Commit 3e7830ce authored by Dan Carpenter's avatar Dan Carpenter Committed by Jiri Kosina

HID: logitech-hidpp: leaks and NULL dereferences

Shift the allocation down a few lines to avoid a memory leak and also
add a check for allocation failure.

Fixes: 2f31c525 ('HID: Introduce hidpp, a module to handle Logitech hid++ devices')
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 3a61e975
...@@ -200,13 +200,15 @@ static int hidpp_send_fap_command_sync(struct hidpp_device *hidpp, ...@@ -200,13 +200,15 @@ static int hidpp_send_fap_command_sync(struct hidpp_device *hidpp,
u8 feat_index, u8 funcindex_clientid, u8 *params, int param_count, u8 feat_index, u8 funcindex_clientid, u8 *params, int param_count,
struct hidpp_report *response) struct hidpp_report *response)
{ {
struct hidpp_report *message = kzalloc(sizeof(struct hidpp_report), struct hidpp_report *message;
GFP_KERNEL);
int ret; int ret;
if (param_count > sizeof(message->fap.params)) if (param_count > sizeof(message->fap.params))
return -EINVAL; return -EINVAL;
message = kzalloc(sizeof(struct hidpp_report), GFP_KERNEL);
if (!message)
return -ENOMEM;
message->report_id = REPORT_ID_HIDPP_LONG; message->report_id = REPORT_ID_HIDPP_LONG;
message->fap.feature_index = feat_index; message->fap.feature_index = feat_index;
message->fap.funcindex_clientid = funcindex_clientid; message->fap.funcindex_clientid = funcindex_clientid;
...@@ -221,8 +223,7 @@ static int hidpp_send_rap_command_sync(struct hidpp_device *hidpp_dev, ...@@ -221,8 +223,7 @@ static int hidpp_send_rap_command_sync(struct hidpp_device *hidpp_dev,
u8 report_id, u8 sub_id, u8 reg_address, u8 *params, int param_count, u8 report_id, u8 sub_id, u8 reg_address, u8 *params, int param_count,
struct hidpp_report *response) struct hidpp_report *response)
{ {
struct hidpp_report *message = kzalloc(sizeof(struct hidpp_report), struct hidpp_report *message;
GFP_KERNEL);
int ret; int ret;
if ((report_id != REPORT_ID_HIDPP_SHORT) && if ((report_id != REPORT_ID_HIDPP_SHORT) &&
...@@ -232,6 +233,9 @@ static int hidpp_send_rap_command_sync(struct hidpp_device *hidpp_dev, ...@@ -232,6 +233,9 @@ static int hidpp_send_rap_command_sync(struct hidpp_device *hidpp_dev,
if (param_count > sizeof(message->rap.params)) if (param_count > sizeof(message->rap.params))
return -EINVAL; return -EINVAL;
message = kzalloc(sizeof(struct hidpp_report), GFP_KERNEL);
if (!message)
return -ENOMEM;
message->report_id = report_id; message->report_id = report_id;
message->rap.sub_id = sub_id; message->rap.sub_id = sub_id;
message->rap.reg_address = reg_address; message->rap.reg_address = reg_address;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment