lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.16 0395/1039] HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc
    Date
    From: José Expósito <jose.exposito89@gmail.com>

    [ Upstream commit 0a94131d6920916ccb6a357037c535533af08819 ]

    The function performs a check on the hdev input parameters, however, it
    is used before the check.

    Initialize the udev variable after the sanity check to avoid a
    possible NULL pointer dereference.

    Fixes: 9614219e9310e ("HID: uclogic: Extract tablet parameter discovery into a module")
    Addresses-Coverity-ID: 1443827 ("Null pointer dereference")
    Signed-off-by: José Expósito <jose.exposito89@gmail.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/hid/hid-uclogic-params.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
    index 3c10b858cf74c..3a83e2c39b4fb 100644
    --- a/drivers/hid/hid-uclogic-params.c
    +++ b/drivers/hid/hid-uclogic-params.c
    @@ -66,7 +66,7 @@ static int uclogic_params_get_str_desc(__u8 **pbuf, struct hid_device *hdev,
    __u8 idx, size_t len)
    {
    int rc;
    - struct usb_device *udev = hid_to_usb_dev(hdev);
    + struct usb_device *udev;
    __u8 *buf = NULL;

    /* Check arguments */
    @@ -75,6 +75,8 @@ static int uclogic_params_get_str_desc(__u8 **pbuf, struct hid_device *hdev,
    goto cleanup;
    }

    + udev = hid_to_usb_dev(hdev);
    +
    buf = kmalloc(len, GFP_KERNEL);
    if (buf == NULL) {
    rc = -ENOMEM;
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-25 01:11    [W:2.698 / U:0.332 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site