Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 53182517 authored by Benjamin Tissoires's avatar Benjamin Tissoires Committed by Jiri Kosina
Browse files

HID: core: check parameters when sending/receiving data from the device 



It is better to check them soon enough before triggering any kernel panic.

Signed-off-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: default avatarDavid Herrmann <dh.herrmann@gmail.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 7e0bc880

drivers/hid/i2c-hid/i2c-hid.c

+1 −1
Original line number Diff line number Diff line
@@ -276,7 +276,7 @@ static int i2c_hid_set_or_send_report(struct i2c_client *client, u8 reportType, 
	u16 outputRegister = le16_to_cpu(ihid->hdesc.wOutputRegister);

	u16 maxOutputLength = le16_to_cpu(ihid->hdesc.wMaxOutputLength);



	/* hidraw already checked that data_len < HID_MAX_BUFFER_SIZE */

	/* hid_hw_* already checked that data_len < HID_MAX_BUFFER_SIZE */

	u16 size =	2			/* size */ +

			(reportID ? 1 : 0)	/* reportID */ +

			data_len		/* buf */;

include/linux/hid.h

+6 −0
Original line number Diff line number Diff line
@@ -989,6 +989,9 @@ static inline int hid_hw_raw_request(struct hid_device *hdev, 
				  unsigned char reportnum, __u8 *buf,

				  size_t len, unsigned char rtype, int reqtype)

{

	if (len < 1 || len > HID_MAX_BUFFER_SIZE || !buf)

		return -EINVAL;



	if (hdev->ll_driver->raw_request)

		return hdev->ll_driver->raw_request(hdev, reportnum, buf, len,

						    rtype, reqtype);
@@ -1008,6 +1011,9 @@ static inline int hid_hw_raw_request(struct hid_device *hdev, 
static inline int hid_hw_output_report(struct hid_device *hdev, __u8 *buf,

					size_t len)

{

	if (len < 1 || len > HID_MAX_BUFFER_SIZE || !buf)

		return -EINVAL;



	if (hdev->ll_driver->output_report)

		return hdev->ll_driver->output_report(hdev, buf, len);