A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 07:37:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

greybus: hid: fix null-deref on short report requests

Browse source 
Make sure to verify the length of incoming requests before trying to
parse the request buffer, which can even be NULL on empty requests.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
This commit is contained in:
Johan Hovold 2015-03-27 12:45:46 +01:00 • committed by Greg Kroah-Hartman
commit 36257f6b4e
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
drivers/staging/greybus/hid.c
View file

@ -163,6 +163,11 @@ static void gb_hid_irq_handler(u8 type, struct gb_operation *op)
return;
}
if (op->request->payload_size < 2) {
dev_err(&connection->dev, "short report received\n");
return;
}
size = request->report[0] | request->report[1] << 8;
if (!size) {
dev_err(&connection->dev, "bad report size: %d\n", size);