Merge "HID: core: prevent out-of-bound readings" (a2f55351) · Commits · e / devices / android_kernel_sony_msm8998

drivers/hid/hid-core.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -1251,6 +1251,7 @@ static void hid_input_field(struct hid_device hid, struct hid_field field,
		/* Ignore report if ErrorRollOver */
		if (!(field->flags & HID_MAIN_ITEM_VARIABLE) &&
		value[n] >= min && value[n] <= max &&
		value[n] - min < field->maxusage &&
		field->usage[value[n] - min].hid == HID_UP_KEYBOARD + 1)
		goto exit;
		}
		@@ -1263,11 +1264,13 @@ static void hid_input_field(struct hid_device hid, struct hid_field field,
		}

		if (field->value[n] >= min && field->value[n] <= max
		&& field->value[n] - min < field->maxusage
		&& field->usage[field->value[n] - min].hid
		&& search(value, field->value[n], count))
		hid_process_event(hid, field, &field->usage[field->value[n] - min], 0, interrupt);

		if (value[n] >= min && value[n] <= max
		&& value[n] - min < field->maxusage
		&& field->usage[value[n] - min].hid
		&& search(field->value, value[n], count))
		hid_process_event(hid, field, &field->usage[value[n] - min], 1, interrupt);

+7 −0

Original line number	Diff line number	Diff line
		@@ -417,6 +417,10 @@ EXPORT_SYMBOL_GPL(tty_ldisc_flush);
		* they are not on hot paths so a little discipline won't do
		* any harm.
		*
		* The line discipline-related tty_struct fields are reset to
		* prevent the ldisc driver from re-using stale information for
		* the new ldisc instance.
		*
		* Locking: takes termios_rwsem
		*/

		@@ -425,6 +429,9 @@ static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
		down_write(&tty->termios_rwsem);
		tty->termios.c_line = num;
		up_write(&tty->termios_rwsem);

		tty->disc_data = NULL;
		tty->receive_room = 0;
		}

		/**