summarylogtreecommitdiffstats
path: root/0005-ipts-fix-NULL-pointer-dereference.patch
diff options
context:
space:
mode:
Diffstat (limited to '0005-ipts-fix-NULL-pointer-dereference.patch')
-rw-r--r--0005-ipts-fix-NULL-pointer-dereference.patch31
1 files changed, 31 insertions, 0 deletions
diff --git a/0005-ipts-fix-NULL-pointer-dereference.patch b/0005-ipts-fix-NULL-pointer-dereference.patch
new file mode 100644
index 00000000000..6148effc3a0
--- /dev/null
+++ b/0005-ipts-fix-NULL-pointer-dereference.patch
@@ -0,0 +1,31 @@
+From bab1e5b308acfa7572906e70ae959d8db5080b3e Mon Sep 17 00:00:00 2001
+From: Anton Vorontsov <anton@enomsg.org>
+Date: Thu, 29 Dec 2016 15:15:38 -0800
+Subject: [PATCH] misc: ipts: Fix NULL pointer dereference in
+ ipts_hid_release()
+
+If we failed to add a hid device (e.g. firmware failed to load),
+ipts_hid_release() will still be called (by mei_cl_device_remove()) on
+shutdown, which in turn will cause ipts->hid to be dereferenced.
+
+Signed-off-by: Anton Vorontsov <anton@enomsg.org>
+---
+ drivers/misc/ipts/ipts-hid.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/misc/ipts/ipts-hid.c b/drivers/misc/ipts/ipts-hid.c
+index cc3ad0d..afa740f 100644
+--- a/drivers/misc/ipts/ipts-hid.c
++++ b/drivers/misc/ipts/ipts-hid.c
+@@ -286,8 +286,9 @@ int ipts_hid_init(ipts_info_t *ipts)
+
+ void ipts_hid_release(ipts_info_t *ipts)
+ {
+- struct hid_device *hid = ipts->hid;
+- hid_destroy_device(hid);
++ if (!ipts->hid)
++ return;
++ hid_destroy_device(ipts->hid);
+ }
+
+ int ipts_handle_hid_data(ipts_info_t *ipts,