aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/hid
diff options
context:
space:
mode:
authorChris Ball <cjb@laptop.org>2010-08-12 19:07:40 -0400
committerJiri Kosina <jkosina@suse.cz>2010-08-13 05:19:24 -0400
commit7032269e87ade34cc12891675371fa2ac150a620 (patch)
tree3f42a6e4449d00b8598c1796ee0a9523365e2dcb /drivers/hid
parent1778ca298b06ec86af5fc9603447c379cbfb477b (diff)
HID: hiddev: protect against disconnect/NULL-dereference race
One of our users reports consistently hitting a NULL dereference that resolves to the "hid_to_usb_dev(hid);" call in hiddev_ioctl(), when disconnecting a Lego WeDo USB HID device from an OLPC XO running Scratch software. There's a FIXME comment and a guard against the dereference, but that happens farther down the function than the initial dereference does. This patch moves the call to be below the guard, and the user reports that it fixes the problem for him. OLPC bug report: http://dev.laptop.org/ticket/10174 Signed-off-by: Chris Ball <cjb@laptop.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid')
-rw-r--r--drivers/hid/usbhid/hiddev.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 254a003af048..f2850171a69b 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -587,7 +587,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
587 struct hiddev_list *list = file->private_data; 587 struct hiddev_list *list = file->private_data;
588 struct hiddev *hiddev = list->hiddev; 588 struct hiddev *hiddev = list->hiddev;
589 struct hid_device *hid = hiddev->hid; 589 struct hid_device *hid = hiddev->hid;
590 struct usb_device *dev = hid_to_usb_dev(hid); 590 struct usb_device *dev;
591 struct hiddev_collection_info cinfo; 591 struct hiddev_collection_info cinfo;
592 struct hiddev_report_info rinfo; 592 struct hiddev_report_info rinfo;
593 struct hiddev_field_info finfo; 593 struct hiddev_field_info finfo;
@@ -601,9 +601,11 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
601 /* Called without BKL by compat methods so no BKL taken */ 601 /* Called without BKL by compat methods so no BKL taken */
602 602
603 /* FIXME: Who or what stop this racing with a disconnect ?? */ 603 /* FIXME: Who or what stop this racing with a disconnect ?? */
604 if (!hiddev->exist) 604 if (!hiddev->exist || !hid)
605 return -EIO; 605 return -EIO;
606 606
607 dev = hid_to_usb_dev(hid);
608
607 switch (cmd) { 609 switch (cmd) {
608 610
609 case HIDIOCGVERSION: 611 case HIDIOCGVERSION: