diff options
| author | Peter Wu <peter@lekensteyn.nl> | 2014-12-11 13:51:18 +0100 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2014-12-11 23:10:00 +0100 |
| commit | 1430ee73b566a30bc210501d1e0e99c519707f1e (patch) | |
| tree | b16d64b16d3f19f4675bc9787719795d1601d96c /drivers | |
| parent | 02cc097e62d51bf6e5cb4209ca90d9bf68e358b5 (diff) | |
HID: logitech-hidpp: check name retrieval return code
hidpp_devicenametype_get_device_name() may return a negative value on
protocol errors (for example, when the device is powered off).
Explicitly check this condition to avoid a long-running loop.
(0 cannot be returned as __name_length - index > 0, but check for it
anyway as it would otherwise result in an infinite loop.)
Signed-off-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/hid/hid-logitech-hidpp.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c index 5066df8afee5..4d72c20fa233 100644 --- a/drivers/hid/hid-logitech-hidpp.c +++ b/drivers/hid/hid-logitech-hidpp.c @@ -484,10 +484,16 @@ static char *hidpp_get_device_name(struct hidpp_device *hidpp) if (!name) return NULL; - while (index < __name_length) - index += hidpp_devicenametype_get_device_name(hidpp, + while (index < __name_length) { + ret = hidpp_devicenametype_get_device_name(hidpp, feature_index, index, name + index, __name_length - index); + if (ret <= 0) { + kfree(name); + return NULL; + } + index += ret; + } return name; } |