Commit de1a7b03 authored Jul 30, 2007 by Jesper Juhl Committed by Jiri Kosina Aug 02, 2007

USB HID: fix a possible NULL pointer dereference when we fail to allocate memory



If, in usb_hid_configure(), we fail to allocate storage for 'usbhid',
 "if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))",
then we'll jump to the 'fail:' label where we have this code:
        usb_free_urb(usbhid->urbin);
        usb_free_urb(usbhid->urbout);
        usb_free_urb(usbhid->urbctrl);
Since we got here because we couldn't allocate storage for 'usbhid',
what we have here is a NULL pointer dereference - ouch...

This patch solves that little problem by adding a new
'fail_no_usbhid:' label after the problematic calls to
usb_free_urb() and jumps to that one instead, in the problem case.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

parent 04a9b7ff

drivers/hid/usbhid/hid-core.c

+2 −1

Original line number	Original line	Diff line number	Diff line
	@@ -743,7 +743,7 @@ static struct hid_device usb_hid_configure(struct usb_interface intf)
	hid->quirks = quirks;		hid->quirks = quirks;

	if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))		if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))
	goto fail;		goto fail_no_usbhid;

	hid->driver_data = usbhid;		hid->driver_data = usbhid;
	usbhid->hid = hid;		usbhid->hid = hid;
	@@ -877,6 +877,7 @@ static struct hid_device usb_hid_configure(struct usb_interface intf)
	usb_free_urb(usbhid->urbin);		usb_free_urb(usbhid->urbin);
	usb_free_urb(usbhid->urbout);		usb_free_urb(usbhid->urbout);
	usb_free_urb(usbhid->urbctrl);		usb_free_urb(usbhid->urbctrl);
			fail_no_usbhid:
	hid_free_buffers(dev, hid);		hid_free_buffers(dev, hid);
	hid_free_device(hid);		hid_free_device(hid);