HID: hidraw, fix a NULL pointer dereference in hidraw_ioctl
BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 IP: [<ffffffffa02c66b4>] hidraw_ioctl+0xfc/0x32c [hid] [...] This is reproducible by disconnecting the device while userspace does ioctl in a loop and doesn't check return values in order to exit the loop. Signed-off-by: Antonio Ospite <ospite@studenti.unina.it> Cc: stable@kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This commit is contained in:
parent
a850ea3037
commit
d20d5ffab9
|
@ -244,6 +244,10 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
|
||||||
|
|
||||||
mutex_lock(&minors_lock);
|
mutex_lock(&minors_lock);
|
||||||
dev = hidraw_table[minor];
|
dev = hidraw_table[minor];
|
||||||
|
if (!dev) {
|
||||||
|
ret = -ENODEV;
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
|
||||||
switch (cmd) {
|
switch (cmd) {
|
||||||
case HIDIOCGRDESCSIZE:
|
case HIDIOCGRDESCSIZE:
|
||||||
|
@ -317,6 +321,7 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
|
||||||
|
|
||||||
ret = -ENOTTY;
|
ret = -ENOTTY;
|
||||||
}
|
}
|
||||||
|
out:
|
||||||
mutex_unlock(&minors_lock);
|
mutex_unlock(&minors_lock);
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue