lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 110/320] HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init
    Date
    From: José Expósito <jose.exposito89@gmail.com>

    [ Upstream commit ff6b548afe4d9d1ff3a0f6ef79e8cbca25d8f905 ]

    The function performs a check on its input parameters, however, the
    hdev parameter is used before the check.

    Initialize the stack variables after checking the input parameters to
    avoid a possible NULL pointer dereference.

    Fixes: 9614219e9310e ("HID: uclogic: Extract tablet parameter discovery into a module")
    Addresses-Coverity-ID: 1443804 ("Null pointer dereference")
    Signed-off-by: José Expósito <jose.exposito89@gmail.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/hid/hid-uclogic-params.c | 10 +++++++---
    1 file changed, 7 insertions(+), 3 deletions(-)

    diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
    index 1f3ea6c93ef44..0fdac91c5f510 100644
    --- a/drivers/hid/hid-uclogic-params.c
    +++ b/drivers/hid/hid-uclogic-params.c
    @@ -707,9 +707,9 @@ static int uclogic_params_huion_init(struct uclogic_params *params,
    struct hid_device *hdev)
    {
    int rc;
    - struct usb_device *udev = hid_to_usb_dev(hdev);
    - struct usb_interface *iface = to_usb_interface(hdev->dev.parent);
    - __u8 bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber;
    + struct usb_device *udev;
    + struct usb_interface *iface;
    + __u8 bInterfaceNumber;
    bool found;
    /* The resulting parameters (noop) */
    struct uclogic_params p = {0, };
    @@ -723,6 +723,10 @@ static int uclogic_params_huion_init(struct uclogic_params *params,
    goto cleanup;
    }

    + udev = hid_to_usb_dev(hdev);
    + iface = to_usb_interface(hdev->dev.parent);
    + bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber;
    +
    /* If it's not a pen interface */
    if (bInterfaceNumber != 0) {
    /* TODO: Consider marking the interface invalid */
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-24 21:40    [W:4.447 / U:0.856 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site