From c2500bdffe5a95fbd0aecdd5be3d2f175ad22f92 Mon Sep 17 00:00:00 2001 From: Michael Zaidman Date: Sat, 5 Nov 2022 23:11:49 +0200 Subject: HID: ft260: fix a NULL pointer dereference in ft260_i2c_write The zero-length passed into the ft260_i2c_write() triggered the NULL pointer dereference in the debug message on data[0] access. Since the controller does not support a write of zero length, let's not allow it. Before: $ sudo i2ctransfer -y 13 w0@0x51 Killed After: $ sudo i2ctransfer -y 13 w0@0x51 Error: Sending messages failed: Invalid argument Reported-by: Enrik Berkhan Signed-off-by: Michael Zaidman Signed-off-by: Jiri Kosina --- drivers/hid/hid-ft260.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'drivers/hid/hid-ft260.c') diff --git a/drivers/hid/hid-ft260.c b/drivers/hid/hid-ft260.c index ac133980dfe9..b4f180c8750a 100644 --- a/drivers/hid/hid-ft260.c +++ b/drivers/hid/hid-ft260.c @@ -409,6 +409,9 @@ static int ft260_i2c_write(struct ft260_device *dev, u8 addr, u8 *data, struct ft260_i2c_write_request_report *rep = (struct ft260_i2c_write_request_report *)dev->write_buf; + if (len < 1) + return -EINVAL; + rep->flag = FT260_FLAG_START; do { -- cgit v1.2.3