Unverified Commit ee9df505 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15785 v2 HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Pu Lehui <pulehui@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/RZRU2BNDZNAHQRUO6SQGB4YJMJTRF62N/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBY43Y 
 
Link:https://gitee.com/openeuler/kernel/pulls/15785

 

Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 3e5da20e 369bae4d

drivers/hid/intel-ish-hid/ishtp-hid.c

+3 −1
Original line number Diff line number Diff line
@@ -261,12 +261,14 @@ int ishtp_hid_probe(unsigned int cur_hid_dev, 
 */

void ishtp_hid_remove(struct ishtp_cl_data *client_data)

{

	void *data;

	int i;



	for (i = 0; i < client_data->num_hid_devices; ++i) {

		if (client_data->hid_sensor_hubs[i]) {

			kfree(client_data->hid_sensor_hubs[i]->driver_data);

			data = client_data->hid_sensor_hubs[i]->driver_data;

			hid_destroy_device(client_data->hid_sensor_hubs[i]);

			kfree(data);

			client_data->hid_sensor_hubs[i] = NULL;

		}

	}