diff options
| author | Miquel Raynal <miquel.raynal@bootlin.com> | 2020-01-27 17:49:15 +0100 |
|---|---|---|
| committer | Miquel Raynal <miquel.raynal@bootlin.com> | 2020-01-27 17:49:15 +0100 |
| commit | 4575243c5c173f8adbc08a5c6ea2269742ea2b47 (patch) | |
| tree | d084fde0a55f38f1924e45f9629dad7747759df7 /drivers/hid/hid-core.c | |
| parent | 701ddf0bbfc761b8bdc974ce9c4e05f9833683e3 (diff) | |
| parent | d85339d9ea2660b550f12aca8bd040be4395c963 (diff) | |
Merge tag 'nand/for-5.6' into mtd/next
Raw NAND
* Macronix: Use match_string() helper
* Atmel: switch to using devm_fwnode_gpiod_get()
* Denali: rework the SKIP_BYTES feature and add reset controlling
* Brcmnand: set appropriate DMA mask
* Various cleanup.
Onenand drivers
* Rename Samsung and Omap2 drivers to avoid possible build warnings
* Enable compile testing
* Various build issues
* Kconfig cleanup
SPI-NAND
* Support for Toshiba TC58CVG2S0HRAIJ
Diffstat (limited to 'drivers/hid/hid-core.c')
| -rw-r--r-- | drivers/hid/hid-core.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index e0b241bd3070..851fe54ea59e 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -288,6 +288,12 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign offset = report->size; report->size += parser->global.report_size * parser->global.report_count; + /* Total size check: Allow for possible report index byte */ + if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) { + hid_err(parser->device, "report is too long\n"); + return -1; + } + if (!parser->local.usage_index) /* Ignore padding fields */ return 0; |