浏览代码

HID: hidraw, fix a NULL pointer dereference in hidraw_ioctl

BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
IP: [<ffffffffa02c66b4>] hidraw_ioctl+0xfc/0x32c [hid]
[...]

This is reproducible by disconnecting the device while userspace does
ioctl in a loop and doesn't check return values in order to exit the
loop.

Signed-off-by: Antonio Ospite <ospite@studenti.unina.it>
Cc: stable@kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Antonio Ospite 14 年之前
父节点
当前提交
d20d5ffab9
共有 1 个文件被更改,包括 5 次插入0 次删除
  1. 5 0
      drivers/hid/hidraw.c

+ 5 - 0
drivers/hid/hidraw.c

@@ -244,6 +244,10 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
 
 
 	mutex_lock(&minors_lock);
 	mutex_lock(&minors_lock);
 	dev = hidraw_table[minor];
 	dev = hidraw_table[minor];
+	if (!dev) {
+		ret = -ENODEV;
+		goto out;
+	}
 
 
 	switch (cmd) {
 	switch (cmd) {
 		case HIDIOCGRDESCSIZE:
 		case HIDIOCGRDESCSIZE:
@@ -317,6 +321,7 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
 
 
 		ret = -ENOTTY;
 		ret = -ENOTTY;
 	}
 	}
+out:
 	mutex_unlock(&minors_lock);
 	mutex_unlock(&minors_lock);
 	return ret;
 	return ret;
 }
 }