diff options
author | Rafi Rubin <rafi@seas.upenn.edu> | 2011-03-08 00:24:29 -0500 |
---|---|---|
committer | Jiri Kosina <jkosina@suse.cz> | 2011-03-08 08:36:31 -0500 |
commit | f41a52d3010579949a3b9fd76783120d9643b60b (patch) | |
tree | ff3644b3a776e9d954d4a4c0c35590f8fd594cf4 /drivers/hid/hid-ntrig.c | |
parent | 581548db3b3c0f6e25b500329eb02e3c72e7acbe (diff) |
HID: ntrig don't dereference unclaimed hidinput
Check before dereferencing field->hidinput to fix a reported invalid
deference bug.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid/hid-ntrig.c')
-rw-r--r-- | drivers/hid/hid-ntrig.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c index beb403421e72..a93e58ca81ed 100644 --- a/drivers/hid/hid-ntrig.c +++ b/drivers/hid/hid-ntrig.c | |||
@@ -539,8 +539,19 @@ static int ntrig_input_mapped(struct hid_device *hdev, struct hid_input *hi, | |||
539 | static int ntrig_event (struct hid_device *hid, struct hid_field *field, | 539 | static int ntrig_event (struct hid_device *hid, struct hid_field *field, |
540 | struct hid_usage *usage, __s32 value) | 540 | struct hid_usage *usage, __s32 value) |
541 | { | 541 | { |
542 | struct input_dev *input = field->hidinput->input; | ||
543 | struct ntrig_data *nd = hid_get_drvdata(hid); | 542 | struct ntrig_data *nd = hid_get_drvdata(hid); |
543 | struct input_dev *input; | ||
544 | |||
545 | /* Skip processing if not a claimed input */ | ||
546 | if (!(hid->claimed & HID_CLAIMED_INPUT)) | ||
547 | goto not_claimed_input; | ||
548 | |||
549 | /* This function is being called before the structures are fully | ||
550 | * initialized */ | ||
551 | if(!(field->hidinput && field->hidinput->input)) | ||
552 | return -EINVAL; | ||
553 | |||
554 | input = field->hidinput->input; | ||
544 | 555 | ||
545 | /* No special handling needed for the pen */ | 556 | /* No special handling needed for the pen */ |
546 | if (field->application == HID_DG_PEN) | 557 | if (field->application == HID_DG_PEN) |
@@ -810,6 +821,8 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field, | |||
810 | } | 821 | } |
811 | } | 822 | } |
812 | 823 | ||
824 | not_claimed_input: | ||
825 | |||
813 | /* we have handled the hidinput part, now remains hiddev */ | 826 | /* we have handled the hidinput part, now remains hiddev */ |
814 | if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_hid_event) | 827 | if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_hid_event) |
815 | hid->hiddev_hid_event(hid, field, usage, value); | 828 | hid->hiddev_hid_event(hid, field, usage, value); |