Skip to content

Commit 22a0546

Browse files
LawstorantJiri Kosina
authored andcommitted
HID: pidff: Fix null pointer dereference in pidff_find_fields
This function triggered a null pointer dereference if used to search for a report that isn't implemented on the device. This happened both for optional and required reports alike. The same logic was applied to pidff_find_special_field and although pidff_init_fields should return an error earlier if one of the required reports is missing, future modifications could change this logic and resurface this possible null pointer dereference again. LKML bug report: https://lore.kernel.org/all/CAL-gK7f5=R0nrrQdPtaZZr1fd-cdAMbDMuZ_NLA8vM0SX+nGSw@mail.gmail.com Reported-by: Nolan Nicholson <nolananicholson@gmail.com> Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Reviewed-by: Michał Kopeć <michal@nozomi.space> Reviewed-by: Paul Dino Jones <paul@spacefreak18.xyz> Tested-by: Paul Dino Jones <paul@spacefreak18.xyz> Tested-by: Cristóferson Bueno <cbueno81@gmail.com> Tested-by: Pablo Cisneros <patchkez@protonmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
1 parent f7ebf0b commit 22a0546

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

drivers/hid/usbhid/hid-pidff.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -926,6 +926,11 @@ static void pidff_set_autocenter(struct input_dev *dev, u16 magnitude)
926926
static int pidff_find_fields(struct pidff_usage *usage, const u8 *table,
927927
struct hid_report *report, int count, int strict)
928928
{
929+
if (!report) {
930+
pr_debug("pidff_find_fields, null report\n");
931+
return -1;
932+
}
933+
929934
int i, j, k, found;
930935
int return_value = 0;
931936

@@ -1050,6 +1055,11 @@ static int pidff_reports_ok(struct pidff_device *pidff)
10501055
static struct hid_field *pidff_find_special_field(struct hid_report *report,
10511056
int usage, int enforce_min)
10521057
{
1058+
if (!report) {
1059+
pr_debug("pidff_find_special_field, null report\n");
1060+
return NULL;
1061+
}
1062+
10531063
int i;
10541064

10551065
for (i = 0; i < report->maxfield; i++) {

0 commit comments

Comments
 (0)