Alan Stern 668160e5a8 HID: usbhid: fix use-after-free bug ...

This patch (as1592) fixes an obscure problem in the usbhid driver.
Under some circumstances, a control or interrupt-OUT URB can be
submitted twice.  This will happen if the first submission fails; the
queue pointers aren't updated, so the next time the queue is restarted
the same URB will be submitted again.

The problem is that raw_report gets deallocated during the first
submission.  The second submission will then dereference and try to
free an already-freed region of memory.  The patch fixes the problem
by setting raw_report to NULL when it is deallocated and checking for
NULL before dereferencing it.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

2012-07-20 11:24:23 +02:00

..

usbhid

HID: usbhid: fix use-after-free bug

2012-07-20 11:24:23 +02:00

hid-a4tech.c

HID: Add and use hid_<level>: dev_<level> equivalents

2010-12-10 15:10:38 +01:00

hid-apple.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2012-07-13 10:33:18 -07:00

hid-aureal.c

HID: Aureal Remote Control Device Driver

2012-04-13 18:15:57 +02:00

hid-axff.c

hid: Add module.h to fix up implicit users of it

2011-10-31 19:31:17 -04:00

hid-belkin.c

HID: Add and use hid_<level>: dev_<level> equivalents

2010-12-10 15:10:38 +01:00

hid-cherry.c

HID: Add and use hid_<level>: dev_<level> equivalents

2010-12-10 15:10:38 +01:00

hid-chicony.c

HID: add more hotkeys in Asus AIO keyboards

2012-02-02 10:32:45 +01:00

hid-core.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2012-07-13 10:33:18 -07:00

hid-cypress.c

HID: Add and use hid_<level>: dev_<level> equivalents

2010-12-10 15:10:38 +01:00

hid-debug.c

Merge branches 'hyperv', 'multitouch', 'roccat', 'upstream', 'upstream-fixes', 'wacom' and 'wiimote' into for-linus

2012-01-05 15:51:02 +01:00

hid-dr.c

hid: Add module.h to fix up implicit users of it

2011-10-31 19:31:17 -04:00

hid-elecom.c

HID: Add and use hid_<level>: dev_<level> equivalents

2010-12-10 15:10:38 +01:00

hid-emsff.c

Merge branches 'hyperv', 'multitouch', 'roccat', 'upstream', 'upstream-fixes', 'wacom' and 'wiimote' into for-linus

2012-01-05 15:51:02 +01:00

hid-ezkey.c

HID: adding __init/__exit macros to module init/exit functions

2009-07-23 01:28:01 +02:00

hid-gaff.c

hid: Add module.h to fix up implicit users of it

2011-10-31 19:31:17 -04:00

hid-generic.c

HID: Create a common generic driver

2012-05-01 12:54:55 +02:00

hid-gyration.c

HID: Add teletext/color keys - gyration remote - EU version (GYAR3101CKDE)

2011-02-15 10:29:57 +01:00

hid-holtekff.c

hid: Add module.h to fix up implicit users of it

2011-10-31 19:31:17 -04:00

hid-hyperv.c

HID: hyperv: Set the hid drvdata correctly

2012-05-17 10:01:07 +02:00

hid-ids.h

Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

2012-07-19 08:15:55 -07:00

hid-input.c

HID: add battery quirk for Apple Wireless ANSI

2012-07-04 15:46:25 +02:00

hid-kensington.c

HID: adding __init/__exit macros to module init/exit functions

2009-07-23 01:28:01 +02:00

hid-keytouch.c

HID: add support for Keytouch IEC 60945

2011-02-17 15:12:45 +01:00

hid-kye.c

HID: kye: Add support for 3 tablets

2012-02-28 13:37:12 +01:00

hid-lcpower.c

HID: hid-lcpower: fix key mapping

2011-02-13 15:04:51 +01:00

hid-lg2ff.c

HID: Add and use hid_<level>: dev_<level> equivalents

2010-12-10 15:10:38 +01:00

hid-lg3ff.c

HID: Add and use hid_<level>: dev_<level> equivalents

2010-12-10 15:10:38 +01:00

hid-lg4ff.c

HID: hid-lg4ff: remove unused label in !LEDS_CLASS case

2012-04-23 21:08:15 +02:00

hid-lg.c

HID: hid-lg: Allow for custom device-specific properties to be stored in priv drvdata

2012-04-03 04:09:50 +02:00

hid-lg.h

HID: lg4ff: Remove sysfs iface before deallocating memory

2012-04-03 04:11:12 +02:00

hid-lgff.c

HID: lg4ff - Move handling of Logitech wheels to lg4ff driver

2011-08-04 16:45:55 +02:00

hid-logitech-dj.c

HID: logitech: don't use stack based dj_report structures

2012-06-03 15:11:43 +02:00

hid-logitech-dj.h

HID: hid-logitech-dj: fix off by one

2011-09-20 16:09:22 +02:00

hid-magicmouse.c

HID: magicmouse: Correct report range of major / minor axes

2012-06-25 15:30:15 +02:00

hid-microsoft.c

HID: fix horizontal wheel for ms comfort mouse 4500

2011-07-12 10:31:56 +02:00

hid-monterey.c

HID: Add and use hid_<level>: dev_<level> equivalents

2010-12-10 15:10:38 +01:00

hid-multitouch.c

HID: hid-multitouch: add support for Zytronic panels

2012-07-19 13:56:16 +02:00

hid-ntrig.c

HID: hid-ntrig: init settle and mode check

2011-03-14 13:10:13 +01:00

hid-ortek.c

HID: add support for Skycable 0x3f07 wireless presenter

2011-03-21 16:12:23 +01:00

hid-petalynx.c

HID: Add and use hid_<level>: dev_<level> equivalents

2010-12-10 15:10:38 +01:00

hid-picolcd.c

simple_open: automatically convert to simple_open()

