Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7032269e authored by Chris Ball's avatar Chris Ball Committed by Jiri Kosina
Browse files

HID: hiddev: protect against disconnect/NULL-dereference race 

One of our users reports consistently hitting a NULL dereference that
resolves to the "hid_to_usb_dev(hid);" call in hiddev_ioctl(), when
disconnecting a Lego WeDo USB HID device from an OLPC XO running
Scratch software.  There's a FIXME comment and a guard against the
dereference, but that happens farther down the function than the
initial dereference does.

This patch moves the call to be below the guard, and the user reports
that it fixes the problem for him.  OLPC bug report:
http://dev.laptop.org/ticket/10174



Signed-off-by: default avatarChris Ball <cjb@laptop.org>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 1778ca29

drivers/hid/usbhid/hiddev.c

+4 −2
Original line number Original line Diff line number Diff line
@@ -587,7 +587,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 
	struct hiddev_list *list = file->private_data;

	struct hiddev_list *list = file->private_data;

	struct hiddev *hiddev = list->hiddev;

	struct hiddev *hiddev = list->hiddev;

	struct hid_device *hid = hiddev->hid;

	struct hid_device *hid = hiddev->hid;

	struct usb_device *dev = hid_to_usb_dev(hid);

	struct usb_device *dev;

	struct hiddev_collection_info cinfo;

	struct hiddev_collection_info cinfo;

	struct hiddev_report_info rinfo;

	struct hiddev_report_info rinfo;

	struct hiddev_field_info finfo;

	struct hiddev_field_info finfo;
@@ -601,9 +601,11 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 
	/* Called without BKL by compat methods so no BKL taken */

	/* Called without BKL by compat methods so no BKL taken */





	/* FIXME: Who or what stop this racing with a disconnect ?? */

	/* FIXME: Who or what stop this racing with a disconnect ?? */

	if (!hiddev->exist)

	if (!hiddev->exist || !hid)

		return -EIO;

		return -EIO;





	dev = hid_to_usb_dev(hid);



	switch (cmd) {

	switch (cmd) {





	case HIDIOCGVERSION:

	case HIDIOCGVERSION: