--- drivers/hid/hidraw.c

+++ drivers/hid/hidraw.c

@@ -105,11 +105,15 @@ out:

static ssize_t hidraw_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos)

{

unsigned int minor = iminor(file->f_path.dentry->d_inode);

- /* FIXME: What stops hidraw_table going NULL */

- struct hid_device *dev = hidraw_table[minor]->hid;

+ struct hid_device *dev;

__u8 *buf;

int ret = 0;

+ if (!hidraw_table[minor])

+ return -ENODEV;

+

+ dev = hidraw_table[minor]->hid;

+

if (!dev->hid_output_raw_report)

return -ENODEV;

@@ -237,11 +241,16 @@ static long hidraw_ioctl(struct file *fi

struct inode *inode = file->f_path.dentry->d_inode;

unsigned int minor = iminor(inode);

long ret = 0;

- /* FIXME: What stops hidraw_table going NULL */

- struct hidraw *dev = hidraw_table[minor];

+ struct hidraw *dev;

void __user *user_arg = (void __user*) arg;

lock_kernel();

+ dev = hidraw_table[minor];

+ if (!dev) {

+ ret = -ENODEV;

+ goto out;

+ }

+

switch (cmd) {

case HIDIOCGRDESCSIZE:

if (put_user(dev->hid->rsize, (int __user *)arg))

@@ -314,6 +323,7 @@ static long hidraw_ioctl(struct file *fi

ret = -ENOTTY;

}

+out:

unlock_kernel();

return ret;

}