 −10
Original line number Diff line number Diff line
@@ -830,7 +830,7 @@ static int gtco_probe(struct usb_interface *usbinterface, 
	struct gtco             *gtco;

	struct input_dev        *input_dev;

	struct hid_descriptor   *hid_desc;

	char                    *report = NULL;

	char                    *report;

	int                     result = 0, retry;

	int			error;

	struct usb_endpoint_descriptor *endpoint;
@@ -916,12 +916,16 @@ static int gtco_probe(struct usb_interface *usbinterface, 
					 le16_to_cpu(hid_desc->wDescriptorLength),

					 5000); /* 5 secs */



		if (result == le16_to_cpu(hid_desc->wDescriptorLength))

		dbg("usb_control_msg result: %d", result);

		if (result == le16_to_cpu(hid_desc->wDescriptorLength)) {

			parse_hid_report_descriptor(gtco, report, result);

			break;

		}

	}



	kfree(report);



	/* If we didn't get the report, fail */

	dbg("usb_control_msg result: :%d", result);

	if (result != le16_to_cpu(hid_desc->wDescriptorLength)) {

		err("Failed to get HID Report Descriptor of size: %d",

		    hid_desc->wDescriptorLength);
@@ -929,12 +933,6 @@ static int gtco_probe(struct usb_interface *usbinterface, 
		goto err_free_urb;

	}



	/* Now we parse the report */

	parse_hid_report_descriptor(gtco, report, result);



	/* Now we delete it */

	kfree(report);



	/* Create a device file node */

	usb_make_path(gtco->usbdev, gtco->usbpath, sizeof(gtco->usbpath));

	strlcat(gtco->usbpath, "/input0", sizeof(gtco->usbpath));
@@ -988,7 +986,6 @@ static int gtco_probe(struct usb_interface *usbinterface, 
	usb_buffer_free(gtco->usbdev, REPORT_MAX_SIZE,

			gtco->buffer, gtco->buf_dma);

 err_free_devs:

	kfree(report);

	input_free_device(input_dev);

	kfree(gtco);

	return error;