Commit a9fadff7 authored by Dinghao Liu's avatar Dinghao Liu Committed by Chen Ridong
Browse files

HID: elan: Fix memleak in elan_input_configured 

stable inclusion
from stable-v4.19.14
commit 4023bad0a528d383800a2262c899f52dcd613c7c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP38D
CVE: CVE-2022-49508

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4023bad0a528d383800a2262c899f52dcd613c7c



----------------------------------------------------------------------

[ Upstream commit b7429ea5 ]

When input_mt_init_slots() fails, input should be freed
to prevent memleak. When input_register_device() fails,
we should call input_mt_destroy_slots() to free memory
allocated by input_mt_init_slots().

Signed-off-by: default avatarDinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarChen Ridong <chenridong@huawei.com>
parent 10501491

drivers/hid/hid-elan.c

+2 −0
Original line number Diff line number Diff line
@@ -192,6 +192,7 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi) 
	ret = input_mt_init_slots(input, ELAN_MAX_FINGERS, INPUT_MT_POINTER);

	if (ret) {

		hid_err(hdev, "Failed to init elan MT slots: %d\n", ret);

		input_free_device(input);

		return ret;

	}
@@ -202,6 +203,7 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi) 
	if (ret) {

		hid_err(hdev, "Failed to register elan input device: %d\n",

			ret);

		input_mt_destroy_slots(input);

		input_free_device(input);

		return ret;

	}