lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 328/846] HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init
    Date
    From: José Expósito <jose.exposito89@gmail.com>

    [ Upstream commit f364c571a5c77e96de2d32062ff019d6b8d2e2bc ]

    The function performs a check on its input parameters, however, the
    hdev parameter is used before the check.

    Initialize the stack variables after checking the input parameters to
    avoid a possible NULL pointer dereference.

    Fixes: 9614219e9310e ("HID: uclogic: Extract tablet parameter discovery into a module")
    Addresses-Coverity-ID: 1443831 ("Null pointer dereference")
    Signed-off-by: José Expósito <jose.exposito89@gmail.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/hid/hid-uclogic-params.c | 13 +++++++++----
    1 file changed, 9 insertions(+), 4 deletions(-)

    diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
    index adff1bd68d9f8..3c10b858cf74c 100644
    --- a/drivers/hid/hid-uclogic-params.c
    +++ b/drivers/hid/hid-uclogic-params.c
    @@ -834,10 +834,10 @@ int uclogic_params_init(struct uclogic_params *params,
    struct hid_device *hdev)
    {
    int rc;
    - struct usb_device *udev = hid_to_usb_dev(hdev);
    - __u8 bNumInterfaces = udev->config->desc.bNumInterfaces;
    - struct usb_interface *iface = to_usb_interface(hdev->dev.parent);
    - __u8 bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber;
    + struct usb_device *udev;
    + __u8 bNumInterfaces;
    + struct usb_interface *iface;
    + __u8 bInterfaceNumber;
    bool found;
    /* The resulting parameters (noop) */
    struct uclogic_params p = {0, };
    @@ -848,6 +848,11 @@ int uclogic_params_init(struct uclogic_params *params,
    goto cleanup;
    }

    + udev = hid_to_usb_dev(hdev);
    + bNumInterfaces = udev->config->desc.bNumInterfaces;
    + iface = to_usb_interface(hdev->dev.parent);
    + bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber;
    +
    /*
    * Set replacement report descriptor if the original matches the
    * specified size. Otherwise keep interface unchanged.
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-25 00:11    [W:5.599 / U:0.676 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site