summaryrefslogtreecommitdiff
path: root/drivers/hid/i2c-hid
diff options
context:
space:
mode:
authorSeth Forshee <seth.forshee@canonical.com>2015-02-20 20:45:11 +0300
committerJiri Kosina <jkosina@suse.cz>2015-02-23 17:10:04 +0300
commit6d00f37e49d95e640a3937a4a1ae07dbe92a10cb (patch)
tree5d180215f0d463f4967b4ac379ad2b86e4b0808a /drivers/hid/i2c-hid
parentb94993f6fb3452628bb4678ea86df33ffbfdde8d (diff)
downloadlinux-6d00f37e49d95e640a3937a4a1ae07dbe92a10cb.tar.xz
HID: i2c-hid: Limit reads to wMaxInputLength bytes for input events
d1c7e29e8d27 (HID: i2c-hid: prevent buffer overflow in early IRQ) changed hid_get_input() to read ihid->bufsize bytes, which can be more than wMaxInputLength. This is the case with the Dell XPS 13 9343, and it is causing events to be missed. In some cases the missed events are releases, which can cause the cursor to jump or freeze, among other problems. Limit the number of bytes read to min(wMaxInputLength, ihid->bufsize) to prevent such problems. Fixes: d1c7e29e8d27 "HID: i2c-hid: prevent buffer overflow in early IRQ" Signed-off-by: Seth Forshee <seth.forshee@canonical.com> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid/i2c-hid')
-rw-r--r--drivers/hid/i2c-hid/i2c-hid.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 8f1dfc5c5d9c..36053f33d6d9 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -370,7 +370,10 @@ static int i2c_hid_hwreset(struct i2c_client *client)
static void i2c_hid_get_input(struct i2c_hid *ihid)
{
int ret, ret_size;
- int size = ihid->bufsize;
+ int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
+
+ if (size > ihid->bufsize)
+ size = ihid->bufsize;
ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
if (ret != size) {