aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/hid
diff options
context:
space:
mode:
authorJohannes Weiner <hannes@cmpxchg.org>2009-03-10 17:43:56 -0400
committerJiri Kosina <jkosina@suse.cz>2009-03-10 17:43:56 -0400
commit48e7a3c95c9f98c2cb6f894820e3cc2d0448e92f (patch)
tree641418256b1b64e3408c6327d48c11cbe57b20b6 /drivers/hid
parentd2f8d7ee1a9b4650b4e43325b321801264f7c37a (diff)
HID: fix incorrect free in hiddev
If hiddev_open() fails, it wrongly frees the shared hiddev structure kept in hiddev_table instead of the hiddev_list structure allocated for the opened file descriptor. Existing references to this structure will then accessed free memory. This was introduced by 079034073 "HID: hiddev cleanup -- handle all error conditions properly". Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Oliver Neukum <oliver@neukum.name> Cc: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid')
-rw-r--r--drivers/hid/usbhid/hiddev.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 4940e4d70c2d..00ea1ed282a9 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -306,7 +306,7 @@ static int hiddev_open(struct inode *inode, struct file *file)
306 return 0; 306 return 0;
307bail: 307bail:
308 file->private_data = NULL; 308 file->private_data = NULL;
309 kfree(list->hiddev); 309 kfree(list);
310 return res; 310 return res;
311} 311}
312 312