TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HID: multitouch: Correct devm device reference for hidinput input_dev name

Browse Source 
[ Upstream commit 4794394635 ]

Reference the HID device rather than the input device for the devm
allocation of the input_dev name. Referencing the input_dev would lead to a
use-after-free when the input_dev was unregistered and subsequently fires a
uevent that depends on the name. At the point of firing the uevent, the
name would be freed by devres management.

Use devm_kasprintf to simplify the logic for allocating memory and
formatting the input_dev name string.

Reported-by: Maxime Ripard <mripard@kernel.org>
Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/#m443f3dce92520f74b6cf6ffa8653f9c92643d4ae
Fixes: c08d46aa80 ("HID: multitouch: devm conversion")
Suggested-by: Maxime Ripard <mripard@kernel.org>
Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20230824061308.222021-3-sergeantsagara@protonmail.com
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Rahul Rameshbabu
2023-08-24 06:14:33 +00:00
committed by Greg Kroah-Hartman
parent e38a6f1268
commit 15ec7cb55e
1 changed files with 3 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/hid/hid-multitouch.c
+3 -10
View File
@@ -1541,7 +1541,6 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app)
static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
{ {
struct mt_device *td = hid_get_drvdata(hdev); struct mt_device *td = hid_get_drvdata(hdev);
char *name;
const char *suffix = NULL; const char *suffix = NULL;
struct mt_report_data *rdata; struct mt_report_data *rdata;
struct mt_application *mt_application = NULL; struct mt_application *mt_application = NULL;
@@ -1595,15 +1594,9 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
break; break;
} }
if (suffix) { if (suffix)
name = devm_kzalloc(&hi->input->dev, hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
strlen(hdev->name) + strlen(suffix) + 2, "%s %s", hdev->name, suffix);
GFP_KERNEL);
if (name) {
sprintf(name, "%s %s", hdev->name, suffix);
hi->input->name = name;
}
}
return 0; return 0;
} }