Commit 1ba893a1 authored by Benjamin Tissoires's avatar Benjamin Tissoires
Browse files

Merge branch 'for-6.6/devm-fixes' into for-linus 

Fix a wrong devm attachment to the input device which
now triggers a use after free with a recent devm change
by Rahul Rameshbabu.
parents 11438237 197d3143

drivers/hid/hid-multitouch.c

+3 −10
Original line number Diff line number Diff line
@@ -1594,7 +1594,6 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app) 
static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)

{

	struct mt_device *td = hid_get_drvdata(hdev);

	char *name;

	const char *suffix = NULL;

	struct mt_report_data *rdata;

	struct mt_application *mt_application = NULL;
@@ -1645,15 +1644,9 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) 
		break;

	}



	if (suffix) {

		name = devm_kzalloc(&hi->input->dev,

				    strlen(hdev->name) + strlen(suffix) + 2,

				    GFP_KERNEL);

		if (name) {

			sprintf(name, "%s %s", hdev->name, suffix);

			hi->input->name = name;

		}

	}

	if (suffix)

		hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,

						 "%s %s", hdev->name, suffix);



	return 0;

}

drivers/hid/hid-nvidia-shield.c

+1 −1
Original line number Diff line number Diff line
@@ -164,7 +164,7 @@ static struct input_dev *shield_allocate_input_dev(struct hid_device *hdev, 
	idev->id.product = hdev->product;

	idev->id.version = hdev->version;

	idev->uniq = hdev->uniq;

	idev->name = devm_kasprintf(&idev->dev, GFP_KERNEL, "%s %s", hdev->name,

	idev->name = devm_kasprintf(&hdev->dev, GFP_KERNEL, "%s %s", hdev->name,

				    name_suffix);

	if (!idev->name)

		goto err_name;

drivers/hid/hid-uclogic-core.c

+3 −10
Original line number Diff line number Diff line
@@ -85,10 +85,8 @@ static int uclogic_input_configured(struct hid_device *hdev, 
{

	struct uclogic_drvdata *drvdata = hid_get_drvdata(hdev);

	struct uclogic_params *params = &drvdata->params;

	char *name;

	const char *suffix = NULL;

	struct hid_field *field;

	size_t len;

	size_t i;

	const struct uclogic_params_frame *frame;
@@ -146,14 +144,9 @@ static int uclogic_input_configured(struct hid_device *hdev, 
		}

	}



	if (suffix) {

		len = strlen(hdev->name) + 2 + strlen(suffix);

		name = devm_kzalloc(&hi->input->dev, len, GFP_KERNEL);

		if (name) {

			snprintf(name, len, "%s %s", hdev->name, suffix);

			hi->input->name = name;

		}

	}

	if (suffix)

		hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,

						 "%s %s", hdev->name, suffix);



	return 0;

}