diff mbox

HID: logitech-hidpp: leaks and NULL dereferences

Message ID 20141031091439.GA11252@mwanda (mailing list archive)
State New, archived
Delegated to: Jiri Kosina
Headers show

Commit Message

Dan Carpenter Oct. 31, 2014, 9:14 a.m. UTC 
Shift the allocation down a few lines to avoid a memory leak and also
add a check for allocation failure.

Fixes: 2f31c5252910 ('HID: Introduce hidpp, a module to handle Logitech hid++ devices')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-input" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Benjamin Tissoires Oct. 31, 2014, 1:49 p.m. UTC | #1 
On Oct 31 2014 or thereabouts, Dan Carpenter wrote:
> Shift the allocation down a few lines to avoid a memory leak and also
> add a check for allocation failure.
> 
> Fixes: 2f31c5252910 ('HID: Introduce hidpp, a module to handle Logitech hid++ devices')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 

Ouch, I am ashamed of not having spot that :/

Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>

Thanks Dan!
Benjamin

> diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
> index 361e97d..3cce995 100644
> --- a/drivers/hid/hid-logitech-hidpp.c
> +++ b/drivers/hid/hid-logitech-hidpp.c
> @@ -200,13 +200,15 @@ static int hidpp_send_fap_command_sync(struct hidpp_device *hidpp,
>  	u8 feat_index, u8 funcindex_clientid, u8 *params, int param_count,
>  	struct hidpp_report *response)
>  {
> -	struct hidpp_report *message = kzalloc(sizeof(struct hidpp_report),
> -			GFP_KERNEL);
> +	struct hidpp_report *message;
>  	int ret;
>  
>  	if (param_count > sizeof(message->fap.params))
>  		return -EINVAL;
>  
> +	message = kzalloc(sizeof(struct hidpp_report), GFP_KERNEL);
> +	if (!message)
> +		return -ENOMEM;
>  	message->report_id = REPORT_ID_HIDPP_LONG;
>  	message->fap.feature_index = feat_index;
>  	message->fap.funcindex_clientid = funcindex_clientid;
> @@ -221,8 +223,7 @@ static int hidpp_send_rap_command_sync(struct hidpp_device *hidpp_dev,
>  	u8 report_id, u8 sub_id, u8 reg_address, u8 *params, int param_count,
>  	struct hidpp_report *response)
>  {
> -	struct hidpp_report *message = kzalloc(sizeof(struct hidpp_report),
> -			GFP_KERNEL);
> +	struct hidpp_report *message;
>  	int ret;
>  
>  	if ((report_id != REPORT_ID_HIDPP_SHORT) &&
> @@ -232,6 +233,9 @@ static int hidpp_send_rap_command_sync(struct hidpp_device *hidpp_dev,
>  	if (param_count > sizeof(message->rap.params))
>  		return -EINVAL;
>  
> +	message = kzalloc(sizeof(struct hidpp_report), GFP_KERNEL);
> +	if (!message)
> +		return -ENOMEM;
>  	message->report_id = report_id;
>  	message->rap.sub_id = sub_id;
>  	message->rap.reg_address = reg_address;
--
To unsubscribe from this list: send the line "unsubscribe linux-input" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Jiri Kosina Nov. 3, 2014, 1:27 p.m. UTC | #2 
On Fri, 31 Oct 2014, Benjamin Tissoires wrote:

> > Shift the allocation down a few lines to avoid a memory leak and also
> > add a check for allocation failure.
> > 
> > Fixes: 2f31c5252910 ('HID: Introduce hidpp, a module to handle Logitech hid++ devices')
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > 
> 
> Ouch, I am ashamed of not having spot that :/
> 
> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>

Good catch. Applied, thanks.
diff mbox

Patch

diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 361e97d..3cce995 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -200,13 +200,15 @@  static int hidpp_send_fap_command_sync(struct hidpp_device *hidpp,
 	u8 feat_index, u8 funcindex_clientid, u8 *params, int param_count,
 	struct hidpp_report *response)
 {
-	struct hidpp_report *message = kzalloc(sizeof(struct hidpp_report),
-			GFP_KERNEL);
+	struct hidpp_report *message;
 	int ret;
 
 	if (param_count > sizeof(message->fap.params))
 		return -EINVAL;
 
+	message = kzalloc(sizeof(struct hidpp_report), GFP_KERNEL);
+	if (!message)
+		return -ENOMEM;
 	message->report_id = REPORT_ID_HIDPP_LONG;
 	message->fap.feature_index = feat_index;
 	message->fap.funcindex_clientid = funcindex_clientid;
@@ -221,8 +223,7 @@  static int hidpp_send_rap_command_sync(struct hidpp_device *hidpp_dev,
 	u8 report_id, u8 sub_id, u8 reg_address, u8 *params, int param_count,
 	struct hidpp_report *response)
 {
-	struct hidpp_report *message = kzalloc(sizeof(struct hidpp_report),
-			GFP_KERNEL);
+	struct hidpp_report *message;
 	int ret;
 
 	if ((report_id != REPORT_ID_HIDPP_SHORT) &&
@@ -232,6 +233,9 @@  static int hidpp_send_rap_command_sync(struct hidpp_device *hidpp_dev,
 	if (param_count > sizeof(message->rap.params))
 		return -EINVAL;
 
+	message = kzalloc(sizeof(struct hidpp_report), GFP_KERNEL);
+	if (!message)
+		return -ENOMEM;
 	message->report_id = report_id;
 	message->rap.sub_id = sub_id;
 	message->rap.reg_address = reg_address;