diff options
| author | Jesper Juhl <jesper.juhl@gmail.com> | 2007-07-30 15:15:26 +0200 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2007-08-02 13:48:03 +0200 |
| commit | de1a7b03282310d143cb0add74e909daffedda01 (patch) | |
| tree | b65e3873d4805595a242257d06524982e960edb2 /drivers/hid | |
| parent | 04a9b7ffceff4337d9e63476b5c71e9b79249969 (diff) | |
| download | linux-stable-de1a7b03282310d143cb0add74e909daffedda01.tar.gz linux-stable-de1a7b03282310d143cb0add74e909daffedda01.tar.bz2 linux-stable-de1a7b03282310d143cb0add74e909daffedda01.zip | |
USB HID: fix a possible NULL pointer dereference when we fail to allocate memory
If, in usb_hid_configure(), we fail to allocate storage for 'usbhid',
"if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))",
then we'll jump to the 'fail:' label where we have this code:
usb_free_urb(usbhid->urbin);
usb_free_urb(usbhid->urbout);
usb_free_urb(usbhid->urbctrl);
Since we got here because we couldn't allocate storage for 'usbhid',
what we have here is a NULL pointer dereference - ouch...
This patch solves that little problem by adding a new
'fail_no_usbhid:' label after the problematic calls to
usb_free_urb() and jumps to that one instead, in the problem case.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid')
| -rw-r--r-- | drivers/hid/usbhid/hid-core.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c index b2baeaeba9be..3ff74685875d 100644 --- a/drivers/hid/usbhid/hid-core.c +++ b/drivers/hid/usbhid/hid-core.c @@ -743,7 +743,7 @@ static struct hid_device *usb_hid_configure(struct usb_interface *intf) hid->quirks = quirks; if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL))) - goto fail; + goto fail_no_usbhid; hid->driver_data = usbhid; usbhid->hid = hid; @@ -877,6 +877,7 @@ fail: usb_free_urb(usbhid->urbin); usb_free_urb(usbhid->urbout); usb_free_urb(usbhid->urbctrl); +fail_no_usbhid: hid_free_buffers(dev, hid); hid_free_device(hid); |