github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-30 01:53:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

HID: pidff: Fix possible null pointer dereference

Browse Source 
As reported by Dan Carpenter, if the axes_enable field wasn't found,
trying to find the axes themselves will result in a null pointer
dereference. This could only occur with a broken PID descriptor, but
it's worth protecting from.

Exit early if the axes_enable wasn't found AND add a gate to the
pidff_find_special_keys to exit early if the passed HID field is null.
This will protect again null dereferencing in the future and properly
return 0 found special keys.

Fixes: 1d72e7bd34 ("HID: pidff: Add support for AXES_ENABLE field")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
This commit is contained in:
Tomasz Pakuła 2025-08-23 21:45:16 +02:00 committed by Jiri Kosina
parent 13120abdb0
commit d927909d4d
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/hid/usbhid/hid-pidff.c
View File

@ -1194,6 +1194,9 @@ static int pidff_find_special_keys(int *keys, struct hid_field *fld,
{
int found = 0;
if (!fld)
return 0;
for (int i = 0; i < count; i++) {
keys[i] = pidff_find_usage(fld, usage_page | usagetable[i]) + 1;
if (keys[i])
@ -1299,11 +1302,13 @@ static int pidff_find_special_fields(struct pidff_device *pidff)
return -1;
}
if (!pidff->axes_enable)
if (!pidff->axes_enable) {
hid_info(pidff->hid, "axes enable field not found!\n");
else
hid_dbg(pidff->hid, "axes enable report count: %u\n",
pidff->axes_enable->report_count);
return 0;
}
hid_dbg(pidff->hid, "axes enable report count: %u\n",
pidff->axes_enable->report_count);
uint found = PIDFF_FIND_GENERAL_DESKTOP(direction_axis_id, axes_enable,
direction_axis);
@ -1311,7 +1316,7 @@ static int pidff_find_special_fields(struct pidff_device *pidff)
pidff->axis_count = found;
hid_dbg(pidff->hid, "found direction axes: %u", found);
for (int i = 0; i < sizeof(pidff_direction_axis); i++) {
for (int i = 0; i < ARRAY_SIZE(pidff_direction_axis); i++) {
if (!pidff->direction_axis_id[i])
continue;