2012-04-05 15:25:50 -07:00

hid-pl.c

misc latin1 to utf8 conversions

2012-01-02 13:04:55 +01:00

hid-primax.c

HID: support primax keyboards violating USB HID spec

2011-10-17 17:04:41 +02:00

hid-prodikeys.c

module_param: make bool parameters really bool (drivers & misc)

2012-01-13 09:32:20 +10:30

hid-roccat-arvo.c

HID: roccat: fix NULL pointer dereference, add range checks

2011-06-13 13:06:23 +02:00

hid-roccat-arvo.h

HID: roccat: correction and cleanup of HID feature reports

2011-06-13 12:52:57 +02:00

hid-roccat-common.c

Merge branches 'hyperv', 'multitouch', 'roccat', 'upstream', 'upstream-fixes', 'wacom' and 'wiimote' into for-linus

2012-01-05 15:51:02 +01:00

hid-roccat-common.h

HID: roccat: correction and cleanup of HID feature reports

2011-06-13 12:52:57 +02:00

hid-roccat-isku.c

HID: roccat: Add support for Isku keyboard

2011-12-06 10:21:10 +01:00

hid-roccat-isku.h

HID: roccat: Add support for Isku keyboard

2011-12-06 10:21:10 +01:00

hid-roccat-kone.c

HID: roccat: Use kmemdup rather than duplicating its implementation

2011-11-20 00:42:42 +01:00

hid-roccat-kone.h

HID: roccat: correction and cleanup of HID feature reports

2011-06-13 12:52:57 +02:00

hid-roccat-koneplus.c

HID: roccat: fix NULL pointer dereference, add range checks

2011-06-13 13:06:23 +02:00

hid-roccat-koneplus.h

HID: roccat: correction and cleanup of HID feature reports

2011-06-13 12:52:57 +02:00

hid-roccat-kovaplus.c

HID: roccat: Kovaplus now reports external profile changes via roccat device

2011-09-07 13:38:27 +02:00

hid-roccat-kovaplus.h

HID: roccat: correction and cleanup of HID feature reports

2011-06-13 12:52:57 +02:00

hid-roccat-pyra.c

HID: roccat: Pyra now reports external profile changes via roccat device

2011-09-07 13:38:27 +02:00

hid-roccat-pyra.h

HID: roccat: correction and cleanup of HID feature reports

2011-06-13 12:52:57 +02:00

hid-roccat.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

hid-saitek.c

HID: add new driver for non-compliant Saitek devices

2012-02-22 11:30:17 +01:00

hid-samsung.c

HID: Add and use hid_<level>: dev_<level> equivalents

2010-12-10 15:10:38 +01:00

hid-sjoy.c

HID: sjoy: Add device ID for Super Joy Box 3

2012-02-21 14:16:36 +01:00

hid-sony.c

HID: hid-sony: fix endiannes of Sixaxis accel/gyro values

2011-06-13 13:21:30 +02:00

hid-speedlink.c

HID: Add driver to fix Speedlink VAD Cezanne support

2011-06-08 09:45:37 +02:00

hid-sunplus.c

HID: Add and use hid_<level>: dev_<level> equivalents

2010-12-10 15:10:38 +01:00

hid-tivo.c

HID: tivo: fix support for bluetooth version of tivo Slide

2012-03-30 15:28:59 +02:00

hid-tmff.c

hid: Add module.h to fix up implicit users of it

2011-10-31 19:31:17 -04:00

hid-topseed.c

HID: Add support for Perixx PERIBOARD-707 (Plus)

2010-11-25 15:59:02 +01:00

hid-twinhan.c

misc latin1 to utf8 conversions

2012-01-02 13:04:55 +01:00

hid-uclogic.c

HID: uclogic: Add support for UC-Logic TWHL850

2012-05-15 09:50:19 +02:00

hid-wacom.c

HID: wacom: Unify speed setting

2012-05-16 21:42:16 +02:00

hid-waltop.c

HID: waltop: Extend barrel button fix

2012-05-21 13:21:18 +02:00

hid-wiimote-core.c

HID: wiimote: Fix IR data parser

2012-05-09 11:40:51 +02:00

hid-wiimote-debug.c

simple_open: automatically convert to simple_open()

2012-04-05 15:25:50 -07:00

hid-wiimote-ext.c

HID: wiimote: Parse classic controller data

2011-11-22 23:10:10 +01:00

hid-wiimote.h

HID: wiimote: Allow direct DRM debug access

2011-11-22 23:11:10 +01:00

hid-zpff.c

hid: Add module.h to fix up implicit users of it

2011-10-31 19:31:17 -04:00

hid-zydacron.c

HID: zydacron: kfree() NULL pointer cleanup

2011-08-04 23:51:29 +02:00

hidraw.c

HID: hidraw: add proper error handling to raw event reporting

2012-04-27 20:10:09 +02:00

Kconfig

HID: hid-multitouch: add support for Zytronic panels

2012-07-19 13:56:16 +02:00

Makefile

Merge branch 'upstream' into for-linus

2012-05-22 11:32:31 +02:00