]> git.ipfire.org Git - thirdparty/linux.git/commit
HID: core: Provide new max_buffer_size attribute to over-ride the default
authorLee Jones <lee@kernel.org>
Mon, 23 Jan 2023 12:39:11 +0000 (12:39 +0000)
committerJiri Kosina <jkosina@suse.cz>
Thu, 23 Feb 2023 10:51:56 +0000 (11:51 +0100)
commitb1a37ed00d7908a991c1d0f18a8cba3c2aa99bdc
tree4ec509588d2eaa3a495286af213ef4bcc3ce2991
parent6c71297eaf713ece684a367ce9aff06069d715b9
HID: core: Provide new max_buffer_size attribute to over-ride the default

Presently, when a report is processed, its proposed size, provided by
the user of the API (as Report Size * Report Count) is compared against
the subsystem default HID_MAX_BUFFER_SIZE (16k).  However, some
low-level HID drivers allocate a reduced amount of memory to their
buffers (e.g. UHID only allocates UHID_DATA_MAX (4k) buffers), rending
this check inadequate in some cases.

In these circumstances, if the received report ends up being smaller
than the proposed report size, the remainder of the buffer is zeroed.
That is, the space between sizeof(csize) (size of the current report)
and the rsize (size proposed i.e. Report Size * Report Count), which can
be handled up to HID_MAX_BUFFER_SIZE (16k).  Meaning that memset()
shoots straight past the end of the buffer boundary and starts zeroing
out in-use values, often resulting in calamity.

This patch introduces a new variable into 'struct hid_ll_driver' where
individual low-level drivers can over-ride the default maximum value of
HID_MAX_BUFFER_SIZE (16k) with something more sympathetic to the
interface.

Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/hid-core.c
include/linux/hid.h