From: Jesper Juhl If, in usb_hid_configure(), we fail to allocate storage for 'usbhid', "if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))", then we'll jump to the 'fail:' label where we have this code: usb_free_urb(usbhid->urbin); usb_free_urb(usbhid->urbout); usb_free_urb(usbhid->urbctrl); Since we got here because we couldn't allocate storage for 'usbhid', what we have here is a NULL pointer dereference - ouch... This patch solves that little problem by adding a new 'fail_no_usbhid:' label after the problematic calls to usb_free_urb() and jumps to that one instead, in the problem case. Signed-off-by: Jesper Juhl Cc: Jiri Kosina Cc: Dmitry Torokhov Cc: Greg KH Signed-off-by: Andrew Morton --- drivers/hid/usbhid/hid-core.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletion(-) diff -puN drivers/hid/usbhid/hid-core.c~hid-fix-a-null-pointer-dereference-when-we-fail-to-allocate-memory drivers/hid/usbhid/hid-core.c --- a/drivers/hid/usbhid/hid-core.c~hid-fix-a-null-pointer-dereference-when-we-fail-to-allocate-memory +++ a/drivers/hid/usbhid/hid-core.c @@ -766,7 +766,7 @@ static struct hid_device *usb_hid_config hid->quirks = quirks; if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL))) - goto fail; + goto fail_no_usbhid; hid->driver_data = usbhid; usbhid->hid = hid; @@ -901,6 +901,7 @@ fail: usb_free_urb(usbhid->urbin); usb_free_urb(usbhid->urbout); usb_free_urb(usbhid->urbctrl); +fail_no_usbhid: hid_free_buffers(dev, hid); hid_free_device(hid); _