summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPeter Wu <peter@lekensteyn.nl>2014-12-11 13:51:18 +0100
committerJiri Kosina <jkosina@suse.cz>2014-12-11 23:10:00 +0100
commit1430ee73b566a30bc210501d1e0e99c519707f1e (patch)
treeb16d64b16d3f19f4675bc9787719795d1601d96c
parent02cc097e62d51bf6e5cb4209ca90d9bf68e358b5 (diff)
downloadlinux-1430ee73b566a30bc210501d1e0e99c519707f1e.tar.gz
HID: logitech-hidpp: check name retrieval return code
hidpp_devicenametype_get_device_name() may return a negative value on protocol errors (for example, when the device is powered off). Explicitly check this condition to avoid a long-running loop. (0 cannot be returned as __name_length - index > 0, but check for it anyway as it would otherwise result in an infinite loop.) Signed-off-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
-rw-r--r--drivers/hid/hid-logitech-hidpp.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 5066df8afee5..4d72c20fa233 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -484,10 +484,16 @@ static char *hidpp_get_device_name(struct hidpp_device *hidpp)
if (!name)
return NULL;
- while (index < __name_length)
- index += hidpp_devicenametype_get_device_name(hidpp,
+ while (index < __name_length) {
+ ret = hidpp_devicenametype_get_device_name(hidpp,
feature_index, index, name + index,
__name_length - index);
+ if (ret <= 0) {
+ kfree(name);
+ return NULL;
+ }
+ index += ret;
+ }
return name;
}