input: pcf8574_keypad: use after input_unregister_device()

PATCH Applied Dan Carpenter 2 participants 2 messages Nov 11, 2010

Subsystems (3)

Kernel janitors HID Input drivers

lore

Share & tools

lore

Dan Carpenter

author

2010-11-11 07:28 UTC #0 lore raw

PATCH 1/1 input: pcf8574_keypad: use after input_unregister_device()

input_unregister_device() is tricky because it frees the argument. So in the original code the call to input_set_drvdata(idev, NULL) is a use after free bug. The other problem is the input_set_drvdata() makes the input_free_device() into a no-op.

The prefered style in input/ is to make input_register_device() the last function in the probe which can fail. That way we don't need to call input_unregister_device().

Signed-off-by Dan Carpenter <[email protected]>

drivers/input/misc/pcf8574_keypad.c +11 ~~-11~~

index 4b42ffc..d0b0e36 100644
@@ -129,12 +129,6 @@ static int __devinit pcf8574_kp_probe(struct i2c_client *client, const struct i2
 
 	input_set_drvdata(idev, lp);
 
-	ret = input_register_device(idev);
-	if (ret) {
-		dev_err(&client->dev, "input_register_device() failed\n");
-		goto fail_register;
-	}
-
 	lp->laststate = read_state(lp);
 
 	ret = request_threaded_irq(client->irq, NULL, pcf8574_kp_irq_handler,

@@ -142,16 +136,22 @@ static int __devinit pcf8574_kp_probe(struct i2c_client *client, const struct i2
 				   DRV_NAME, lp);
 	if (ret) {
 		dev_err(&client->dev, "IRQ %d is not free\n", client->irq);
-		goto fail_irq;
+		goto fail_free_device;
 	}
 
 	i2c_set_clientdata(client, lp);
+
+	ret = input_register_device(idev);
+	if (ret) {
+		dev_err(&client->dev, "input_register_device() failed\n");
+		goto fail_free_irq;
+	}
+
 	return 0;
 
- fail_irq:
-	input_unregister_device(idev);
- fail_register:
-	input_set_drvdata(idev, NULL);
+ fail_free_irq:
+	free_irq(client->irq, lp);
+ fail_free_device:
 	input_free_device(idev);
  fail_allocate:
 	kfree(lp);

Dmitry Torokhov

maintainer Applied

2010-11-11 09:04 UTC #1 lore raw

Re: [patch] input: pcf8574_keypad: use after

Quoted 10 lines · Dan Carpenter

input_unregister_device() is tricky because it frees the argument. So in the original code the call to input_set_drvdata(idev, NULL) is a use after free bug. The other problem is the input_set_drvdata() makes the input_free_device() into a no-op.
The prefered style in input/ is to make input_register_device() the last function in the probe which can fail. That way we don't need to call input_unregister_device().
Signed-off-by Dan Carpenter <[email protected]>

Applied, thanks Dan.

Signature · 1 line

Dmitry