summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2009-07-22 09:30:07 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2009-07-22 09:30:07 -0700
commit1fd1f285369d992950a5411139a23f0f5804727a (patch)
tree1cd4fbc78549c4377281735bb8e3a6de1afe4197 /drivers
parent0dc3d523e8bc4718e0be2e4a742367d6e4be77cd (diff)
parent76c317d6e5cb7f58541879006d39774596962715 (diff)
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: Move dereferences below a NULL test HID: hiddev, fix lock imbalance
Diffstat (limited to 'drivers')
-rw-r--r--drivers/hid/hid-core.c6
-rw-r--r--drivers/hid/usbhid/hiddev.c4
2 files changed, 7 insertions, 3 deletions
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f2c21d5d24e8..5eb10c2ce665 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1075,14 +1075,16 @@ EXPORT_SYMBOL_GPL(hid_report_raw_event);
*/
int hid_input_report(struct hid_device *hid, int type, u8 *data, int size, int interrupt)
{
- struct hid_report_enum *report_enum = hid->report_enum + type;
- struct hid_driver *hdrv = hid->driver;
+ struct hid_report_enum *report_enum;
+ struct hid_driver *hdrv;
struct hid_report *report;
unsigned int i;
int ret;
if (!hid || !hid->driver)
return -ENODEV;
+ report_enum = hid->report_enum + type;
+ hdrv = hid->driver;
if (!size) {
dbg_hid("empty report\n");
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 9e9421525fb9..215b2addddbb 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -527,8 +527,10 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
goto goodreturn;
case HIDIOCGCOLLECTIONINDEX:
+ i = field->usage[uref->usage_index].collection_index;
+ unlock_kernel();
kfree(uref_multi);
- return field->usage[uref->usage_index].collection_index;
+ return i;
case HIDIOCGUSAGES:
for (i = 0; i < uref_multi->num_values; i++)
uref_multi->values[i] =