From 901e64dbdb5998b9248c372a401c921bbdf662f6 Mon Sep 17 00:00:00 2001 From: Stefan Achatz Date: Sun, 12 Jun 2011 10:02:44 +0200 Subject: HID: roccat: fix NULL pointer dereference, add range checks On rare occassions raw events can be triggered before drvdata gets set up which leads to NULL pointer dereferences. This was only observed with pyra on 2.6.39, but is fixed for all devices now to play it save. kovaplus returned wrong actual values when profile change was initiated from host. Added range checks for setting actual profile on all devices. Signed-off-by: Stefan Achatz Signed-off-by: Jiri Kosina --- drivers/hid/hid-roccat-koneplus.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'drivers/hid/hid-roccat-koneplus.c') diff --git a/drivers/hid/hid-roccat-koneplus.c b/drivers/hid/hid-roccat-koneplus.c index 33ecad50395..59e47770fa1 100644 --- a/drivers/hid/hid-roccat-koneplus.c +++ b/drivers/hid/hid-roccat-koneplus.c @@ -431,6 +431,9 @@ static ssize_t koneplus_sysfs_set_actual_profile(struct device *dev, if (retval) return retval; + if (profile > 4) + return -EINVAL; + mutex_lock(&koneplus->koneplus_lock); retval = koneplus_set_actual_profile(usb_dev, profile); @@ -439,7 +442,7 @@ static ssize_t koneplus_sysfs_set_actual_profile(struct device *dev, return retval; } - koneplus->actual_profile = profile; + koneplus_profile_activated(koneplus, profile); roccat_report.type = KONEPLUS_MOUSE_REPORT_BUTTON_TYPE_PROFILE; roccat_report.data1 = profile + 1; @@ -751,6 +754,9 @@ static int koneplus_raw_event(struct hid_device *hdev, != USB_INTERFACE_PROTOCOL_MOUSE) return 0; + if (koneplus == NULL) + return 0; + koneplus_keep_values_up_to_date(koneplus, data); if (koneplus->roccat_claimed) -- cgit v1.2.3-70-g09d2