Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 844580ff authored by Nestor Lopez Casado's avatar Nestor Lopez Casado Committed by Jiri Kosina
Browse files

HID: hid-logitech-dj: fix off by one 



There is a bug where a device with index 6 would write out of bounds in
the array of paired devices.
This patch fixes that problem.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarBenjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: default avatarOlivier Gay <ogay@logitech.com>
Signed-off-by: default avatarNestor Lopez Casado <nlopezcasad@logitech.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 534a7b8e

drivers/hid/hid-logitech-dj.c

+1 −4
Original line number Original line Diff line number Diff line
@@ -179,9 +179,6 @@ static const u8 hid_reportid_size_map[NUMBER_OF_HID_REPORTS] = { 




#define LOGITECH_DJ_INTERFACE_NUMBER 0x02

#define LOGITECH_DJ_INTERFACE_NUMBER 0x02





#define DJ_DEVICE_INDEX_MIN 1

#define DJ_DEVICE_INDEX_MAX 6



static struct hid_ll_driver logi_dj_ll_driver;

static struct hid_ll_driver logi_dj_ll_driver;





static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,

static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
@@ -823,7 +820,7 @@ static void logi_dj_remove(struct hid_device *hdev) 
	 * have finished and no more raw_event callbacks should arrive after

	 * have finished and no more raw_event callbacks should arrive after

	 * the remove callback was triggered so no locks are put around the

	 * the remove callback was triggered so no locks are put around the

	 * code below */

	 * code below */

	for (i = 0; i < DJ_MAX_PAIRED_DEVICES; i++) {

	for (i = 0; i < (DJ_MAX_PAIRED_DEVICES + DJ_DEVICE_INDEX_MIN); i++) {

		dj_dev = djrcv_dev->paired_dj_devices[i];

		dj_dev = djrcv_dev->paired_dj_devices[i];

		if (dj_dev != NULL) {

		if (dj_dev != NULL) {

			hid_destroy_device(dj_dev->hdev);

			hid_destroy_device(dj_dev->hdev);

drivers/hid/hid-logitech-dj.h

+4 −1
Original line number Original line Diff line number Diff line
@@ -27,6 +27,8 @@ 




#define DJ_MAX_PAIRED_DEVICES			6

#define DJ_MAX_PAIRED_DEVICES			6

#define DJ_MAX_NUMBER_NOTIFICATIONS		8

#define DJ_MAX_NUMBER_NOTIFICATIONS		8

#define DJ_DEVICE_INDEX_MIN 			1

#define DJ_DEVICE_INDEX_MAX 			6





#define DJREPORT_SHORT_LENGTH			15

#define DJREPORT_SHORT_LENGTH			15

#define DJREPORT_LONG_LENGTH			32

#define DJREPORT_LONG_LENGTH			32
@@ -94,7 +96,8 @@ struct dj_report { 




struct dj_receiver_dev {

struct dj_receiver_dev {

	struct hid_device *hdev;

	struct hid_device *hdev;

	struct dj_device *paired_dj_devices[DJ_MAX_PAIRED_DEVICES];

	struct dj_device *paired_dj_devices[DJ_MAX_PAIRED_DEVICES +

					    DJ_DEVICE_INDEX_MIN];

	struct work_struct work;

	struct work_struct work;

	struct kfifo notif_fifo;

	struct kfifo notif_fifo;

	spinlock_t lock;

	spinlock_t lock;