diff options
| author | Sanjeev Chugh <sanjeev_chugh@mentor.com> | 2018-12-28 17:04:31 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-01-09 17:38:41 +0100 |
| commit | f1680565304c524fd94f913575ac802fb865181a (patch) | |
| tree | 064dd8a9639f9809f184116b38bcd9eb469de289 /drivers/input | |
| parent | d648a9bdac4b9705e48f0131a71f264eca8fd520 (diff) | |
| download | linux-rpi3-f1680565304c524fd94f913575ac802fb865181a.tar.gz linux-rpi3-f1680565304c524fd94f913575ac802fb865181a.tar.bz2 linux-rpi3-f1680565304c524fd94f913575ac802fb865181a.zip | |
Input: atmel_mxt_ts - don't try to free unallocated kernel memory
commit 1e3c336ad8f40f88a8961c434640920fe35cc08b upstream.
If the user attempts to update Atmel device with an invalid configuration
cfg file, error handling code is trying to free cfg file memory which is
not allocated yet hence results into kernel crash.
This patch fixes the order of memory free operations.
Signed-off-by: Sanjeev Chugh <sanjeev_chugh@mentor.com>
Fixes: a4891f105837 ("Input: atmel_mxt_ts - zero terminate config firmware file")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/input')
| -rw-r--r-- | drivers/input/touchscreen/atmel_mxt_ts.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c index 3232af5dcf89..a7ace07e179e 100644 --- a/drivers/input/touchscreen/atmel_mxt_ts.c +++ b/drivers/input/touchscreen/atmel_mxt_ts.c @@ -1586,10 +1586,10 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *fw) /* T7 config may have changed */ mxt_init_t7_power_cfg(data); -release_raw: - kfree(cfg.raw); release_mem: kfree(cfg.mem); +release_raw: + kfree(cfg.raw); return ret; } |