Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-21 10:31:54 +00:00
Code Issues Packages Projects Releases Wiki Activity
668160e5a8
linux/drivers/hid
History
Alan Stern 668160e5a8 HID: usbhid: fix use-after-free bug 
This patch (as1592) fixes an obscure problem in the usbhid driver.
Under some circumstances, a control or interrupt-OUT URB can be
submitted twice.  This will happen if the first submission fails; the
queue pointers aren't updated, so the next time the queue is restarted
the same URB will be submitted again.

The problem is that raw_report gets deallocated during the first
submission.  The second submission will then dereference and try to
free an already-freed region of memory.  The patch fixes the problem
by setting raw_report to NULL when it is deallocated and checking for
NULL before dereferencing it.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2012-07-20 11:24:23 +02:00
..
usbhid HID: usbhid: fix use-after-free bug 2012-07-20 11:24:23 +02:00
hid-a4tech.c HID: Add and use hid_<level>: dev_<level> equivalents 2010-12-10 15:10:38 +01:00
hid-apple.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2012-07-13 10:33:18 -07:00
hid-aureal.c HID: Aureal Remote Control Device Driver 2012-04-13 18:15:57 +02:00
hid-axff.c hid: Add module.h to fix up implicit users of it 2011-10-31 19:31:17 -04:00
hid-belkin.c HID: Add and use hid_<level>: dev_<level> equivalents 2010-12-10 15:10:38 +01:00
hid-cherry.c HID: Add and use hid_<level>: dev_<level> equivalents 2010-12-10 15:10:38 +01:00
hid-chicony.c HID: add more hotkeys in Asus AIO keyboards 2012-02-02 10:32:45 +01:00
hid-core.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2012-07-13 10:33:18 -07:00
hid-cypress.c HID: Add and use hid_<level>: dev_<level> equivalents 2010-12-10 15:10:38 +01:00
hid-debug.c Merge branches 'hyperv', 'multitouch', 'roccat', 'upstream', 'upstream-fixes', 'wacom' and 'wiimote' into for-linus 2012-01-05 15:51:02 +01:00
hid-dr.c hid: Add module.h to fix up implicit users of it 2011-10-31 19:31:17 -04:00
hid-elecom.c HID: Add and use hid_<level>: dev_<level> equivalents 2010-12-10 15:10:38 +01:00
hid-emsff.c Merge branches 'hyperv', 'multitouch', 'roccat', 'upstream', 'upstream-fixes', 'wacom' and 'wiimote' into for-linus 2012-01-05 15:51:02 +01:00
hid-ezkey.c HID: adding __init/__exit macros to module init/exit functions 2009-07-23 01:28:01 +02:00
hid-gaff.c hid: Add module.h to fix up implicit users of it 2011-10-31 19:31:17 -04:00
hid-generic.c HID: Create a common generic driver 2012-05-01 12:54:55 +02:00
hid-gyration.c HID: Add teletext/color keys - gyration remote - EU version (GYAR3101CKDE) 2011-02-15 10:29:57 +01:00
hid-holtekff.c hid: Add module.h to fix up implicit users of it 2011-10-31 19:31:17 -04:00
hid-hyperv.c HID: hyperv: Set the hid drvdata correctly 2012-05-17 10:01:07 +02:00
hid-ids.h Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2012-07-19 08:15:55 -07:00
hid-input.c HID: add battery quirk for Apple Wireless ANSI 2012-07-04 15:46:25 +02:00
hid-kensington.c HID: adding __init/__exit macros to module init/exit functions 2009-07-23 01:28:01 +02:00
hid-keytouch.c HID: add support for Keytouch IEC 60945 2011-02-17 15:12:45 +01:00
hid-kye.c HID: kye: Add support for 3 tablets 2012-02-28 13:37:12 +01:00
hid-lcpower.c HID: hid-lcpower: fix key mapping 2011-02-13 15:04:51 +01:00
hid-lg2ff.c HID: Add and use hid_<level>: dev_<level> equivalents 2010-12-10 15:10:38 +01:00
hid-lg3ff.c HID: Add and use hid_<level>: dev_<level> equivalents 2010-12-10 15:10:38 +01:00
hid-lg4ff.c HID: hid-lg4ff: remove unused label in !LEDS_CLASS case 2012-04-23 21:08:15 +02:00
hid-lg.c HID: hid-lg: Allow for custom device-specific properties to be stored in priv drvdata 2012-04-03 04:09:50 +02:00
hid-lg.h HID: lg4ff: Remove sysfs iface before deallocating memory 2012-04-03 04:11:12 +02:00
hid-lgff.c HID: lg4ff - Move handling of Logitech wheels to lg4ff driver 2011-08-04 16:45:55 +02:00
hid-logitech-dj.c HID: logitech: don't use stack based dj_report structures 2012-06-03 15:11:43 +02:00
hid-logitech-dj.h HID: hid-logitech-dj: fix off by one 2011-09-20 16:09:22 +02:00
hid-magicmouse.c HID: magicmouse: Correct report range of major / minor axes 2012-06-25 15:30:15 +02:00
hid-microsoft.c HID: fix horizontal wheel for ms comfort mouse 4500 2011-07-12 10:31:56 +02:00
