| From a955358d54695e4ad9f7d6489a7ac4d69a8fc711 Mon Sep 17 00:00:00 2001 |
| From: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com> |
| Date: Fri, 6 Apr 2018 01:09:36 +0200 |
| Subject: HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device |
| |
| From: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com> |
| |
| commit a955358d54695e4ad9f7d6489a7ac4d69a8fc711 upstream. |
| |
| Doing `ioctl(HIDIOCGFEATURE)` in a tight loop on a hidraw device |
| and then disconnecting the device, or unloading the driver, can |
| cause a NULL pointer dereference. |
| |
| When a hidraw device is destroyed it sets 0 to `dev->exist`. |
| Most functions check 'dev->exist' before doing its work, but |
| `hidraw_get_report()` was missing that check. |
| |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com> |
| Signed-off-by: Jiri Kosina <jkosina@suse.cz> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/hid/hidraw.c | 5 +++++ |
| 1 file changed, 5 insertions(+) |
| |
| --- a/drivers/hid/hidraw.c |
| +++ b/drivers/hid/hidraw.c |
| @@ -197,6 +197,11 @@ static ssize_t hidraw_get_report(struct |
| int ret = 0, len; |
| unsigned char report_number; |
| |
| + if (!hidraw_table[minor] || !hidraw_table[minor]->exist) { |
| + ret = -ENODEV; |
| + goto out; |
| + } |
| + |
| dev = hidraw_table[minor]->hid; |
| |
| if (!dev->ll_driver->raw_request) { |
