Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

HID: holtek: test for sanity of intfdata

The ioctl handler uses the intfdata of a second interface,
which may not be present in a broken or malicious device, hence
the intfdata needs to be checked for NULL.

[jkosina@suse.cz: fix newly added spurious space]
Reported-by: syzbot+965152643a75a56737be@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

authored by

Oliver Neukum and committed by
Jiri Kosina
01ec0a5f 693c3dab

+7 -2
+7 -2
drivers/hid/hid-holtek-kbd.c
··· 123 123 124 124 /* Locate the boot interface, to receive the LED change events */ 125 125 struct usb_interface *boot_interface = usb_ifnum_to_if(usb_dev, 0); 126 + struct hid_device *boot_hid; 127 + struct hid_input *boot_hid_input; 126 128 127 - struct hid_device *boot_hid = usb_get_intfdata(boot_interface); 128 - struct hid_input *boot_hid_input = list_first_entry(&boot_hid->inputs, 129 + if (unlikely(boot_interface == NULL)) 130 + return -ENODEV; 131 + 132 + boot_hid = usb_get_intfdata(boot_interface); 133 + boot_hid_input = list_first_entry(&boot_hid->inputs, 129 134 struct hid_input, list); 130 135 131 136 return boot_hid_input->input->event(boot_hid_input->input, type, code,