android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HID: uhid: avoid dangling pointers in uhid context

Browse Source 
Avoid keeping uhid->rd_data and uhid->rd_size set in case
uhid_dev_create2() fails. This is non-critical as we never flip
uhid->running and thus never enter uhid_dev_destroy(). However, it's much
nicer for debugging if pointers are only set if they point to valid data.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This commit is contained in:
David Herrmann
2014-07-29 17:14:17 +02:00
committed by Jiri Kosina
parent 56c4775463
commit 41c4a46423
1 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/hid/uhid.c
View File

@ -363,20 +363,24 @@ static int uhid_dev_create2(struct uhid_device *uhid,
const struct uhid_event *ev) const struct uhid_event *ev)
{ {
struct hid_device *hid; struct hid_device *hid;
size_t rd_size;
void *rd_data;
int ret; int ret;
if (uhid->running) if (uhid->running)
return -EALREADY; return -EALREADY;
uhid->rd_size = ev->u.create2.rd_size; rd_size = ev->u.create2.rd_size;
if (uhid->rd_size <= 0 || uhid->rd_size > HID_MAX_DESCRIPTOR_SIZE) if (rd_size <= 0 || rd_size > HID_MAX_DESCRIPTOR_SIZE)
return -EINVAL; return -EINVAL;
uhid->rd_data = kmemdup(ev->u.create2.rd_data, uhid->rd_size, rd_data = kmemdup(ev->u.create2.rd_data, rd_size, GFP_KERNEL);
GFP_KERNEL); if (!rd_data)
if (!uhid->rd_data)
return -ENOMEM; return -ENOMEM;
uhid->rd_size = rd_size;
uhid->rd_data = rd_data;
hid = hid_allocate_device(); hid = hid_allocate_device();
if (IS_ERR(hid)) { if (IS_ERR(hid)) {
ret = PTR_ERR(hid); ret = PTR_ERR(hid);
@ -416,6 +420,8 @@ err_hid:
uhid->running = false; uhid->running = false;
err_free: err_free:
kfree(uhid->rd_data); kfree(uhid->rd_data);
uhid->rd_data = NULL;
uhid->rd_size = 0;
return ret; return ret;
} }