summaryrefslogtreecommitdiff
path: root/drivers/hid
diff options
context:
space:
mode:
authorJohannes Weiner <hannes@cmpxchg.org>2009-03-10 22:43:56 +0100
committerJiri Kosina <jkosina@suse.cz>2009-03-10 22:43:56 +0100
commit48e7a3c95c9f98c2cb6f894820e3cc2d0448e92f (patch)
tree641418256b1b64e3408c6327d48c11cbe57b20b6 /drivers/hid
parentd2f8d7ee1a9b4650b4e43325b321801264f7c37a (diff)
HID: fix incorrect free in hiddev
If hiddev_open() fails, it wrongly frees the shared hiddev structure kept in hiddev_table instead of the hiddev_list structure allocated for the opened file descriptor. Existing references to this structure will then accessed free memory. This was introduced by 079034073 "HID: hiddev cleanup -- handle all error conditions properly". Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Oliver Neukum <oliver@neukum.name> Cc: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid')
-rw-r--r--drivers/hid/usbhid/hiddev.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 4940e4d70c2d..00ea1ed282a9 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -306,7 +306,7 @@ static int hiddev_open(struct inode *inode, struct file *file)
return 0;
bail:
file->private_data = NULL;
- kfree(list->hiddev);
+ kfree(list);
return res;
}