HID: hid-lg4ff: Add check for empty lbuf

commit 0b94d7f2a95a4e4b45ff671f964b238e34604e92 upstream.

If an empty buf is received, lbuf is also empty. So lbuf is
accessed by index -1.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 0dd6833b97db ("HID: hid-lg4ff: Allow switching of Logitech gaming wheels between compatibility modes")
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
index 5e6a0cef2a06d061035520a28e24cc4488859498..e3fcf1353fb3b701c0ec821be638f0a154aa9f78 100644 (file)
--- a/drivers/hid/hid-lg4ff.c
+++ b/drivers/hid/hid-lg4ff.c
@@ -872,6 +872,12 @@ static ssize_t lg4ff_alternate_modes_store(struct device *dev, struct device_att
                return -ENOMEM;
 
        i = strlen(lbuf);
+
+       if (i == 0) {
+               kfree(lbuf);
+               return -EINVAL;
+       }
+
        if (lbuf[i-1] == '\n') {
                if (i == 1) {
                        kfree(lbuf);