summaryrefslogtreecommitdiff
path: root/drivers/hid
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2011-05-26 12:49:16 +0400
committerJiri Kosina <jkosina@suse.cz>2011-05-26 16:04:40 +0400
commit5c699d7d3f94ee1dd934edea889b32f8279a4e65 (patch)
treed46ed26c576ce7357c3d1efe0b63d6779687927f /drivers/hid
parente23be0a27dcc9297ff0495360d89bc5b0bf12383 (diff)
downloadlinux-5c699d7d3f94ee1dd934edea889b32f8279a4e65.tar.xz
HID: hiddev: fix use after free in hiddev_release
There are a couple use after free bugs here. Signed-off-by: Dan Carpenter <error27@gmail.com> [jkosina@suse.cz: removed already fixed hunk] Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid')
-rw-r--r--drivers/hid/usbhid/hiddev.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 4985f485932f..7c1188b53c3e 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -248,12 +248,15 @@ static int hiddev_release(struct inode * inode, struct file * file)
usbhid_close(list->hiddev->hid);
usbhid_put_power(list->hiddev->hid);
} else {
+ mutex_unlock(&list->hiddev->existancelock);
kfree(list->hiddev);
+ kfree(list);
+ return 0;
}
}
- kfree(list);
mutex_unlock(&list->hiddev->existancelock);
+ kfree(list);
return 0;
}