iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

greybus: hid: fix null-deref on short report requests

Browse Source 
Make sure to verify the length of incoming requests before trying to
parse the request buffer, which can even be NULL on empty requests.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
This commit is contained in:
Johan Hovold
2015-03-27 12:45:46 +01:00
committed by Greg Kroah-Hartman
parent ecf47ab9c5
commit 36257f6b4e
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/staging/greybus/hid.c
View File

@ -163,6 +163,11 @@ static void gb_hid_irq_handler(u8 type, struct gb_operation *op)
return; return;
} }
if (op->request->payload_size < 2) {
dev_err(&connection->dev, "short report received\n");
return;
}
size = request->report[0] | request->report[1] << 8; size = request->report[0] | request->report[1] << 8;
if (!size) { if (!size) {
dev_err(&connection->dev, "bad report size: %d\n", size); dev_err(&connection->dev, "bad report size: %d\n", size);