Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f6fbc6a0 authored by José Expósito's avatar José Expósito Committed by Greg Kroah-Hartman
Browse files

HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init 



[ Upstream commit ff6b548afe4d9d1ff3a0f6ef79e8cbca25d8f905 ]

The function performs a check on its input parameters, however, the
hdev parameter is used before the check.

Initialize the stack variables after checking the input parameters to
avoid a possible NULL pointer dereference.

Fixes: 9614219e ("HID: uclogic: Extract tablet parameter discovery into a module")
Addresses-Coverity-ID: 1443804 ("Null pointer dereference")
Signed-off-by: default avatarJosé Expósito <jose.exposito89@gmail.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 1f660b3f

drivers/hid/hid-uclogic-params.c

+7 −3
Original line number Original line Diff line number Diff line
@@ -707,9 +707,9 @@ static int uclogic_params_huion_init(struct uclogic_params *params, 
				     struct hid_device *hdev)

				     struct hid_device *hdev)

{

{

	int rc;

	int rc;

	struct usb_device *udev = hid_to_usb_dev(hdev);

	struct usb_device *udev;

	struct usb_interface *iface = to_usb_interface(hdev->dev.parent);

	struct usb_interface *iface;

	__u8 bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber;

	__u8 bInterfaceNumber;

	bool found;

	bool found;

	/* The resulting parameters (noop) */

	/* The resulting parameters (noop) */

	struct uclogic_params p = {0, };

	struct uclogic_params p = {0, };
@@ -723,6 +723,10 @@ static int uclogic_params_huion_init(struct uclogic_params *params, 
		goto cleanup;

		goto cleanup;

	}

	}





	udev = hid_to_usb_dev(hdev);

	iface = to_usb_interface(hdev->dev.parent);

	bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber;



	/* If it's not a pen interface */

	/* If it's not a pen interface */

	if (bInterfaceNumber != 0) {

	if (bInterfaceNumber != 0) {

		/* TODO: Consider marking the interface invalid */

		/* TODO: Consider marking the interface invalid */