50d1225366
[ Upstream commit eb988e46da2e4eae89f5337e047ce372fe33d5b1 ]
The put_device() calls rmi_release_function() which frees "fn" so the
dereference on the next line "fn->num_of_irqs" is a use after free.
Move the put_device() to the end to fix this.
Fixes:
|
||
---|---|---|
.. | ||
Kconfig | ||
Makefile | ||
rmi_2d_sensor.c | ||
rmi_2d_sensor.h | ||
rmi_bus.c | ||
rmi_bus.h | ||
rmi_driver.c | ||
rmi_driver.h | ||
rmi_f01.c | ||
rmi_f03.c | ||
rmi_f11.c | ||
rmi_f12.c | ||
rmi_f30.c | ||
rmi_f34.c | ||
rmi_f34.h | ||
rmi_f34v7.c | ||
rmi_f54.c | ||
rmi_f55.c | ||
rmi_i2c.c | ||
rmi_smbus.c | ||
rmi_spi.c |