[patch 1/2] usbhid: use after free
From: Dan Carpenter <hidden>
Date: 2011-05-26 08:49:16
Also in:
kernel-janitors
Subsystem:
hid core layer, the rest, usb hid/hidbp drivers (usb keyboards, mice, remote controls, ...) · Maintainers:
Jiri Kosina, Benjamin Tissoires, Linus Torvalds
There are a couple use after free bugs here. Signed-off-by: Dan Carpenter <redacted> --- Compile tested only. Please review carefully.
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index ff3c644..b2f9a3a 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c@@ -248,12 +248,15 @@ static int hiddev_release(struct inode * inode, struct file * file) usbhid_close(list->hiddev->hid); usbhid_put_power(list->hiddev->hid); } else { + mutex_unlock(&list->hiddev->existancelock); kfree(list->hiddev); + kfree(list); + return 0; } } - kfree(list); mutex_unlock(&list->hiddev->existancelock); + kfree(list); return 0; }
@@ -926,7 +929,9 @@ void hiddev_disconnect(struct hid_device *hid) usbhid_close(hiddev->hid); wake_up_interruptible(&hiddev->wait); } else { + mutex_unlock(&hiddev->existancelock); kfree(hiddev); + return; } mutex_unlock(&hiddev->existancelock); } --
To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html