diff mbox

[v2,1/6] hid: sony: Prevent the freeing of an unitialized ida value

Message ID 1430873253-11765-2-git-send-email-frank.praznik@oh.rr.com (mailing list archive)
State New, archived
Delegated to: Jiri Kosina
Headers show

Commit Message

Frank Praznik May 6, 2015, 12:47 a.m. UTC
sony_allocate_output_report() was being called before sony_set_device_id()
which meant that an unallocated ida value was was freed if the output
report allocation failed and the probe function jumped to err_stop.

Do the device ID allocation before the output report allocation to avoid
freeing an unallocated value in case of a failure.

Signed-off-by: Frank Praznik <frank.praznik@oh.rr.com>
---
 drivers/hid/hid-sony.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

Comments

Pavel Machek May 6, 2015, 9:24 a.m. UTC | #1
Hi!

> sony_allocate_output_report() was being called before sony_set_device_id()
> which meant that an unallocated ida value was was freed if the output
> report allocation failed and the probe function jumped to err_stop.
> 
> Do the device ID allocation before the output report allocation to avoid
> freeing an unallocated value in case of a failure.
> 
> Signed-off-by: Frank Praznik <frank.praznik@oh.rr.com>

The series looks good to me, thanks a lot.

Acked-by: Pavel Machek <pavel@ucw.cz>
									Pavel
diff mbox

Patch

diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 6ca96ce..4c521b2 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -1993,15 +1993,15 @@  static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
 		return ret;
 	}
 
-	ret = sony_allocate_output_report(sc);
+	ret = sony_set_device_id(sc);
 	if (ret < 0) {
-		hid_err(hdev, "failed to allocate the output report buffer\n");
+		hid_err(hdev, "failed to allocate the device id\n");
 		goto err_stop;
 	}
 
-	ret = sony_set_device_id(sc);
+	ret = sony_allocate_output_report(sc);
 	if (ret < 0) {
-		hid_err(hdev, "failed to allocate the device id\n");
+		hid_err(hdev, "failed to allocate the output report buffer\n");
 		goto err_stop;
 	}