Commit 85ff89af authored by Gwendal Grignou's avatar Gwendal Grignou Committed by Luis Henriques

HID: i2c-hid: prevent buffer overflow in early IRQ

commit d1c7e29e upstream.

Before ->start() is called, bufsize size is set to HID_MIN_BUFFER_SIZE,
64 bytes. While processing the IRQ, we were asking to receive up to
wMaxInputLength bytes, which can be bigger than 64 bytes.

Later, when ->start is run, a proper bufsize will be calculated.

Given wMaxInputLength is said to be unreliable in other part of the
code, set to receive only what we can even if it results in truncated
reports.
Signed-off-by: default avatarGwendal Grignou <gwendal@chromium.org>
Reviewed-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent 9cc8ab9e
...@@ -370,7 +370,7 @@ static int i2c_hid_hwreset(struct i2c_client *client) ...@@ -370,7 +370,7 @@ static int i2c_hid_hwreset(struct i2c_client *client)
static void i2c_hid_get_input(struct i2c_hid *ihid) static void i2c_hid_get_input(struct i2c_hid *ihid)
{ {
int ret, ret_size; int ret, ret_size;
int size = le16_to_cpu(ihid->hdesc.wMaxInputLength); int size = ihid->bufsize;
ret = i2c_master_recv(ihid->client, ihid->inbuf, size); ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
if (ret != size) { if (ret != size) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment