diff options
| author | Rafi Rubin <rafi@seas.upenn.edu> | 2011-03-08 08:24:29 +0300 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2011-03-08 16:36:31 +0300 |
| commit | f41a52d3010579949a3b9fd76783120d9643b60b (patch) | |
| tree | ff3644b3a776e9d954d4a4c0c35590f8fd594cf4 /drivers/hid | |
| parent | 581548db3b3c0f6e25b500329eb02e3c72e7acbe (diff) | |
| download | linux-f41a52d3010579949a3b9fd76783120d9643b60b.tar.xz | |
HID: ntrig don't dereference unclaimed hidinput
Check before dereferencing field->hidinput to fix a reported invalid
deference bug.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid')
| -rw-r--r-- | drivers/hid/hid-ntrig.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c index beb403421e72..a93e58ca81ed 100644 --- a/drivers/hid/hid-ntrig.c +++ b/drivers/hid/hid-ntrig.c @@ -539,8 +539,19 @@ static int ntrig_input_mapped(struct hid_device *hdev, struct hid_input *hi, static int ntrig_event (struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value) { - struct input_dev *input = field->hidinput->input; struct ntrig_data *nd = hid_get_drvdata(hid); + struct input_dev *input; + + /* Skip processing if not a claimed input */ + if (!(hid->claimed & HID_CLAIMED_INPUT)) + goto not_claimed_input; + + /* This function is being called before the structures are fully + * initialized */ + if(!(field->hidinput && field->hidinput->input)) + return -EINVAL; + + input = field->hidinput->input; /* No special handling needed for the pen */ if (field->application == HID_DG_PEN) @@ -810,6 +821,8 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field, } } +not_claimed_input: + /* we have handled the hidinput part, now remains hiddev */ if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_hid_event) hid->hiddev_hid_event(hid, field, usage, value); |