Hi Aaron,
On Mon, Jan 08, 2018 at 10:41:41AM +0800, Aaron Ma wrote:
> When size is negative, calling memset will make segment fault.
> Declare the size as type u32 to keep memset safe.
>
> size in struct hid_report is unsigned, fix return type of
> hid_report_len to u32.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Aaron Ma <aaron.ma@xxxxxxxxxxxxx>
> ---
> drivers/hid/hid-core.c | 10 +++++-----
> include/linux/hid.h | 6 +++---
> 2 files changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
> index 0c3f608131cf..cf81c53e3b98 100644
> --- a/drivers/hid/hid-core.c
> +++ b/drivers/hid/hid-core.c
> @@ -1390,7 +1390,7 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags)
> * of implement() working on 8 byte chunks
> */
>
> - int len = hid_report_len(report) + 7;
> + u32 len = hid_report_len(report) + 7;
>
> return kmalloc(len, flags);
> }
> @@ -1455,7 +1455,7 @@ void __hid_request(struct hid_device *hid, struct hid_report *report,
> {
> char *buf;
> int ret;
> - int len;
> + u32 len;
>
> buf = hid_alloc_report_buf(report, GFP_KERNEL);
> if (!buf)
> @@ -1481,14 +1481,14 @@ void __hid_request(struct hid_device *hid, struct hid_report *report,
> }
> EXPORT_SYMBOL_GPL(__hid_request);
>
> -int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,
> +int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
> int interrupt)
> {
> struct hid_report_enum *report_enum = hid->report_enum + type;
> struct hid_report *report;
> struct hid_driver *hdrv;
> unsigned int a;
> - int rsize, csize = size;
> + u32 rsize, csize = size;
> u8 *cdata = data;
> int ret = 0;
>
> @@ -1546,7 +1546,7 @@ EXPORT_SYMBOL_GPL(hid_report_raw_event);
> *
> * This is data entry for lower layers.
> */
> -int hid_input_report(struct hid_device *hid, int type, u8 *data, int size, int interrupt)
> +int hid_input_report(struct hid_device *hid, int type, u8 *data, u32 size, int interrupt)
> {
> struct hid_report_enum *report_enum;
> struct hid_driver *hdrv;
> diff --git a/include/linux/hid.h b/include/linux/hid.h
> index d491027a7c22..9bc296eebc98 100644
> --- a/include/linux/hid.h
> +++ b/include/linux/hid.h
> @@ -841,7 +841,7 @@ extern int hidinput_connect(struct hid_device *hid, unsigned int force);
> extern void hidinput_disconnect(struct hid_device *);
>
> int hid_set_field(struct hid_field *, unsigned, __s32);
> -int hid_input_report(struct hid_device *, int type, u8 *, int, int);
> +int hid_input_report(struct hid_device *, int type, u8 *, u32, int);
> int hidinput_find_field(struct hid_device *hid, unsigned int type, unsigned int code, struct hid_field **field);
> struct hid_field *hidinput_get_led_field(struct hid_device *hid);
> unsigned int hidinput_count_leds(struct hid_device *hid);
> @@ -1088,13 +1088,13 @@ static inline void hid_hw_wait(struct hid_device *hdev)
> *
> * @report: the report we want to know the length
> */
> -static inline int hid_report_len(struct hid_report *report)
> +static inline u32 hid_report_len(struct hid_report *report)
hid_report_len() is used in several files.
If we think it is a good idea to change the return type, we should fix
these files as well.
[08:47:56]marcus@little:~/git/linux$ git grep -l hid_report_len
drivers/hid/hid-core.c
drivers/hid/hid-input.c
drivers/hid/hid-multitouch.c
drivers/hid/hid-rmi.c
drivers/hid/usbhid/hid-core.c
drivers/hid/wacom_sys.c
drivers/staging/greybus/hid.c
include/linux/hid.h
> {
> /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */
> return ((report->size - 1) >> 3) + 1 + (report->id > 0);
> }
>
> -int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,
> +int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
> int interrupt);
>
> /* HID quirks API */
> --
> 2.14.3
Best regards
Marcus Folkesson
>
Attachment:
signature.asc
Description: PGP signature
