diff options
| author | Rafi Rubin <rafi@seas.upenn.edu> | 2011-03-08 00:24:29 -0500 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2011-03-08 14:36:31 +0100 |
| commit | f41a52d3010579949a3b9fd76783120d9643b60b (patch) | |
| tree | ff3644b3a776e9d954d4a4c0c35590f8fd594cf4 | |
| parent | 581548db3b3c0f6e25b500329eb02e3c72e7acbe (diff) | |
| download | op-kernel-dev-f41a52d3010579949a3b9fd76783120d9643b60b.zip op-kernel-dev-f41a52d3010579949a3b9fd76783120d9643b60b.tar.gz | |
HID: ntrig don't dereference unclaimed hidinput
Check before dereferencing field->hidinput to fix a reported invalid
deference bug.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| -rw-r--r-- | drivers/hid/hid-ntrig.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c index beb4034..a93e58c 100644 --- a/drivers/hid/hid-ntrig.c +++ b/drivers/hid/hid-ntrig.c @@ -539,8 +539,19 @@ static int ntrig_input_mapped(struct hid_device *hdev, struct hid_input *hi, static int ntrig_event (struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value) { - struct input_dev *input = field->hidinput->input; struct ntrig_data *nd = hid_get_drvdata(hid); + struct input_dev *input; + + /* Skip processing if not a claimed input */ + if (!(hid->claimed & HID_CLAIMED_INPUT)) + goto not_claimed_input; + + /* This function is being called before the structures are fully + * initialized */ + if(!(field->hidinput && field->hidinput->input)) + return -EINVAL; + + input = field->hidinput->input; /* No special handling needed for the pen */ if (field->application == HID_DG_PEN) @@ -810,6 +821,8 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field, } } +not_claimed_input: + /* we have handled the hidinput part, now remains hiddev */ if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_hid_event) hid->hiddev_hid_event(hid, field, usage, value); |
