Messages in this thread Patch in this message | | | From | Michael Zaidman <> | Subject | [PATCH v4 11/13] HID: ft260: fix a NULL pointer dereference in ft260_i2c_write | Date | Sat, 5 Nov 2022 23:11:49 +0200 |
| |
The zero-length passed into the ft260_i2c_write() triggered the NULL pointer dereference in the debug message on data[0] access. Since the controller does not support a write of zero length, let's not allow it.
Before:
$ sudo i2ctransfer -y 13 w0@0x51 Killed
After:
$ sudo i2ctransfer -y 13 w0@0x51 Error: Sending messages failed: Invalid argument
Reported-by: Enrik Berkhan <Enrik.Berkhan@inka.de> Signed-off-by: Michael Zaidman <michael.zaidman@gmail.com> --- drivers/hid/hid-ft260.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/hid/hid-ft260.c b/drivers/hid/hid-ft260.c index ac133980dfe9..b4f180c8750a 100644 --- a/drivers/hid/hid-ft260.c +++ b/drivers/hid/hid-ft260.c @@ -409,6 +409,9 @@ static int ft260_i2c_write(struct ft260_device *dev, u8 addr, u8 *data, struct ft260_i2c_write_request_report *rep = (struct ft260_i2c_write_request_report *)dev->write_buf; + if (len < 1) + return -EINVAL; + rep->flag = FT260_FLAG_START; do { -- 2.34.1
| |