Commit adefb69b authored Jul 14, 2012 by Vinicius Costa Gomes Committed by Jiri Kosina Jul 20, 2012

HID: uhid: Fix sending events with invalid data



This was detected because events with invalid types were arriving
to userspace.

The code before this patch would only work for the first event in the
queue (when uhid->tail is 0).

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Reviewed-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

parent 1a8b294c

drivers/hid/uhid.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -465,7 +465,7 @@ static ssize_t uhid_char_read(struct file file, char __user buffer,
	goto try_again;		goto try_again;
	} else {		} else {
	len = min(count, sizeof(**uhid->outq));		len = min(count, sizeof(**uhid->outq));
	if (copy_to_user(buffer, &uhid->outq[uhid->tail], len)) {		if (copy_to_user(buffer, uhid->outq[uhid->tail], len)) {
	ret = -EFAULT;		ret = -EFAULT;
	} else {		} else {
	kfree(uhid->outq[uhid->tail]);		kfree(uhid->outq[uhid->tail]);