From patchwork Tue Mar 8 05:24:29 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rafi Rubin X-Patchwork-Id: 617301 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p285Kg1O008326 for ; Tue, 8 Mar 2011 05:24:58 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752971Ab1CHFY5 (ORCPT ); Tue, 8 Mar 2011 00:24:57 -0500 Received: from fox.seas.upenn.edu ([158.130.68.12]:48783 "EHLO fox.seas.upenn.edu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750932Ab1CHFY5 (ORCPT ); Tue, 8 Mar 2011 00:24:57 -0500 Received: from hex.seas.upenn.edu (hex.seas.upenn.edu [158.130.62.166]) (authenticated bits=0) by fox.seas.upenn.edu (8.14.3/8.14.3) with ESMTP id p285OevG017662 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 8 Mar 2011 00:24:43 -0500 From: Rafi Rubin To: jkosina@suse.cz, linux-input@vger.kernel.org Cc: rydberg@euromail.se, chatty@enac.fr, peter.hutterer@who-t.net, Rafi Rubin Subject: [PATCH] HID: ntrig don't dereference unclaimed hidinput Date: Tue, 8 Mar 2011 00:24:29 -0500 Message-Id: <1299561869-15165-1-git-send-email-rafi@seas.upenn.edu> X-Mailer: git-send-email 1.7.2.3 In-Reply-To: <1299550408-11457-1-git-send-email-rafi@seas.upenn.edu> References: <1299550408-11457-1-git-send-email-rafi@seas.upenn.edu> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.2.15, 1.0.148, 0.0.0000 definitions=2011-03-08_02:2011-03-08, 2011-03-08, 1970-01-01 signatures=0 X-Proofpoint-Spam-Reason: safe Sender: linux-input-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-input@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Tue, 08 Mar 2011 05:25:19 +0000 (UTC) diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c index beb4034..a93e58c 100644 --- a/drivers/hid/hid-ntrig.c +++ b/drivers/hid/hid-ntrig.c @@ -539,8 +539,19 @@ static int ntrig_input_mapped(struct hid_device *hdev, struct hid_input *hi, static int ntrig_event (struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value) { - struct input_dev *input = field->hidinput->input; struct ntrig_data *nd = hid_get_drvdata(hid); + struct input_dev *input; + + /* Skip processing if not a claimed input */ + if (!(hid->claimed & HID_CLAIMED_INPUT)) + goto not_claimed_input; + + /* This function is being called before the structures are fully + * initialized */ + if(!(field->hidinput && field->hidinput->input)) + return -EINVAL; + + input = field->hidinput->input; /* No special handling needed for the pen */ if (field->application == HID_DG_PEN) @@ -810,6 +821,8 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field, } } +not_claimed_input: + /* we have handled the hidinput part, now remains hiddev */ if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_hid_event) hid->hiddev_hid_event(hid, field, usage, value);