releases/4.16.4/hid-i2c-hid-fix-size-check-and-type-usage.patch

   1 From ac75a041048b8c1f7418e27621ca5efda8571043 Mon Sep 17 00:00:00 2001
   2 From: Aaron Ma <aaron.ma@canonical.com>
   3 Date: Mon, 8 Jan 2018 10:41:40 +0800
   4 Subject: HID: i2c-hid: fix size check and type usage
   5
   6 From: Aaron Ma <aaron.ma@canonical.com>
   7
   8 commit ac75a041048b8c1f7418e27621ca5efda8571043 upstream.
   9
  10 When convert char array with signed int, if the inbuf[x] is negative then
  11 upper bits will be set to 1. Fix this by using u8 instead of char.
  12
  13 ret_size has to be at least 3, hid_input_report use it after minus 2 bytes.
  14
  15 Cc: stable@vger.kernel.org
  16 Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
  17 Signed-off-by: Jiri Kosina <jkosina@suse.cz>
  18 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  19
  20 ---
  21  drivers/hid/i2c-hid/i2c-hid.c |   13 +++++++------
  22  1 file changed, 7 insertions(+), 6 deletions(-)
  23
  24 --- a/drivers/hid/i2c-hid/i2c-hid.c
  25 +++ b/drivers/hid/i2c-hid/i2c-hid.c
  26 @@ -144,10 +144,10 @@ struct i2c_hid {
  27                                                    * register of the HID
  28                                                    * descriptor. */
  29         unsigned int            bufsize;        /* i2c buffer size */
  30 -       char                    *inbuf;         /* Input buffer */
  31 -       char                    *rawbuf;        /* Raw Input buffer */
  32 -       char                    *cmdbuf;        /* Command buffer */
  33 -       char                    *argsbuf;       /* Command arguments buffer */
  34 +       u8                      *inbuf;         /* Input buffer */
  35 +       u8                      *rawbuf;        /* Raw Input buffer */
  36 +       u8                      *cmdbuf;        /* Command buffer */
  37 +       u8                      *argsbuf;       /* Command arguments buffer */
  38
  39         unsigned long           flags;          /* device flags */
  40         unsigned long           quirks;         /* Various quirks */
  41 @@ -455,7 +455,8 @@ out_unlock:
  42
  43  static void i2c_hid_get_input(struct i2c_hid *ihid)
  44  {
  45 -       int ret, ret_size;
  46 +       int ret;
  47 +       u32 ret_size;
  48         int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
  49
  50         if (size > ihid->bufsize)
  51 @@ -480,7 +481,7 @@ static void i2c_hid_get_input(struct i2c
  52                 return;
  53         }
  54
  55 -       if (ret_size > size) {
  56 +       if ((ret_size > size) || (ret_size <= 2)) {
  57                 dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",
  58                         __func__, size, ret_size);
  59                 return;