]> git.ipfire.org Git - people/arne_f/kernel.git/commit
HID: i2c-hid: prevent buffer overflow in early IRQ
authorGwendal Grignou <gwendal@chromium.org>
Fri, 12 Dec 2014 00:02:45 +0000 (16:02 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 16 Jan 2015 14:59:31 +0000 (06:59 -0800)
commit6d7f4a3b2a4537caef39fcbbd7b297d37a7932b5
treeea27052801e282597e49497e721169bb38a872b0
parent199eb5ada239253fb48ba51e7bc4612c54b651b6
HID: i2c-hid: prevent buffer overflow in early IRQ

commit d1c7e29e8d276c669e8790bb8be9f505ddc48888 upstream.

Before ->start() is called, bufsize size is set to HID_MIN_BUFFER_SIZE,
64 bytes. While processing the IRQ, we were asking to receive up to
wMaxInputLength bytes, which can be bigger than 64 bytes.

Later, when ->start is run, a proper bufsize will be calculated.

Given wMaxInputLength is said to be unreliable in other part of the
code, set to receive only what we can even if it results in truncated
reports.

Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/hid/i2c-hid/i2c-hid.c