diff options
| author | Michael Ellerman <mpe@ellerman.id.au> | 2020-02-01 21:47:17 +1100 |
|---|---|---|
| committer | Michael Ellerman <mpe@ellerman.id.au> | 2020-02-01 21:47:17 +1100 |
| commit | 4c25df5640ae6e4491ee2c50d3f70c1559ef037d (patch) | |
| tree | 9d68b0361918926d7d7b6d78090dcfb942ec4e72 /drivers/hid/hid-core.c | |
| parent | 34b5a946a9543ce38d8ad1aacc4362533a813db7 (diff) | |
| parent | 3d7dfd632f9b60cfce069b4da517e6b1a1c3f613 (diff) | |
Merge branch 'topic/user-access-begin' into next
Merge the user_access_begin() series from Christophe. This is based on
a commit from Linus that went into v5.5-rc7.
Diffstat (limited to 'drivers/hid/hid-core.c')
| -rw-r--r-- | drivers/hid/hid-core.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index e0b241bd3070..851fe54ea59e 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -288,6 +288,12 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign offset = report->size; report->size += parser->global.report_size * parser->global.report_count; + /* Total size check: Allow for possible report index byte */ + if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) { + hid_err(parser->device, "report is too long\n"); + return -1; + } + if (!parser->local.usage_index) /* Ignore padding fields */ return 0; |