Commit:     de1a7b03282310d143cb0add74e909daffedda01
Parent:     04a9b7ffceff4337d9e63476b5c71e9b79249969
Author:     Jesper Juhl <[EMAIL PROTECTED]>
AuthorDate: Mon Jul 30 15:15:26 2007 +0200
Committer:  Jiri Kosina <[EMAIL PROTECTED]>
CommitDate: Thu Aug 2 13:48:03 2007 +0200

    USB HID: fix a possible NULL pointer dereference when we fail to allocate 
    If, in usb_hid_configure(), we fail to allocate storage for 'usbhid',
     "if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))",
    then we'll jump to the 'fail:' label where we have this code:
    Since we got here because we couldn't allocate storage for 'usbhid',
    what we have here is a NULL pointer dereference - ouch...
    This patch solves that little problem by adding a new
    'fail_no_usbhid:' label after the problematic calls to
    usb_free_urb() and jumps to that one instead, in the problem case.
    Signed-off-by: Jesper Juhl <[EMAIL PROTECTED]>
    Signed-off-by: Jiri Kosina <[EMAIL PROTECTED]>
 drivers/hid/usbhid/hid-core.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index b2baeae..3ff7468 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -743,7 +743,7 @@ static struct hid_device *usb_hid_configure(struct 
usb_interface *intf)
        hid->quirks = quirks;
        if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))
-               goto fail;
+               goto fail_no_usbhid;
        hid->driver_data = usbhid;
        usbhid->hid = hid;
@@ -877,6 +877,7 @@ fail:
        hid_free_buffers(dev, hid);
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to