| From: Aaron Ma <aaron.ma@canonical.com> |
| Date: Mon, 8 Jan 2018 10:41:40 +0800 |
| Subject: HID: i2c-hid: fix size check and type usage |
| |
| commit ac75a041048b8c1f7418e27621ca5efda8571043 upstream. |
| |
| When convert char array with signed int, if the inbuf[x] is negative then |
| upper bits will be set to 1. Fix this by using u8 instead of char. |
| |
| ret_size has to be at least 3, hid_input_report use it after minus 2 bytes. |
| |
| Signed-off-by: Aaron Ma <aaron.ma@canonical.com> |
| Signed-off-by: Jiri Kosina <jkosina@suse.cz> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/hid/i2c-hid/i2c-hid.c | 13 +++++++------ |
| 1 file changed, 7 insertions(+), 6 deletions(-) |
| |
| --- a/drivers/hid/i2c-hid/i2c-hid.c |
| +++ b/drivers/hid/i2c-hid/i2c-hid.c |
| @@ -136,10 +136,10 @@ struct i2c_hid { |
| * register of the HID |
| * descriptor. */ |
| unsigned int bufsize; /* i2c buffer size */ |
| - char *inbuf; /* Input buffer */ |
| - char *rawbuf; /* Raw Input buffer */ |
| - char *cmdbuf; /* Command buffer */ |
| - char *argsbuf; /* Command arguments buffer */ |
| + u8 *inbuf; /* Input buffer */ |
| + u8 *rawbuf; /* Raw Input buffer */ |
| + u8 *cmdbuf; /* Command buffer */ |
| + u8 *argsbuf; /* Command arguments buffer */ |
| |
| unsigned long flags; /* device flags */ |
| |
| @@ -373,7 +373,8 @@ static int i2c_hid_hwreset(struct i2c_cl |
| |
| static void i2c_hid_get_input(struct i2c_hid *ihid) |
| { |
| - int ret, ret_size; |
| + int ret; |
| + u32 ret_size; |
| int size = le16_to_cpu(ihid->hdesc.wMaxInputLength); |
| |
| if (size > ihid->bufsize) |
| @@ -398,7 +399,7 @@ static void i2c_hid_get_input(struct i2c |
| return; |
| } |
| |
| - if (ret_size > size) { |
| + if ((ret_size > size) || (ret_size <= 2)) { |
| dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n", |
| __func__, size, ret_size); |
| return; |