input: fix double kfree of device->rdesc on hid_parse_parse error

       path in hid-core.c

diff --git a/drivers/usb/input/hid-core.c b/drivers/usb/input/hid-core.c
index 2bc835ecf20524b8d28216caf75a3d741038cd65..80822ed23a6ce490298550b4bab7dcac23c88271 100644 (file)
--- a/drivers/usb/input/hid-core.c
+++ b/drivers/usb/input/hid-core.c
@@ -674,7 +674,6 @@ static struct hid_device *hid_parse_report(__u8 *start, unsigned size)
 
                if (item.format != HID_ITEM_FORMAT_SHORT) {
                        dbg("unexpected long global item");
-                       kfree(device->rdesc);
                        kfree(device->collection);
                        hid_free_device(device);
                        kfree(parser);
@@ -684,7 +683,6 @@ static struct hid_device *hid_parse_report(__u8 *start, unsigned size)
                if (dispatch_type[item.type](parser, &item)) {
                        dbg("item %u %u %u %u parsing failed\n",
                                item.format, (unsigned)item.size, (unsigned)item.type, (unsigned)item.tag);
-                       kfree(device->rdesc);
                        kfree(device->collection);
                        hid_free_device(device);
                        kfree(parser);
@@ -694,7 +692,6 @@ static struct hid_device *hid_parse_report(__u8 *start, unsigned size)
                if (start == end) {
                        if (parser->collection_stack_ptr) {
                                dbg("unbalanced collection at end of report description");
-                               kfree(device->rdesc);
                                kfree(device->collection);
                                hid_free_device(device);
                                kfree(parser);
@@ -702,7 +699,6 @@ static struct hid_device *hid_parse_report(__u8 *start, unsigned size)
                        }
                        if (parser->local.delimiter_depth) {
                                dbg("unbalanced delimiter at end of report description");
-                               kfree(device->rdesc);
                                kfree(device->collection);
                                hid_free_device(device);
                                kfree(parser);
@@ -714,7 +710,6 @@ static struct hid_device *hid_parse_report(__u8 *start, unsigned size)
        }
 
        dbg("item fetching failed at offset %d\n", (int)(end - start));
-       kfree(device->rdesc);
        kfree(device->collection);
        hid_free_device(device);
        kfree(parser);