On Sat, Aug 23, 2014 at 8:40 AM, Goffredo Baroncelli <kreijack@xxxxxxxxx> wrote: > Don't copy more than 'count' byte, because *buf may be > shorter than DJREPORT_SHORT_LENGTH,and this means an > access violation. Of course count cannot be greather > than the result buffer. That's a really good catch, but one week late :) See https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=51217e69697fba92a06e07e16f55c9a52d8e8945 Cheers, Benjamin > > Signed-off-by: Goffredo Baroncelli <kreijack@xxxxxxxxx> > --- > drivers/hid/hid-logitech-dj.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c > index 486dbde..ca0ab51 100644 > --- a/drivers/hid/hid-logitech-dj.c > +++ b/drivers/hid/hid-logitech-dj.c > @@ -557,7 +557,7 @@ static int logi_dj_ll_raw_request(struct hid_device *hid, > if (!out_buf) > return -ENOMEM; > > - if (count < DJREPORT_SHORT_LENGTH - 2) > + if (count > DJREPORT_SHORT_LENGTH - 2) > count = DJREPORT_SHORT_LENGTH - 2; > > out_buf[0] = REPORT_ID_DJ_SHORT; > -- > 1.9.3 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-input" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
