• Jesper Juhl's avatar
    USB HID: fix a possible NULL pointer dereference when we fail to allocate memory · de1a7b03
    Jesper Juhl authored
    If, in usb_hid_configure(), we fail to allocate storage for 'usbhid',
     "if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))",
    then we'll jump to the 'fail:' label where we have this code:
            usb_free_urb(usbhid->urbin);
            usb_free_urb(usbhid->urbout);
            usb_free_urb(usbhid->urbctrl);
    Since we got here because we couldn't allocate storage for 'usbhid',
    what we have here is a NULL pointer dereference - ouch...
    
    This patch solves that little problem by adding a new
    'fail_no_usbhid:' label after the problematic calls to
    usb_free_urb() and jumps to that one instead, in the problem case.
    Signed-off-by: default avatarJesper Juhl <jesper.juhl@gmail.com>
    Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
    de1a7b03
hid-core.c 29.3 KB