1
linux/drivers/hid/usbhid
Jiri Kosina 9c9e54a8df HID: hiddev: fix memory corruption due to invalid intfdata
Commit bd25f4dd69 ("HID: hiddev: use usb_find_interface,
get rid of BKL") introduced using of private intfdata in hiddev for
purpose of storing hiddev pointer.

This is a problem, because intf pointer is already being set to struct
hid_device pointer by HID core. This obviously lead to memory corruptions
at device disconnect time, such as

WARNING: at lib/kobject.c:595 kobject_put+0x37/0x4b()
kobject: '(null)' (ffff88011e9cd898): is not initialized, yet kobject_put() is being called.

Convert hiddev into accessing hiddev through struct hid_device which is
in intfdata already.

Reported-and-tested-by: Markus Trippelsdorf <markus@trippelsdorf.de>
Reported-and-tested-by: Heinz Diehl <htd@fritha.org>
Reported-and-tested-by: Alan Ott <alan@signal11.us>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2010-08-13 12:19:45 +02:00
..
hid-core.c HID: Send Report ID when numbered reports are sent over the control endpoint. 2010-07-11 23:13:15 +02:00
hid-pidff.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
hid-quirks.c HID: Force input registration for "VEC footpedal" 2010-07-19 11:54:16 +02:00
hiddev.c HID: hiddev: fix memory corruption due to invalid intfdata 2010-08-13 12:19:45 +02:00
Kconfig
Makefile
usbhid.h USB: remove uses of URB_NO_SETUP_DMA_MAP 2010-05-20 13:21:31 -07:00
usbkbd.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2010-05-21 10:51:03 -07:00
usbmouse.c USB: rename usb_buffer_alloc() and usb_buffer_free() users 2010-05-20 13:21:38 -07:00