Commit 1fd1f285369d992950a5411139a23f0f5804727a
Exists in
master
and in
7 other branches
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: Move dereferences below a NULL test HID: hiddev, fix lock imbalance
Showing 2 changed files Side-by-side Diff
drivers/hid/hid-core.c
| ... | ... | @@ -1075,14 +1075,16 @@ |
| 1075 | 1075 | */ |
| 1076 | 1076 | int hid_input_report(struct hid_device *hid, int type, u8 *data, int size, int interrupt) |
| 1077 | 1077 | { |
| 1078 | - struct hid_report_enum *report_enum = hid->report_enum + type; | |
| 1079 | - struct hid_driver *hdrv = hid->driver; | |
| 1078 | + struct hid_report_enum *report_enum; | |
| 1079 | + struct hid_driver *hdrv; | |
| 1080 | 1080 | struct hid_report *report; |
| 1081 | 1081 | unsigned int i; |
| 1082 | 1082 | int ret; |
| 1083 | 1083 | |
| 1084 | 1084 | if (!hid || !hid->driver) |
| 1085 | 1085 | return -ENODEV; |
| 1086 | + report_enum = hid->report_enum + type; | |
| 1087 | + hdrv = hid->driver; | |
| 1086 | 1088 | |
| 1087 | 1089 | if (!size) { |
| 1088 | 1090 | dbg_hid("empty report\n"); |
drivers/hid/usbhid/hiddev.c
| ... | ... | @@ -527,8 +527,10 @@ |
| 527 | 527 | goto goodreturn; |
| 528 | 528 | |
| 529 | 529 | case HIDIOCGCOLLECTIONINDEX: |
| 530 | + i = field->usage[uref->usage_index].collection_index; | |
| 531 | + unlock_kernel(); | |
| 530 | 532 | kfree(uref_multi); |
| 531 | - return field->usage[uref->usage_index].collection_index; | |
| 533 | + return i; | |
| 532 | 534 | case HIDIOCGUSAGES: |
| 533 | 535 | for (i = 0; i < uref_multi->num_values; i++) |
| 534 | 536 | uref_multi->values[i] = |