]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
HID: i2c-hid: prevent buffer overflow in early IRQ
authorGwendal Grignou <gwendal@chromium.org>
Fri, 12 Dec 2014 00:02:45 +0000 (16:02 -0800)
committerJiri Slaby <jslaby@suse.cz>
Mon, 26 Jan 2015 13:38:49 +0000 (14:38 +0100)
commitf0a431e778fffb7eae3350a85b0998bf17e726a6
treed8ff59e1c62f20ca8daa5a060108d4bccabe5ec9
parent5927cd034b1a289e1c73018fc908403c0ce15658
HID: i2c-hid: prevent buffer overflow in early IRQ

commit d1c7e29e8d276c669e8790bb8be9f505ddc48888 upstream.

Before ->start() is called, bufsize size is set to HID_MIN_BUFFER_SIZE,
64 bytes. While processing the IRQ, we were asking to receive up to
wMaxInputLength bytes, which can be bigger than 64 bytes.

Later, when ->start is run, a proper bufsize will be calculated.

Given wMaxInputLength is said to be unreliable in other part of the
code, set to receive only what we can even if it results in truncated
reports.

Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
drivers/hid/i2c-hid/i2c-hid.c