mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-28 07:13:34 +00:00
HID: ntrig don't dereference unclaimed hidinput
Check before dereferencing field->hidinput to fix a reported invalid deference bug. Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This commit is contained in:
parent
581548db3b
commit
f41a52d301
1 changed files with 14 additions and 1 deletions
|
@ -539,8 +539,19 @@ static int ntrig_input_mapped(struct hid_device *hdev, struct hid_input *hi,
|
||||||
static int ntrig_event (struct hid_device *hid, struct hid_field *field,
|
static int ntrig_event (struct hid_device *hid, struct hid_field *field,
|
||||||
struct hid_usage *usage, __s32 value)
|
struct hid_usage *usage, __s32 value)
|
||||||
{
|
{
|
||||||
struct input_dev *input = field->hidinput->input;
|
|
||||||
struct ntrig_data *nd = hid_get_drvdata(hid);
|
struct ntrig_data *nd = hid_get_drvdata(hid);
|
||||||
|
struct input_dev *input;
|
||||||
|
|
||||||
|
/* Skip processing if not a claimed input */
|
||||||
|
if (!(hid->claimed & HID_CLAIMED_INPUT))
|
||||||
|
goto not_claimed_input;
|
||||||
|
|
||||||
|
/* This function is being called before the structures are fully
|
||||||
|
* initialized */
|
||||||
|
if(!(field->hidinput && field->hidinput->input))
|
||||||
|
return -EINVAL;
|
||||||
|
|
||||||
|
input = field->hidinput->input;
|
||||||
|
|
||||||
/* No special handling needed for the pen */
|
/* No special handling needed for the pen */
|
||||||
if (field->application == HID_DG_PEN)
|
if (field->application == HID_DG_PEN)
|
||||||
|
@ -810,6 +821,8 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
not_claimed_input:
|
||||||
|
|
||||||
/* we have handled the hidinput part, now remains hiddev */
|
/* we have handled the hidinput part, now remains hiddev */
|
||||||
if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_hid_event)
|
if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_hid_event)
|
||||||
hid->hiddev_hid_event(hid, field, usage, value);
|
hid->hiddev_hid_event(hid, field, usage, value);
|
||||||
|
|
Loading…
Reference in a new issue