USB: fix use after free in wacom_sys.c

[linux-2.6-omap-h63xx.git] / drivers / usb / storage / onetouch.c

diff --git a/drivers/usb/storage/onetouch.c b/drivers/usb/storage/onetouch.c
index 55ee2d36d585824a589113e29cea2f0e94a1bebc..3baf448e300d6125bee994de038baa2e0d70e9e2 100644 (file)
--- a/drivers/usb/storage/onetouch.c
+++ b/drivers/usb/storage/onetouch.c
@@ -28,15 +28,13 @@
  *
  */
 
-#include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/input.h>
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
-#include <linux/usb.h>
 #include <linux/usb_ch9.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 #include "usb.h"
 #include "onetouch.h"
 #include "debug.h"
@@ -55,7 +53,7 @@ struct usb_onetouch {
        unsigned int is_open:1;
 };
 
-static void usb_onetouch_irq(struct urb *urb, struct pt_regs *regs)
+static void usb_onetouch_irq(struct urb *urb)
 {
        struct usb_onetouch *onetouch = urb->context;
        signed char *data = onetouch->data;
@@ -74,7 +72,6 @@ static void usb_onetouch_irq(struct urb *urb, struct pt_regs *regs)
                goto resubmit;
        }
 
-       input_regs(dev, regs);
        input_report_key(dev, ONETOUCH_BUTTON, data[0] & 0x02);
        input_sync(dev);
 
@@ -137,6 +134,7 @@ int onetouch_connect_input(struct us_data *ss)
        struct usb_onetouch *onetouch;
        struct input_dev *input_dev;
        int pipe, maxp;
+       int error = -ENOMEM;
 
        interface = ss->pusb_intf->cur_altsetting;
 
@@ -213,15 +211,18 @@ int onetouch_connect_input(struct us_data *ss)
        ss->suspend_resume_hook = usb_onetouch_pm_hook;
 #endif
 
-       input_register_device(onetouch->dev);
+       error = input_register_device(onetouch->dev);
+       if (error)
+               goto fail3;
 
        return 0;
 
+ fail3:        usb_free_urb(onetouch->irq);
  fail2:        usb_buffer_free(udev, ONETOUCH_PKT_LEN,
                        onetouch->data, onetouch->data_dma);
  fail1:        kfree(onetouch);
        input_free_device(input_dev);
-       return -ENOMEM;
+       return error;
 }
 
 void onetouch_release_input(void *onetouch_)