Commit 5c699d7d authored by Dan Carpenter's avatar Dan Carpenter Committed by Jiri Kosina

HID: hiddev: fix use after free in hiddev_release

There are a couple use after free bugs here.
Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
[jkosina@suse.cz: removed already fixed hunk]
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent e23be0a2
...@@ -248,12 +248,15 @@ static int hiddev_release(struct inode * inode, struct file * file) ...@@ -248,12 +248,15 @@ static int hiddev_release(struct inode * inode, struct file * file)
usbhid_close(list->hiddev->hid); usbhid_close(list->hiddev->hid);
usbhid_put_power(list->hiddev->hid); usbhid_put_power(list->hiddev->hid);
} else { } else {
mutex_unlock(&list->hiddev->existancelock);
kfree(list->hiddev); kfree(list->hiddev);
kfree(list);
return 0;
} }
} }
kfree(list);
mutex_unlock(&list->hiddev->existancelock); mutex_unlock(&list->hiddev->existancelock);
kfree(list);
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment