diff options
| author | David Herrmann <dh.herrmann@gmail.com> | 2013-12-19 15:09:32 +0400 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2014-02-18 00:17:55 +0400 |
| commit | a4b1b5877b514b276f0f31efe02388a9c2836728 (patch) | |
| tree | a09dd741c0a2b98db2ab8f71b45c5dc92efcc02c /net/bluetooth/hidp/hidp.h | |
| parent | 218eb9ed840c6279686ed6b0c3e31a083e241ff9 (diff) | |
| download | linux-a4b1b5877b514b276f0f31efe02388a9c2836728.tar.xz | |
HID: Bluetooth: hidp: make sure input buffers are big enough
HID core expects the input buffers to be at least of size 4096
(HID_MAX_BUFFER_SIZE). Other sizes will result in buffer-overflows if an
input-report is smaller than advertised. We could, like i2c, compute the
biggest report-size instead of using HID_MAX_BUFFER_SIZE, but this will
blow up if report-descriptors are changed after ->start() has been called.
So lets be safe and just use the biggest buffer we have.
Note that this adds an additional copy to the HIDP input path. If there is
a way to make sure the skb-buf is big enough, we should use that instead.
The best way would be to make hid-core honor the @size argument, though,
that sounds easier than it is. So lets just fix the buffer-overflows for
now and afterwards look for a faster way for all transport drivers.
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'net/bluetooth/hidp/hidp.h')
| -rw-r--r-- | net/bluetooth/hidp/hidp.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h index ab5241400cf7..8798492a6e99 100644 --- a/net/bluetooth/hidp/hidp.h +++ b/net/bluetooth/hidp/hidp.h @@ -24,6 +24,7 @@ #define __HIDP_H #include <linux/types.h> +#include <linux/hid.h> #include <linux/kref.h> #include <net/bluetooth/bluetooth.h> #include <net/bluetooth/l2cap.h> @@ -179,6 +180,9 @@ struct hidp_session { /* Used in hidp_output_raw_report() */ int output_report_success; /* boolean */ + + /* temporary input buffer */ + u8 input_buf[HID_MAX_BUFFER_SIZE]; }; /* HIDP init defines */ |