Skip to content

(master) synaptics: fix missing NULL check + open_slots double-free in DeviceInit() - #15

Open
metux wants to merge 1 commit into
masterfrom
pr/master-synaptics-fix-missing-null-check-open-slots-double-free-in-deviceinit-_2026-07-07_13-52-50
Open

(master) synaptics: fix missing NULL check + open_slots double-free in DeviceInit()#15
metux wants to merge 1 commit into
masterfrom
pr/master-synaptics-fix-missing-null-check-open-slots-double-free-in-deviceinit-_2026-07-07_13-52-50

Conversation

@metux

@metux metux commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

DeviceInit() checked priv->hwState and priv->local_hw_state for
allocation failure but not the third SynapticsHwStateAlloc() call
(priv->comm.hwState) -- SynapticsReset(), called right after, derefs
it unconditionally.

Separately, the 'fail' cleanup path used raw free() on hwState/
local_hw_state instead of SynapticsHwStateFree() (leaking their
nested slot_state/mt_mask allocations), and freed priv->open_slots
without resetting it to NULL. priv survives a failed DeviceInit() and
SynapticsUnInit() later frees priv->open_slots again if it's
still non-NULL, so this was a double-free on the open_slots
allocation failure or the hwState allocation failure path.

Add the missing check, use SynapticsHwStateFree() for symmetry with
DeviceClose()'s normal-path cleanup, and NULL out open_slots after
freeing it.

Signed-off-by: Enrico Weigelt, metux IT consult info@metux.net

…nit()

DeviceInit() checked priv->hwState and priv->local_hw_state for
allocation failure but not the third SynapticsHwStateAlloc() call
(priv->comm.hwState) -- SynapticsReset(), called right after, derefs
it unconditionally.

Separately, the 'fail' cleanup path used raw free() on hwState/
local_hw_state instead of SynapticsHwStateFree() (leaking their
nested slot_state/mt_mask allocations), and freed priv->open_slots
without resetting it to NULL. priv survives a failed DeviceInit() and
SynapticsUnInit() later frees priv->open_slots again if it's
still non-NULL, so this was a double-free on the open_slots
allocation failure or the hwState allocation failure path.

Add the missing check, use SynapticsHwStateFree() for symmetry with
DeviceClose()'s normal-path cleanup, and NULL out open_slots after
freeing it.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
@metux metux self-assigned this Jul 7, 2026
@metux
metux requested review from a team, cepelinas9000 and stefan11111 July 7, 2026 11:53
@metux

metux commented Jul 7, 2026

Copy link
Copy Markdown
Contributor Author

Note: could not locally build-verify this change — autogen.sh/configure.ac here requires
xorg-server >= 25.0.0 via pkg-config, and this host's registered system package is 21.1.16.
The change itself is a minimal, mechanical NULL-check following the exact pattern already used a
few lines above the touched code in the same function — flagging the verification gap rather than
silently claiming it was tested.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant