diff options
| author | Johan Hovold <johan@hovoldconsulting.com> | 2015-03-27 12:45:46 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <greg@kroah.com> | 2015-03-30 15:20:33 +0200 |
| commit | 36257f6b4e7671cb12f98d91a6ffdeabdc254d0c (patch) | |
| tree | 0c0235e29113ccac6e050083eecbf99915d316d4 /drivers/staging/greybus/hid.c | |
| parent | ecf47ab9c5ca1427baea7ab6d3226502d967f19d (diff) | |
| download | op-kernel-dev-36257f6b4e7671cb12f98d91a6ffdeabdc254d0c.zip op-kernel-dev-36257f6b4e7671cb12f98d91a6ffdeabdc254d0c.tar.gz | |
greybus: hid: fix null-deref on short report requests
Make sure to verify the length of incoming requests before trying to
parse the request buffer, which can even be NULL on empty requests.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
Diffstat (limited to 'drivers/staging/greybus/hid.c')
| -rw-r--r-- | drivers/staging/greybus/hid.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/staging/greybus/hid.c b/drivers/staging/greybus/hid.c index f0da387..a225813 100644 --- a/drivers/staging/greybus/hid.c +++ b/drivers/staging/greybus/hid.c @@ -163,6 +163,11 @@ static void gb_hid_irq_handler(u8 type, struct gb_operation *op) return; } + if (op->request->payload_size < 2) { + dev_err(&connection->dev, "short report received\n"); + return; + } + size = request->report[0] | request->report[1] << 8; if (!size) { dev_err(&connection->dev, "bad report size: %d\n", size); |
