From patchwork Tue Oct 5 15:20:17 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Antonio Ospite X-Patchwork-Id: 233101 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id o95FMBAm027388 for ; Tue, 5 Oct 2010 15:22:12 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754291Ab0JEPVP (ORCPT ); Tue, 5 Oct 2010 11:21:15 -0400 Received: from smtp207.alice.it ([82.57.200.103]:47372 "EHLO smtp207.alice.it" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754157Ab0JEPVN (ORCPT ); Tue, 5 Oct 2010 11:21:13 -0400 Received: from jcn (87.1.143.99) by smtp207.alice.it (8.5.124.08) id 4C9E16C900B7401C; Tue, 5 Oct 2010 17:21:07 +0200 Received: from ao2 by jcn with local (Exim 4.72) (envelope-from ) id 1P39KB-0001lY-Q1; Tue, 05 Oct 2010 17:21:03 +0200 From: Antonio Ospite To: linux-input@vger.kernel.org Cc: Antonio Ospite , Jiri Kosina , Alan Ott , Oliver Neukum , linux-kernel@vger.kernel.org, stable@kernel.org Subject: [PATCH 2/2] HID: hidraw, fix a NULL pointer dereference in hidraw_write Date: Tue, 5 Oct 2010 17:20:17 +0200 Message-Id: <1286292017-6746-3-git-send-email-ospite@studenti.unina.it> X-Mailer: git-send-email 1.7.1 In-Reply-To: References: X-Face: z*RaLf`X<@C75u6Ig9}{oW$H; 1_\2t5)({*|jhM/Vb; ]yA5\I~93>J<_`<4)A{':UrE Sender: linux-input-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-input@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter1.kernel.org [140.211.167.41]); Tue, 05 Oct 2010 15:22:12 +0000 (UTC) diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c index 9eaf6ae..a3866b5 100644 --- a/drivers/hid/hidraw.c +++ b/drivers/hid/hidraw.c @@ -109,6 +109,12 @@ static ssize_t hidraw_write(struct file *file, const char __user *buffer, size_t int ret = 0; mutex_lock(&minors_lock); + + if (!hidraw_table[minor]) { + ret = -ENODEV; + goto out; + } + dev = hidraw_table[minor]->hid; if (!dev->hid_output_raw_report) {