android_kernel_samsung_msm8976/drivers/hid
Rodrigo Rivas Costa 4140d970b0 HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device
commit a955358d54695e4ad9f7d6489a7ac4d69a8fc711 upstream.

Doing `ioctl(HIDIOCGFEATURE)` in a tight loop on a hidraw device
and then disconnecting the device, or unloading the driver, can
cause a NULL pointer dereference.

When a hidraw device is destroyed it sets 0 to `dev->exist`.
Most functions check 'dev->exist' before doing its work, but
`hidraw_get_report()` was missing that check.

Signed-off-by: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2019-07-27 21:52:17 +02:00
..
i2c-hid HID: i2c-hid: allocate hid buffers for real worst case 2019-07-27 21:45:51 +02:00
usbhid HID: usbhid: fix out-of-bounds bug 2018-08-20 12:00:10 +02:00
hid-a4tech.c
hid-apple.c
hid-appleir.c
hid-aureal.c
hid-axff.c
hid-belkin.c
hid-cherry.c
hid-chicony.c
hid-core.c This is the 3.10.96 stable release 2017-04-18 17:16:02 +02:00
hid-cypress.c HID: hid-cypress: validate length of report 2019-07-27 21:43:43 +02:00
hid-debug.c HID: debug: check length before copy_to_user() 2019-07-27 21:51:21 +02:00
hid-dr.c
hid-elecom.c
hid-emsff.c
hid-ezkey.c
hid-gaff.c
hid-generic.c
hid-gyration.c
hid-holtek-kbd.c
hid-holtekff.c
hid-hyperv.c
hid-icade.c
hid-ids.h
hid-input.c HID: hid-input: Add parentheses to quell gcc warning 2019-07-27 21:42:01 +02:00
hid-kensington.c
hid-keytouch.c
hid-kye.c
hid-lcpower.c
hid-lenovo-tpkbd.c
hid-lg.c HID: hid-lg: Fix immediate disconnection of Logitech Rumblepad 2 2019-07-27 21:44:06 +02:00
hid-lg.h
hid-lg2ff.c
hid-lg3ff.c
hid-lg4ff.c
hid-lgff.c
hid-logitech-dj.c
hid-logitech-dj.h
hid-magicmouse.c
hid-microsoft.c
hid-monterey.c
hid-multitouch.c
hid-ntrig.c hid: hid-ntrig: Fix input_configured function 2017-04-18 12:19:41 +02:00
hid-ortek.c
hid-petalynx.c
hid-picolcd.h
hid-picolcd_backlight.c
hid-picolcd_cir.c
hid-picolcd_core.c
hid-picolcd_debugfs.c
hid-picolcd_fb.c
hid-picolcd_lcd.c
hid-picolcd_leds.c
hid-pl.c
hid-primax.c
hid-prodikeys.c
hid-ps3remote.c
hid-roccat-arvo.c
hid-roccat-arvo.h
hid-roccat-common.c
hid-roccat-common.h
hid-roccat-isku.c
hid-roccat-isku.h
hid-roccat-kone.c
hid-roccat-kone.h
hid-roccat-koneplus.c
hid-roccat-koneplus.h
hid-roccat-konepure.c
hid-roccat-konepure.h
hid-roccat-kovaplus.c
hid-roccat-kovaplus.h
hid-roccat-lua.c
hid-roccat-lua.h
hid-roccat-pyra.c
hid-roccat-pyra.h
hid-roccat-savu.c
hid-roccat-savu.h
hid-roccat.c
hid-saitek.c
hid-samsung.c
hid-sensor-hub.c
hid-sjoy.c
hid-sony.c
hid-speedlink.c
hid-steelseries.c
hid-sunplus.c
hid-synaptics-bt.c
hid-thingm.c
hid-tivo.c
hid-tmff.c
hid-topseed.c
hid-twinhan.c
hid-uclogic.c
hid-wacom.c
hid-waltop.c
hid-wiimote-core.c
hid-wiimote-debug.c
hid-wiimote-ext.c
hid-wiimote.h
hid-zpff.c
hid-zydacron.c
hidraw.c HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device 2019-07-27 21:52:17 +02:00
Kconfig
Makefile
uhid.c