Input: atmel_mxt_ts - fix double free in mxt_read_info_block

JoseExposito · dtor · commit 12f247ab590a · 2021-12-12T21:08:59.000-08:00
The "id_buf" buffer is stored in "data->raw_info_block" and freed by "mxt_free_object_table" in case of error. Return instead of jumping to avoid a double free. Addresses-Coverity-ID: 1474582 ("Double free") Fixes: 068bdb6 ("Input: atmel_mxt_ts - fix the firmware update") Signed-off-by: José Expósito <jose.exposito89@gmail.com> Link: https://lore.kernel.org/r/20211212194257.68879-1-jose.exposito89@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -1882,7 +1882,7 @@ static int mxt_read_info_block(struct mxt_data *data)
 	if (error) {
 		dev_err(&client->dev, "Error %d parsing object table\n", error);
 		mxt_free_object_table(data);
-		goto err_free_mem;
+		return error;
 	}
 
 	data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);

Original file line number	Diff line number	Diff line change
`@@ -1882,7 +1882,7 @@ static int mxt_read_info_block(struct mxt_data *data)`
`1882`	`1882`	`if (error) {`
`1883`	`1883`	`dev_err(&client->dev, "Error %d parsing object table\n", error);`
`1884`	`1884`	`mxt_free_object_table(data);`
`1885`		`- goto err_free_mem;`
	`1885`	`+ return error;`
`1886`	`1886`	`}`
`1887`	`1887`
`1888`	`1888`	`data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);`