summaryrefslogtreecommitdiff
path: root/drivers/hid
diff options
context:
space:
mode:
authorSong Hongyan <hongyan.song@intel.com>2016-11-15 04:11:10 +0300
committerJiri Kosina <jkosina@suse.cz>2016-11-23 19:54:58 +0300
commitd443a0aa3a291e5f78072f2fa464e03bc83fafad (patch)
tree0d0f03b4fa011cb61fd89f92bdaf072a648293db /drivers/hid
parent6dab07df555b652d8d989348b2ce04498d7f9a70 (diff)
downloadlinux-d443a0aa3a291e5f78072f2fa464e03bc83fafad.tar.xz
HID: hid-sensor-hub: clear memory to avoid random data
When user tried to read some fields like hysteresis from IIO sysfs on some systems, it fails. The reason is that this field is a byte field and caller of sensor_hub_get_feature() passes a buffer of 4 bytes. Here the function sensor_hub_get_feature() copies the single byte from the report to the caller buffer and returns "1" as the number of bytes copied. So caller can use the return value. But this is done by multiple callers, so if we just change the sensor_hub_get_feature so that caller buffer is initialized with 0s then we don't to change all functions. Signed-off-by: Song Hongyan <hongyan.song@intel.com> Acked-by: Jonathan Cameron <jic23@kernel.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid')
-rw-r--r--drivers/hid/hid-sensor-hub.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index c5c3d6111729..60875625cbdf 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -212,6 +212,7 @@ int sensor_hub_set_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
__s32 value;
int ret = 0;
+ memset(buffer, 0, buffer_size);
mutex_lock(&data->mutex);
report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
if (!report || (field_index >= report->maxfield)) {