[PATCH 1/2] avoid-double-kfree-ts_filter_destroy_chain.patch

[Nelson Castillo]

The function ts_filter_mean_destroy is destroying all the
filters of the chain. At the same time each filter is trying
to remove other filters in the chain. Let's fix this by
making each filter ignore it is part of a chain when we are
freeing it.

The bug shows when s3c2410_ts.c is built as a module.

Signed-off-by: Nelson Castillo <nelsoneci at gmail.com>
---

 0 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/drivers/input/touchscreen/ts_filter.c b/drivers/input/touchscreen/ts_filter.c
index f8b2b2f..4c650a5 100644
--- a/drivers/input/touchscreen/ts_filter.c
+++ b/drivers/input/touchscreen/ts_filter.c
@@ -49,9 +49,12 @@ EXPORT_SYMBOL_GPL(ts_filter_create_chain);
 
 void ts_filter_destroy_chain(struct ts_filter **list)
 {
+	struct ts_filter **first;
+	first = list;
 	while (*list) {
 		((*list)->api->destroy)(*list);
 		list++;
 	}
+	*first = NULL;
 }
 EXPORT_SYMBOL_GPL(ts_filter_destroy_chain);
diff --git a/drivers/input/touchscreen/ts_filter_mean.c b/drivers/input/touchscreen/ts_filter_mean.c
index b589bee..2322432 100644
--- a/drivers/input/touchscreen/ts_filter_mean.c
+++ b/drivers/input/touchscreen/ts_filter_mean.c
@@ -94,12 +94,6 @@ static void ts_filter_mean_destroy(struct ts_filter *tsf)
 {
 	struct ts_filter_mean *tsfs = (struct ts_filter_mean *)tsf;
 
-	if (!tsf)
-		return;
-
-	if (tsf->next) /* chain */
-		(tsf->next->api->destroy)(tsf->next);
-
 	kfree(tsfs->fifo[0]); /* first guy has pointer from kmalloc */
 	kfree(tsf);
 }
diff --git a/drivers/input/touchscreen/ts_filter_median.c b/drivers/input/touchscreen/ts_filter_median.c
index fe1b35f..47970da 100644
--- a/drivers/input/touchscreen/ts_filter_median.c
+++ b/drivers/input/touchscreen/ts_filter_median.c
@@ -119,9 +119,6 @@ static void ts_filter_median_destroy(struct ts_filter *tsf)
 {
 	struct ts_filter_median *tsfm = (struct ts_filter_median *)tsf;
 
-	if (tsf->next) /* chain */
-		(tsf->next->api->destroy)(tsf->next);
-
 	kfree(tsfm->sort[0]); /* first guy has pointer from kmalloc */
 	kfree(tsf);
 }