linux-kernel - Re: [PATCH AUTOSEL 5.10 3/5] HID: pidff: Fix null pointer dereference in pidff_find

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aAKEZwyixI01sJmk@duo.ucw.cz>
Date: Fri, 18 Apr 2025 18:57:11 +0200
From: Pavel Machek <pavel@...x.de>
To: Sasha Levin <sashal@...nel.org>
Cc: linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	Tomasz Pakuła <forest10pl@...il.com>,
	Nolan Nicholson <nolananicholson@...il.com>,
	Tomasz Pakuła <tomasz.pakula.oficjalny@...il.com>,
	Michał Kopeć <michal@...omi.space>,
	Paul Dino Jones <paul@...cefreak18.xyz>,
	Cristóferson Bueno <cbueno81@...il.com>,
	Pablo Cisneros <patchkez@...tonmail.com>,
	Jiri Kosina <jkosina@...e.com>, jikos@...nel.org,
	bentiss@...nel.org, linux-usb@...r.kernel.org,
	linux-input@...r.kernel.org
Subject: Re: [PATCH AUTOSEL 5.10 3/5] HID: pidff: Fix null pointer
 dereference in pidff_find_fields

Hi!

> From: Tomasz Pakuła <forest10pl@...il.com>
> 
> [ Upstream commit 22a05462c3d0eee15154faf8d13c49e6295270a5 ]
> 
> This function triggered a null pointer dereference if used to search for
> a report that isn't implemented on the device. This happened both for
> optional and required reports alike.

Ok.

> +++ b/drivers/hid/usbhid/hid-pidff.c
> @@ -770,6 +770,11 @@ static void pidff_set_autocenter(struct input_dev *dev, u16 magnitude)
>  static int pidff_find_fields(struct pidff_usage *usage, const u8 *table,
>  			     struct hid_report *report, int count, int strict)
>  {
> +	if (!report) {
> +		pr_debug("pidff_find_fields, null report\n");
> +		return -1;
> +	}
> +
>  	int i, j, k, found;
>  
>  	for (k = 0; k < count; k++) {
> @@ -883,6 +888,11 @@ static int pidff_reports_ok(struct pidff_device *pidff)
>  static struct hid_field *pidff_find_special_field(struct hid_report *report,
>  						  int usage, int enforce_min)
>  {
> +	if (!report) {
> +		pr_debug("pidff_find_special_field, null report\n");
> +		return NULL;
> +	}
> +
>  	int i;


But this is quite strange. Normally declarations go first. Not sure if
old compilers can handle this?

Best regards,
								Pavel
-- 
DENX Software Engineering GmbH,        Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)