hid-monterey.c HID: Add and use hid_<level>: dev_<level> equivalents 2010-12-10 15:10:38 +01:00
hid-multitouch.c HID: hid-multitouch: add support for Zytronic panels 2012-07-19 13:56:16 +02:00
hid-ntrig.c HID: hid-ntrig: init settle and mode check 2011-03-14 13:10:13 +01:00
hid-ortek.c HID: add support for Skycable 0x3f07 wireless presenter 2011-03-21 16:12:23 +01:00
hid-petalynx.c HID: Add and use hid_<level>: dev_<level> equivalents 2010-12-10 15:10:38 +01:00
hid-picolcd.c simple_open: automatically convert to simple_open() 2012-04-05 15:25:50 -07:00
hid-pl.c misc latin1 to utf8 conversions 2012-01-02 13:04:55 +01:00
hid-primax.c HID: support primax keyboards violating USB HID spec 2011-10-17 17:04:41 +02:00
hid-prodikeys.c module_param: make bool parameters really bool (drivers & misc) 2012-01-13 09:32:20 +10:30
hid-roccat-arvo.c HID: roccat: fix NULL pointer dereference, add range checks 2011-06-13 13:06:23 +02:00
hid-roccat-arvo.h HID: roccat: correction and cleanup of HID feature reports 2011-06-13 12:52:57 +02:00
hid-roccat-common.c Merge branches 'hyperv', 'multitouch', 'roccat', 'upstream', 'upstream-fixes', 'wacom' and 'wiimote' into for-linus 2012-01-05 15:51:02 +01:00
hid-roccat-common.h HID: roccat: correction and cleanup of HID feature reports 2011-06-13 12:52:57 +02:00
hid-roccat-isku.c HID: roccat: Add support for Isku keyboard 2011-12-06 10:21:10 +01:00
hid-roccat-isku.h HID: roccat: Add support for Isku keyboard 2011-12-06 10:21:10 +01:00
hid-roccat-kone.c HID: roccat: Use kmemdup rather than duplicating its implementation 2011-11-20 00:42:42 +01:00
hid-roccat-kone.h HID: roccat: correction and cleanup of HID feature reports 2011-06-13 12:52:57 +02:00
hid-roccat-koneplus.c HID: roccat: fix NULL pointer dereference, add range checks 2011-06-13 13:06:23 +02:00
hid-roccat-koneplus.h HID: roccat: correction and cleanup of HID feature reports 2011-06-13 12:52:57 +02:00
hid-roccat-kovaplus.c HID: roccat: Kovaplus now reports external profile changes via roccat device 2011-09-07 13:38:27 +02:00
hid-roccat-kovaplus.h HID: roccat: correction and cleanup of HID feature reports 2011-06-13 12:52:57 +02:00
hid-roccat-pyra.c HID: roccat: Pyra now reports external profile changes via roccat device 2011-09-07 13:38:27 +02:00
hid-roccat-pyra.h HID: roccat: correction and cleanup of HID feature reports 2011-06-13 12:52:57 +02:00
hid-roccat.c Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
hid-saitek.c HID: add new driver for non-compliant Saitek devices 2012-02-22 11:30:17 +01:00
hid-samsung.c HID: Add and use hid_<level>: dev_<level> equivalents 2010-12-10 15:10:38 +01:00
hid-sjoy.c HID: sjoy: Add device ID for Super Joy Box 3 2012-02-21 14:16:36 +01:00
hid-sony.c HID: hid-sony: fix endiannes of Sixaxis accel/gyro values 2011-06-13 13:21:30 +02:00
hid-speedlink.c HID: Add driver to fix Speedlink VAD Cezanne support 2011-06-08 09:45:37 +02:00
hid-sunplus.c HID: Add and use hid_<level>: dev_<level> equivalents 2010-12-10 15:10:38 +01:00
hid-tivo.c HID: tivo: fix support for bluetooth version of tivo Slide 2012-03-30 15:28:59 +02:00
hid-tmff.c hid: Add module.h to fix up implicit users of it 2011-10-31 19:31:17 -04:00
hid-topseed.c HID: Add support for Perixx PERIBOARD-707 (Plus) 2010-11-25 15:59:02 +01:00
hid-twinhan.c misc latin1 to utf8 conversions 2012-01-02 13:04:55 +01:00
hid-uclogic.c HID: uclogic: Add support for UC-Logic TWHL850 2012-05-15 09:50:19 +02:00
hid-wacom.c HID: wacom: Unify speed setting 2012-05-16 21:42:16 +02:00
hid-waltop.c HID: waltop: Extend barrel button fix 2012-05-21 13:21:18 +02:00
hid-wiimote-core.c HID: wiimote: Fix IR data parser 2012-05-09 11:40:51 +02:00
hid-wiimote-debug.c simple_open: automatically convert to simple_open() 2012-04-05 15:25:50 -07:00
hid-wiimote-ext.c HID: wiimote: Parse classic controller data 2011-11-22 23:10:10 +01:00
hid-wiimote.h HID: wiimote: Allow direct DRM debug access 2011-11-22 23:11:10 +01:00
hid-zpff.c hid: Add module.h to fix up implicit users of it 2011-10-31 19:31:17 -04:00
hid-zydacron.c HID: zydacron: kfree() NULL pointer cleanup 2011-08-04 23:51:29 +02:00
hidraw.c HID: hidraw: add proper error handling to raw event reporting 2012-04-27 20:10:09 +02:00
Kconfig HID: hid-multitouch: add support for Zytronic panels 2012-07-19 13:56:16 +02:00
Makefile Merge branch 'upstream' into for-linus 2012-05-22 11:32:31 +02:00