[PATCH] input: atmel_mxt_ts: fix double free

From: trix
Date: Mon Aug 03 2020 - 09:48:46 EST


From: Tom Rix <trix@xxxxxxxxxx>

Clang static analysis reports this error

atmel_mxt_ts.c:1850:2: warning: Attempt to free released memory
kfree(id_buf);
^~~~~~~~~~~~~

The problem is with this code block

data->raw_info_block = id_buf;
...
error = mxt_parse_object_table(data, id_buf + MXT_OBJECT_START);
if (error) {
dev_err(&client->dev, "Error %d parsing object table\n", error);
mxt_free_object_table(data);
goto err_free_mem;
}

mxt_free_object_table() frees id_buf

kfree(data->raw_info_block);

So skip over the second free

Fixes: 068bdb67ef74 ("Input: atmel_mxt_ts - fix the firmware update")

Signed-off-by: Tom Rix <trix@xxxxxxxxxx>
---
drivers/input/touchscreen/atmel_mxt_ts.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 6b71b0aff115..1cc0f492f4f4 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -1839,7 +1839,7 @@ static int mxt_read_info_block(struct mxt_data *data)
if (error) {
dev_err(&client->dev, "Error %d parsing object table\n", error);
mxt_free_object_table(data);
- goto err_free_mem;
+ goto err_free_mem1;
}

data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
@@ -1848,6 +1848,7 @@ static int mxt_read_info_block(struct mxt_data *data)

err_free_mem:
kfree(id_buf);
+err_free_mem1:
return error;
}

--
2.18.1