mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 05:48:40 +00:00
USB HID: fix a possible NULL pointer dereference when we fail to allocate memory
If, in usb_hid_configure(), we fail to allocate storage for 'usbhid', "if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))", then we'll jump to the 'fail:' label where we have this code: usb_free_urb(usbhid->urbin); usb_free_urb(usbhid->urbout); usb_free_urb(usbhid->urbctrl); Since we got here because we couldn't allocate storage for 'usbhid', what we have here is a NULL pointer dereference - ouch... This patch solves that little problem by adding a new 'fail_no_usbhid:' label after the problematic calls to usb_free_urb() and jumps to that one instead, in the problem case. Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This commit is contained in:
parent
04a9b7ffce
commit
de1a7b0328
1 changed files with 2 additions and 1 deletions
|
@ -743,7 +743,7 @@ static struct hid_device *usb_hid_configure(struct usb_interface *intf)
|
|||
hid->quirks = quirks;
|
||||
|
||||
if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))
|
||||
goto fail;
|
||||
goto fail_no_usbhid;
|
||||
|
||||
hid->driver_data = usbhid;
|
||||
usbhid->hid = hid;
|
||||
|
@ -877,6 +877,7 @@ static struct hid_device *usb_hid_configure(struct usb_interface *intf)
|
|||
usb_free_urb(usbhid->urbin);
|
||||
usb_free_urb(usbhid->urbout);
|
||||
usb_free_urb(usbhid->urbctrl);
|
||||
fail_no_usbhid:
|
||||
hid_free_buffers(dev, hid);
|
||||
hid_free_device(hid);
|
||||
|
||||
|
|
Loading…
Reference in a new issue