]> git.baikalelectronics.ru Git - kernel.git/commit
HID: i2c-hid: prevent buffer overflow in early IRQ
authorGwendal Grignou <gwendal@chromium.org>
Fri, 12 Dec 2014 00:02:45 +0000 (16:02 -0800)
committerJiri Kosina <jkosina@suse.cz>
Fri, 12 Dec 2014 08:36:20 +0000 (09:36 +0100)
commite7a2e371bed8c4463014910339cb46ff3d780f04
tree4067652204d865084fe2c863e281b176a32e803e
parent1594386effd02110ea61730f4ffc85745330cfd9
HID: i2c-hid: prevent buffer overflow in early IRQ

Before ->start() is called, bufsize size is set to HID_MIN_BUFFER_SIZE,
64 bytes. While processing the IRQ, we were asking to receive up to
wMaxInputLength bytes, which can be bigger than 64 bytes.

Later, when ->start is run, a proper bufsize will be calculated.

Given wMaxInputLength is said to be unreliable in other part of the
code, set to receive only what we can even if it results in truncated
reports.

Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/i2c-hid/i2c-hid.c