HID: roccat: fix NULL pointer dereference, add range checks

On rare occassions raw events can be triggered before drvdata gets set up
which leads to NULL pointer dereferences. This was only observed with pyra on
2.6.39, but is fixed for all devices now to play it save.
kovaplus returned wrong actual values when profile change was initiated from host.
Added range checks for setting actual profile on all devices.

Signed-off-by: Stefan Achatz <erazor_de@users.sourceforge.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

diff --git a/drivers/hid/hid-roccat-arvo.c b/drivers/hid/hid-roccat-arvo.c
index 610536606195cddf445f39ab5732cbe26bace922..093bfad00b023d8a22a6bf17c382f4eef311b7ce 100644 (file)
--- a/drivers/hid/hid-roccat-arvo.c
+++ b/drivers/hid/hid-roccat-arvo.c
@@ -163,6 +163,9 @@ static ssize_t arvo_sysfs_set_actual_profile(struct device *dev,
        if (retval)
                return retval;
 
+       if (profile < 1 || profile > 5)
+               return -EINVAL;
+
        temp_buf.command = ARVO_COMMAND_ACTUAL_PROFILE;
        temp_buf.actual_profile = profile;
 
@@ -399,7 +402,7 @@ static int arvo_raw_event(struct hid_device *hdev,
        if (size != 3)
                return 0;
 
-       if (arvo->roccat_claimed)
+       if (arvo && arvo->roccat_claimed)
                arvo_report_to_chrdev(arvo, data);
 
        return 0;

diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c
index 7e29778fe7ab65ee307ad158f7b7706ba0194b43..2b8f3a31ffb314aa814e560d6fa7c221c9c3035a 100644 (file)
--- a/drivers/hid/hid-roccat-kone.c
+++ b/drivers/hid/hid-roccat-kone.c
@@ -832,6 +832,9 @@ static int kone_raw_event(struct hid_device *hdev, struct hid_report *report,
        if (size != sizeof(struct kone_mouse_event))
                return 0;
 
+       if (kone == NULL)
+               return 0;
+
        /*
         * Firmware 1.38 introduced new behaviour for tilt and special buttons.
         * Pressed button is reported in each movement event.

diff --git a/drivers/hid/hid-roccat-koneplus.c b/drivers/hid/hid-roccat-koneplus.c
index 33ecad50395b845e96219bcb34bbaaed1c733676..59e47770fa1036aeaf72c145eadb9d8804bb33d8 100644 (file)
--- a/drivers/hid/hid-roccat-koneplus.c
+++ b/drivers/hid/hid-roccat-koneplus.c
@@ -431,6 +431,9 @@ static ssize_t koneplus_sysfs_set_actual_profile(struct device *dev,
        if (retval)
                return retval;
 
+       if (profile > 4)
+               return -EINVAL;
+
        mutex_lock(&koneplus->koneplus_lock);
 
        retval = koneplus_set_actual_profile(usb_dev, profile);
@@ -439,7 +442,7 @@ static ssize_t koneplus_sysfs_set_actual_profile(struct device *dev,
                return retval;
        }
 
-       koneplus->actual_profile = profile;
+       koneplus_profile_activated(koneplus, profile);
 
        roccat_report.type = KONEPLUS_MOUSE_REPORT_BUTTON_TYPE_PROFILE;
        roccat_report.data1 = profile + 1;
@@ -751,6 +754,9 @@ static int koneplus_raw_event(struct hid_device *hdev,
                        != USB_INTERFACE_PROTOCOL_MOUSE)
                return 0;
 
+       if (koneplus == NULL)
+               return 0;
+
        koneplus_keep_values_up_to_date(koneplus, data);
 
        if (koneplus->roccat_claimed)

diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
index 212e7921e942334abb979f807f2ec542ef9f6866..1f8336e3f584ab270d1519063dffc79c99f9e6c3 100644 (file)
--- a/drivers/hid/hid-roccat-kovaplus.c
+++ b/drivers/hid/hid-roccat-kovaplus.c
@@ -337,7 +337,7 @@ static ssize_t kovaplus_sysfs_set_actual_profile(struct device *dev,
 
        mutex_lock(&kovaplus->kovaplus_lock);
        retval = kovaplus_set_actual_profile(usb_dev, profile);
-       kovaplus->actual_profile = profile;
+       kovaplus_profile_activated(kovaplus, profile);
        mutex_unlock(&kovaplus->kovaplus_lock);
        if (retval)
                return retval;
@@ -662,6 +662,9 @@ static int kovaplus_raw_event(struct hid_device *hdev,
                        != USB_INTERFACE_PROTOCOL_MOUSE)
                return 0;
 
+       if (kovaplus == NULL)
+               return 0;
+
        kovaplus_keep_values_up_to_date(kovaplus, data);
 
        if (kovaplus->roccat_claimed)

diff --git a/drivers/hid/hid-roccat-pyra.c b/drivers/hid/hid-roccat-pyra.c
index 75a092e0d1d87ac1cd74987895bd32e37307f9f6..8140776bd8c51906f7f1296ef1d1ea5ff6d49299 100644 (file)
--- a/drivers/hid/hid-roccat-pyra.c
+++ b/drivers/hid/hid-roccat-pyra.c
@@ -637,6 +637,9 @@ static int pyra_raw_event(struct hid_device *hdev, struct hid_report *report,
                        != USB_INTERFACE_PROTOCOL_MOUSE)
                return 0;
 
+       if (pyra == NULL)
+               return 0;
+
        pyra_keep_values_up_to_date(pyra, data);
 
        if (pyra->roccat_claimed)