lkml.org 
[lkml]   [2015]   [Sep]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.1 21/78] HID: hid-input: Fix accessing freed memory during device disconnect
    Date
    4.1-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Krzysztof Kozlowski <k.kozlowski@samsung.com>

    commit 0621809e37936e7c2b3eac9165cf2aad7f9189eb upstream.

    During unbinding the driver was dereferencing a pointer to memory
    already freed by power_supply_unregister().

    Driver was freeing its internal description of battery through pointers
    stored in power_supply structure. However, because the core owns the
    power supply instance, after calling power_supply_unregister() this
    memory is freed and the driver cannot access these members.

    Fix this by storing the pointer to internal description of battery in a
    local variable before calling power_supply_unregister(), so the pointer
    remains valid.

    Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
    Reported-by: H.J. Lu <hjl.tools@gmail.com>
    Fixes: 297d716f6260 ("power_supply: Change ownership from driver to core")
    Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/hid/hid-input.c | 7 +++++--
    1 file changed, 5 insertions(+), 2 deletions(-)

    --- a/drivers/hid/hid-input.c
    +++ b/drivers/hid/hid-input.c
    @@ -462,12 +462,15 @@ out:

    static void hidinput_cleanup_battery(struct hid_device *dev)
    {
    + const struct power_supply_desc *psy_desc;
    +
    if (!dev->battery)
    return;

    + psy_desc = dev->battery->desc;
    power_supply_unregister(dev->battery);
    - kfree(dev->battery->desc->name);
    - kfree(dev->battery->desc);
    + kfree(psy_desc->name);
    + kfree(psy_desc);
    dev->battery = NULL;
    }
    #else /* !CONFIG_HID_BATTERY_STRENGTH */



    \
     
     \ /
      Last update: 2015-09-12 01:21    [W:3.720 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site