提交 5c699d7d 编写于 作者: D Dan Carpenter 提交者: Jiri Kosina

HID: hiddev: fix use after free in hiddev_release

There are a couple use after free bugs here.
Signed-off-by: NDan Carpenter <error27@gmail.com>
[jkosina@suse.cz: removed already fixed hunk]
Signed-off-by: NJiri Kosina <jkosina@suse.cz>
上级 e23be0a2
......@@ -248,12 +248,15 @@ static int hiddev_release(struct inode * inode, struct file * file)
usbhid_close(list->hiddev->hid);
usbhid_put_power(list->hiddev->hid);
} else {
mutex_unlock(&list->hiddev->existancelock);
kfree(list->hiddev);
kfree(list);
return 0;
}
}
kfree(list);
mutex_unlock(&list->hiddev->existancelock);
kfree(list);
return 0;
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册