HID: kernel oops in out_cleanup in function hidinput_connect

Goto out_cleanup infers a kernel oops: hidinput_disconnect calls input_unregister_driver to all members of hid->inputs. However, hidinput already has been added to hid->inputs even though input_register_device was not called. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@enac.fr> Reviewed-by: Dmitry Torokhov <dtor@mail.ru> Signed-off-by: Jiri Kosina <jkosina@suse.cz>

HID: kernel oops in out_cleanup in function hidinput_connect
Goto out_cleanup infers a kernel oops: hidinput_disconnect calls input_unregister_driver to all members of hid->inputs. However, hidinput already has been added to hid->inputs even though input_register_device was not called. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@enac.fr> Reviewed-by: Dmitry Torokhov <dtor@mail.ru> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Benjamin Tissoires · Jiri Kosina
1 parent 6497dc3a54
Showing 1 changed file with 1 additions and 0 deletions Side-by-side Diff
drivers/hid/hid-input.c
@@ -928,6 +928,7 @@
 	return 0;
  
 out_cleanup:
+	list_del(&hidinput->list);
 	input_free_device(hidinput->input);
 	kfree(hidinput);
 out_unwind:
...	...	@@ -928,6 +928,7 @@
928	928	return 0;
929	929
930	930	out_cleanup:
	931	+ list_del(&hidinput->list);
931	932	input_free_device(hidinput->input);
932	933	kfree(hidinput);
933	934	out_unwind: