leds: pca9532: free after input_unregister_device()
Subsystems (3)
PATCH 1/1 leds: pca9532: free after input_unregister_device()
input_unregister_device() frees data->idev so the second input_free_device() is a double free.
Signed-off-by Dan Carpenter <[email protected]>
drivers/leds/leds-pca9532.c +0 -2
@@ -286,7 +286,6 @@ exit:case PCA9532_TYPE_N2100_BEEP :if (data->idev !=NULL ) {input_unregister_device (data->idev); -input_free_device (data->idev);cancel_work_sync (&data->work); data->idev =NULL ; }
@@ -341,7 +340,6 @@ static int pca9532_remove(struct i2c_client *client)case PCA9532_TYPE_N2100_BEEP :if (data->idev !=NULL ) {input_unregister_device (data->idev); -input_free_device (data->idev);cancel_work_sync (&data->work); data->idev =NULL ; }
Quoted 4 lines · Dan Carpenter
input_unregister_device()freesdata->idevso the secondinput_free_device()is a double free.Signed-off-by Dan Carpenter <[email protected]>
Acked-by Dmitry Torokhov <[email protected]>
Quoted 21 lines
drivers/leds/leds-pca9532.c +0
-2@@ -286,7 +286,6 @@ exit:case PCA9532_TYPE_N2100_BEEP :if (data->idev !=NULL ) {input_unregister_device (data->idev); -input_free_device (data->idev);cancel_work_sync (&data->work); data->idev =NULL ; }@@ -341,7 +340,6 @@ static int pca9532_remove(struct i2c_client *client)case PCA9532_TYPE_N2100_BEEP :if (data->idev !=NULL ) {input_unregister_device (data->idev); -input_free_device (data->idev);cancel_work_sync (&data->work); data->idev =NULL ; }
Signature · 1 line
Dmitry