aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/hid/hid-roccat-koneplus.c
diff options
context:
space:
mode:
authorStefan Achatz <erazor_de@users.sourceforge.net>2011-06-12 04:02:44 -0400
committerJiri Kosina <jkosina@suse.cz>2011-06-13 07:06:23 -0400
commit901e64dbdb5998b9248c372a401c921bbdf662f6 (patch)
tree439c7685adb52e2b97b968ee6535da29a8434915 /drivers/hid/hid-roccat-koneplus.c
parent1edd5b42a6631b1b1f147e9018e309bde8d96a05 (diff)
HID: roccat: fix NULL pointer dereference, add range checks
On rare occassions raw events can be triggered before drvdata gets set up which leads to NULL pointer dereferences. This was only observed with pyra on 2.6.39, but is fixed for all devices now to play it save. kovaplus returned wrong actual values when profile change was initiated from host. Added range checks for setting actual profile on all devices. Signed-off-by: Stefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid/hid-roccat-koneplus.c')
-rw-r--r--drivers/hid/hid-roccat-koneplus.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/hid/hid-roccat-koneplus.c b/drivers/hid/hid-roccat-koneplus.c
index 33ecad50395b..59e47770fa10 100644
--- a/drivers/hid/hid-roccat-koneplus.c
+++ b/drivers/hid/hid-roccat-koneplus.c
@@ -431,6 +431,9 @@ static ssize_t koneplus_sysfs_set_actual_profile(struct device *dev,
431 if (retval) 431 if (retval)
432 return retval; 432 return retval;
433 433
434 if (profile > 4)
435 return -EINVAL;
436
434 mutex_lock(&koneplus->koneplus_lock); 437 mutex_lock(&koneplus->koneplus_lock);
435 438
436 retval = koneplus_set_actual_profile(usb_dev, profile); 439 retval = koneplus_set_actual_profile(usb_dev, profile);
@@ -439,7 +442,7 @@ static ssize_t koneplus_sysfs_set_actual_profile(struct device *dev,
439 return retval; 442 return retval;
440 } 443 }
441 444
442 koneplus->actual_profile = profile; 445 koneplus_profile_activated(koneplus, profile);
443 446
444 roccat_report.type = KONEPLUS_MOUSE_REPORT_BUTTON_TYPE_PROFILE; 447 roccat_report.type = KONEPLUS_MOUSE_REPORT_BUTTON_TYPE_PROFILE;
445 roccat_report.data1 = profile + 1; 448 roccat_report.data1 = profile + 1;
@@ -751,6 +754,9 @@ static int koneplus_raw_event(struct hid_device *hdev,
751 != USB_INTERFACE_PROTOCOL_MOUSE) 754 != USB_INTERFACE_PROTOCOL_MOUSE)
752 return 0; 755 return 0;
753 756
757 if (koneplus == NULL)
758 return 0;
759
754 koneplus_keep_values_up_to_date(koneplus, data); 760 koneplus_keep_values_up_to_date(koneplus, data);
755 761
756 if (koneplus->roccat_claimed) 762 if (koneplus->roccat_claimed)