hid: usbhid: Changes to prevent buffer overflow

Moved some value checks to right positions to prevent
buffer flow, which may be possible before. Previously
these value checks are in an else statement which may
not be executed.

Change-Id: I02dbecd074183581a6bdae6377097bc004bd3d3c
CRs-fixed: 1102936
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>

diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 700145b..da8fd95 100644 (file)
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -510,13 +510,13 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
                                goto inval;
 
                        field = report->field[uref->field_index];
+               }
 
-                       if (cmd == HIDIOCGCOLLECTIONINDEX) {
-                               if (uref->usage_index >= field->maxusage)
-                                       goto inval;
-                       } else if (uref->usage_index >= field->report_count)
+               if (cmd == HIDIOCGCOLLECTIONINDEX) {
+                       if (uref->usage_index >= field->maxusage)
                                goto inval;
-               }
+               } else if (uref->usage_index >= field->report_count)
+                       goto inval;
 
                if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
                    (uref_multi->num_values > HID_MAX_MULTI_USAGES ||