Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dd3edeb6 authored by Andrew Duggan's avatar Andrew Duggan Committed by Jiri Kosina
Browse files

HID: rmi: check that report ids exist in the report_id_hash before accessing their size 

It is possible that the hid-rmi driver could get loaded onto a device which does not have the
expected report ids. This should not happen because it would indicate that the hid-rmi driver is
not compatible with that device. However, if it does happen it should return an error from probe
instead of dereferencing a null pointer.

related bug:
https://bugzilla.kernel.org/show_bug.cgi?id=80091



Signed-off-by: default avatarAndrew Duggan <aduggan@synaptics.com>
Reviewed-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 01a5f8a4

drivers/hid/hid-rmi.c

+22 −6
Original line number Diff line number Diff line
@@ -848,6 +848,8 @@ static int rmi_probe(struct hid_device *hdev, const struct hid_device_id *id) 
	struct rmi_data *data = NULL;

	int ret;

	size_t alloc_size;

	struct hid_report *input_report;

	struct hid_report *output_report;



	data = devm_kzalloc(&hdev->dev, sizeof(struct rmi_data), GFP_KERNEL);

	if (!data)
@@ -866,11 +868,25 @@ static int rmi_probe(struct hid_device *hdev, const struct hid_device_id *id) 
		return ret;

	}



	data->input_report_size = (hdev->report_enum[HID_INPUT_REPORT]

		.report_id_hash[RMI_ATTN_REPORT_ID]->size >> 3)

		+ 1 /* report id */;

	data->output_report_size = (hdev->report_enum[HID_OUTPUT_REPORT]

		.report_id_hash[RMI_WRITE_REPORT_ID]->size >> 3)

	input_report = hdev->report_enum[HID_INPUT_REPORT]

			.report_id_hash[RMI_ATTN_REPORT_ID];

	if (!input_report) {

		hid_err(hdev, "device does not have expected input report\n");

		ret = -ENODEV;

		return ret;

	}



	data->input_report_size = (input_report->size >> 3) + 1 /* report id */;



	output_report = hdev->report_enum[HID_OUTPUT_REPORT]

			.report_id_hash[RMI_WRITE_REPORT_ID];

	if (!output_report) {

		hid_err(hdev, "device does not have expected output report\n");

		ret = -ENODEV;

		return ret;

	}



	data->output_report_size = (output_report->size >> 3)

					+ 1 /* report id */;



	alloc_size = data->output_report_size + data->input_report_size;