diff mbox series

[5.4,09/88] HID: bigbenff: prevent null pointer dereference

Message ID	20211213092933.551227122@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Benjamin Tissoires <benjamin.tissoires@redhat.com> Subject: [PATCH 5.4 09/88] HID: bigbenff: prevent null pointer dereference Date: Mon, 13 Dec 2021 10:29:39 +0100 Message-Id: <20211213092933.551227122@linuxfoundation.org> In-Reply-To: <20211213092933.250314515@linuxfoundation.org> References: <20211213092933.250314515@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.4,03/88] HID: quirks: Add quirk for the Microsoft Surface 3 type-cover [5.4,05/88] HID: add hid_is_usb() function to make it simpler for USB detection [5.4,09/88] HID: bigbenff: prevent null pointer dereference [5.4,10/88] HID: wacom: fix problems when device is not a valid USB device [5.4,14/88] can: sja1000: fix use after free in ems_pcmcia_add_card() [5.4,16/88] selftests: netfilter: add a vrf+conntrack testcase [5.4,20/88] bonding: make tx_rebalance_counter an atomic [5.4,22/88] seg6: fix the iif in the IPv6 socket control block [5.4,23/88] udp: using datalen to cap max gso segments [5.4,26/88] IB/hfi1: Correct guard on eager buffer deallocation [5.4,28/88] ALSA: ctl: Fix copy of updated id with element read/write [5.4,31/88] ALSA: pcm: oss: Limit the period size to 16MB [5.4,32/88] ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() [5.4,34/88] btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling [5.4,35/88] nfsd: Fix nsfd startup race (again) [5.4,37/88] clk: qcom: regmap-mux: fix parent clock lookup [5.4,38/88] drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence. [5.4,41/88] x86/sme: Explicitly map new EFI memmap table as encrypted [5.4,42/88] libata: add horkage for ASMedia 1092 [5.4,44/88] binder: use wake_up_pollfree() [5.4,46/88] aio: keep poll requests on waitqueue until completed [5.4,47/88] aio: fix use-after-free due to missing POLLFREE handling [5.4,48/88] tracefs: Set all files to the same group ownership as the mount option [5.4,49/88] block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) [5.4,50/88] qede: validate non LSO skb length [5.4,51/88] ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer [5.4,52/88] i40e: Fix failed opcode appearing if handling messages from VF [5.4,53/88] i40e: Fix pre-set max number of queues for VF [5.4,54/88] mtd: rawnand: fsmc: Take instruction delay into account [5.4,55/88] mtd: rawnand: fsmc: Fix timing computation [5.4,56/88] dt-bindings: net: Reintroduce PHY no lane swap binding [5.4,57/88] tools build: Remove needless libpython-version feature check that breaks test-all fas... [5.4,59/88] net: altera: set a couple error code in probe() [5.4,62/88] net/qla3xxx: fix an error code in ql_adapter_up() [5.4,63/88] selftests/fib_tests: Rework fib_rp_filter_test() [5.4,65/88] USB: gadget: zero allocate endpoint 0 buffers [5.4,66/88] usb: core: config: fix validation of wMaxPacketValue entries [5.4,67/88] xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending [5.4,68/88] usb: core: config: using bit mask instead of individual bits [5.4,70/88] iio: trigger: Fix reference counting [5.4,73/88] iio: mma8452: Fix trigger reference couting [5.4,75/88] iio: kxsd9: Dont return error code in trigger handler [5.4,76/88] iio: itg3200: Call iio_trigger_notify_done() on error [5.4,77/88] iio: dln2-adc: Fix lockdep complaint [5.4,78/88] iio: dln2: Check return value of devm_iio_trigger_register() [5.4,79/88] iio: at91-sama5d2: Fix incorrect sign extension [5.4,80/88] iio: adc: axp20x_adc: fix charging current reporting on AXP22x [5.4,83/88] irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() [5.4,86/88] irqchip: nvic: Fix offset for Interrupt Priority Offsets

Commit Message

Greg Kroah-Hartman Dec. 13, 2021, 9:29 a.m. UTC

From: Benjamin Tissoires <benjamin.tissoires@redhat.com>

commit 918aa1ef104d286d16b9e7ef139a463ac7a296f0 upstream.

When emulating the device through uhid, there is a chance we don't have
output reports and so report_field is null.

Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20211202095334.14399-3-benjamin.tissoires@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-bigbenff.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/drivers/hid/hid-bigbenff.c
+++ b/drivers/hid/hid-bigbenff.c
@@ -191,7 +191,7 @@  static void bigben_worker(struct work_st
 		struct bigben_device, worker);
 	struct hid_field *report_field = bigben->report->field[0];
 
-	if (bigben->removed)
+	if (bigben->removed || !report_field)
 		return;
 
 	if (bigben->work_led) {