Re: [PATCH] HID: hidraw, fix a NULL pointer dereference in hidraw_ioctl

[Antonio Ospite <ospite@studenti.unina.it>]

[-- Attachment #1: Type: text/plain, Size: 1894 bytes --]

On Mon, 04 Oct 2010 09:54:21 -0400
Alan Ott <alan@signal11.us> wrote:

> On 10/02/2010 07:25 AM, Antonio Ospite wrote:
> > BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
> > IP: [<ffffffffa02c66b4>] hidraw_ioctl+0xfc/0x32c [hid]
> > [...]
> >
[...]
> > there is a similar problem when _writing_ to the device, but Alan's
> > changes in that area are shuffling the code a bit, should I send a patch
> > [to hidraw_send_report()] on top of Alan's work for that, or a fix for
> > current mainline [in hidraw_write()] on which Alan should rebase his
> > work would be better?
> >    
> 
> This needs to go back into stable kernels as well, so a patch against 
> mainline will be necessary for that. If you want to make a patch against 
> mine, that's fine with me. If you want me to work it into my patch, 
> that's fine too. (I want you to get credit for the fix though :) ).
>

Alan rebasing your patch on top of the hidraw_write() fix is trivial
so you do it in your v5, ok? It does not get rebased automatically just
because of the mutex_lock() call.

If it is OK to you I'd promote my Tested-by to a Signed-off-by in
the commit message so to take implicit credit for the fix. But this is
not even needed as the fix will be in mainline anyway.

> > The same pattern of unchecked hidraw_table[minor] is also present in
> > hidraw_get_report but this function is called only after the NULL check
> > in hidraw_ioctl _for_now_, so that is currently safe.
> >    
> 
> I can stick a comment ahead of hidraw_send_report, similar to the one 
> which already exists.
>

ACK.

Thanks,
   Antonio

-- 
Antonio Ospite
http://ao2.it

PGP public key ID: 0x4553B001

A: Because it messes up the order in which people normally read text.
   See http://en.wikipedia.org/wiki/Posting_style
Q: Why is top-posting such a bad thing?

[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]