aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/hid
diff options
context:
space:
mode:
authorJesper Juhl <jesper.juhl@gmail.com>2007-07-30 09:15:26 -0400
committerJiri Kosina <jkosina@suse.cz>2007-08-02 07:48:03 -0400
commitde1a7b03282310d143cb0add74e909daffedda01 (patch)
treeb65e3873d4805595a242257d06524982e960edb2 /drivers/hid
parent04a9b7ffceff4337d9e63476b5c71e9b79249969 (diff)
USB HID: fix a possible NULL pointer dereference when we fail to allocate memory
If, in usb_hid_configure(), we fail to allocate storage for 'usbhid', "if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))", then we'll jump to the 'fail:' label where we have this code: usb_free_urb(usbhid->urbin); usb_free_urb(usbhid->urbout); usb_free_urb(usbhid->urbctrl); Since we got here because we couldn't allocate storage for 'usbhid', what we have here is a NULL pointer dereference - ouch... This patch solves that little problem by adding a new 'fail_no_usbhid:' label after the problematic calls to usb_free_urb() and jumps to that one instead, in the problem case. Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid')
-rw-r--r--drivers/hid/usbhid/hid-core.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index b2baeaeba9be..3ff74685875d 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -743,7 +743,7 @@ static struct hid_device *usb_hid_configure(struct usb_interface *intf)
743 hid->quirks = quirks; 743 hid->quirks = quirks;
744 744
745 if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL))) 745 if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))
746 goto fail; 746 goto fail_no_usbhid;
747 747
748 hid->driver_data = usbhid; 748 hid->driver_data = usbhid;
749 usbhid->hid = hid; 749 usbhid->hid = hid;
@@ -877,6 +877,7 @@ fail:
877 usb_free_urb(usbhid->urbin); 877 usb_free_urb(usbhid->urbin);
878 usb_free_urb(usbhid->urbout); 878 usb_free_urb(usbhid->urbout);
879 usb_free_urb(usbhid->urbctrl); 879 usb_free_urb(usbhid->urbctrl);
880fail_no_usbhid:
880 hid_free_buffers(dev, hid); 881 hid_free_buffers(dev, hid);
881 hid_free_device(hid); 882 hid_free_device(hid);
882 883