lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

USB HID: fix a possible NULL pointer dereference when we fail to allocate memory

Browse Source 
If, in usb_hid_configure(), we fail to allocate storage for 'usbhid',
 "if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))",
then we'll jump to the 'fail:' label where we have this code:
        usb_free_urb(usbhid->urbin);
        usb_free_urb(usbhid->urbout);
        usb_free_urb(usbhid->urbctrl);
Since we got here because we couldn't allocate storage for 'usbhid',
what we have here is a NULL pointer dereference - ouch...

This patch solves that little problem by adding a new
'fail_no_usbhid:' label after the problematic calls to
usb_free_urb() and jumps to that one instead, in the problem case.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This commit is contained in:
Jesper Juhl
2007-07-30 15:15:26 +02:00
committed by Jiri Kosina
parent 04a9b7ffce
commit de1a7b0328
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/hid/usbhid/hid-core.c
View File

@@ -743,7 +743,7 @@ static struct hid_device *usb_hid_configure(struct usb_interface *intf)
hid->quirks = quirks; hid->quirks = quirks;
if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL))) if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))
goto fail; goto fail_no_usbhid;
hid->driver_data = usbhid; hid->driver_data = usbhid;
usbhid->hid = hid; usbhid->hid = hid;
@@ -877,6 +877,7 @@ fail:
usb_free_urb(usbhid->urbin); usb_free_urb(usbhid->urbin);
usb_free_urb(usbhid->urbout); usb_free_urb(usbhid->urbout);
usb_free_urb(usbhid->urbctrl); usb_free_urb(usbhid->urbctrl);
fail_no_usbhid:
hid_free_buffers(dev, hid); hid_free_buffers(dev, hid);
hid_free_device(hid); hid_free_device(hid);