diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2009-07-22 09:30:07 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-07-22 09:30:07 -0700 |
| commit | 1fd1f285369d992950a5411139a23f0f5804727a (patch) | |
| tree | 1cd4fbc78549c4377281735bb8e3a6de1afe4197 | |
| parent | 0dc3d523e8bc4718e0be2e4a742367d6e4be77cd (diff) | |
| parent | 76c317d6e5cb7f58541879006d39774596962715 (diff) | |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: Move dereferences below a NULL test
HID: hiddev, fix lock imbalance
| -rw-r--r-- | drivers/hid/hid-core.c | 6 | ||||
| -rw-r--r-- | drivers/hid/usbhid/hiddev.c | 4 |
2 files changed, 7 insertions, 3 deletions
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index f2c21d5d24e..5eb10c2ce66 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1075,14 +1075,16 @@ EXPORT_SYMBOL_GPL(hid_report_raw_event); */ int hid_input_report(struct hid_device *hid, int type, u8 *data, int size, int interrupt) { - struct hid_report_enum *report_enum = hid->report_enum + type; - struct hid_driver *hdrv = hid->driver; + struct hid_report_enum *report_enum; + struct hid_driver *hdrv; struct hid_report *report; unsigned int i; int ret; if (!hid || !hid->driver) return -ENODEV; + report_enum = hid->report_enum + type; + hdrv = hid->driver; if (!size) { dbg_hid("empty report\n"); diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c index 9e9421525fb..215b2addddb 100644 --- a/drivers/hid/usbhid/hiddev.c +++ b/drivers/hid/usbhid/hiddev.c @@ -527,8 +527,10 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, goto goodreturn; case HIDIOCGCOLLECTIONINDEX: + i = field->usage[uref->usage_index].collection_index; + unlock_kernel(); kfree(uref_multi); - return field->usage[uref->usage_index].collection_index; + return i; case HIDIOCGUSAGES: for (i = 0; i < uref_multi->num_values; i++) uref_multi->values[i] = |