greybus: hid: fix null-deref on short report requests

Make sure to verify the length of incoming requests before trying to
parse the request buffer, which can even be NULL on empty requests.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

diff --git a/drivers/staging/greybus/hid.c b/drivers/staging/greybus/hid.c
index f0da387476b877096a2185f843a2eb18f1081f34..a225813bc477bd49fba61304dc157a28c9fc5ee0 100644 (file)
--- a/drivers/staging/greybus/hid.c
+++ b/drivers/staging/greybus/hid.c
@@ -163,6 +163,11 @@ static void gb_hid_irq_handler(u8 type, struct gb_operation *op)
                return;
        }
 
+       if (op->request->payload_size < 2) {
+               dev_err(&connection->dev, "short report received\n");
+               return;
+       }
+
        size = request->report[0] | request->report[1] << 8;
        if (!size) {
                dev_err(&connection->dev, "bad report size: %d\n", size);