| Message ID | 20221105211151.7094-12-michael.zaidman@gmail.com (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | c2500bdffe5a95fbd0aecdd5be3d2f175ad22f92 |
| Delegated to: | Jiri Kosina |
| Headers | show |
| Series | HID: ft260: fixes and performance improvements | expand |
diff --git a/drivers/hid/hid-ft260.c b/drivers/hid/hid-ft260.c index ac133980dfe9..b4f180c8750a 100644 --- a/drivers/hid/hid-ft260.c +++ b/drivers/hid/hid-ft260.c @@ -409,6 +409,9 @@ static int ft260_i2c_write(struct ft260_device *dev, u8 addr, u8 *data, struct ft260_i2c_write_request_report *rep = (struct ft260_i2c_write_request_report *)dev->write_buf; + if (len < 1) + return -EINVAL; + rep->flag = FT260_FLAG_START; do {
The zero-length passed into the ft260_i2c_write() triggered the NULL pointer dereference in the debug message on data[0] access. Since the controller does not support a write of zero length, let's not allow it. Before: $ sudo i2ctransfer -y 13 w0@0x51 Killed After: $ sudo i2ctransfer -y 13 w0@0x51 Error: Sending messages failed: Invalid argument Reported-by: Enrik Berkhan <Enrik.Berkhan@inka.de> Signed-off-by: Michael Zaidman <michael.zaidman@gmail.com> --- drivers/hid/hid-ft260.c | 3 +++ 1 file changed, 3 insertions(+)