tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

USB HID: fix a possible NULL pointer dereference when we fail to allocate memory

If, in usb_hid_configure(), we fail to allocate storage for 'usbhid',
"if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))",
then we'll jump to the 'fail:' label where we have this code:
usb_free_urb(usbhid->urbin);
usb_free_urb(usbhid->urbout);
usb_free_urb(usbhid->urbctrl);
Since we got here because we couldn't allocate storage for 'usbhid',
what we have here is a NULL pointer dereference - ouch...

This patch solves that little problem by adding a new
'fail_no_usbhid:' label after the problematic calls to
usb_free_urb() and jumps to that one instead, in the problem case.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

authored by

Jesper Juhl and committed by
Jiri Kosina de1a7b03 04a9b7ff

+2 -1
+2 -1
drivers/hid/usbhid/hid-core.c
··· 743 743 hid->quirks = quirks; 744 744 745 745 if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL))) 746 - goto fail; 746 + goto fail_no_usbhid; 747 747 748 748 hid->driver_data = usbhid; 749 749 usbhid->hid = hid; ··· 877 877 usb_free_urb(usbhid->urbin); 878 878 usb_free_urb(usbhid->urbout); 879 879 usb_free_urb(usbhid->urbctrl); 880 + fail_no_usbhid: 880 881 hid_free_buffers(dev, hid); 881 882 hid_free_device(hid); 882 883