Patch "HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports" has been added to the 5.17-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports

to the 5.17-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     hid-i2c-hid-fix-get-set_report-for-unnumbered-report.patch
and it can be found in the queue-5.17 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit a4d333ed0b46338d6e9da2b65858f6e1fca4a380
Author: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
Date:   Mon Jan 17 23:26:18 2022 -0800

    HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
    
    [ Upstream commit a5e5e03e94764148a01757b2fa4737d3445c13a6 ]
    
    Internally kernel prepends all report buffers, for both numbered and
    unnumbered reports, with report ID, therefore to properly handle unnumbered
    reports we should prepend it ourselves.
    
    For the same reason we should skip the first byte of the buffer when
    calling i2c_hid_set_or_send_report() which then will take care of properly
    formatting the transfer buffer based on its separate report ID argument
    along with report payload.
    
    [jkosina@xxxxxxx: finalize trimmed sentence in changelog as spotted by Benjamin]
    Fixes: 9b5a9ae88573 ("HID: i2c-hid: implement ll_driver transport-layer callbacks")
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
    Tested-by: Benjamin Tissoires <benjamin.tissoires@xxxxxxxxxx>
    Signed-off-by: Jiri Kosina <jkosina@xxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 6726567d7297..8d6fc50dab65 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -618,6 +618,17 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
 	if (report_type == HID_OUTPUT_REPORT)
 		return -EINVAL;
 
+	/*
+	 * In case of unnumbered reports the response from the device will
+	 * not have the report ID that the upper layers expect, so we need
+	 * to stash it the buffer ourselves and adjust the data size.
+	 */
+	if (!report_number) {
+		buf[0] = 0;
+		buf++;
+		count--;
+	}
+
 	/* +2 bytes to include the size of the reply in the query buffer */
 	ask_count = min(count + 2, (size_t)ihid->bufsize);
 
@@ -639,6 +650,9 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
 	count = min(count, ret_count - 2);
 	memcpy(buf, ihid->rawbuf + 2, count);
 
+	if (!report_number)
+		count++;
+
 	return count;
 }
 
@@ -655,17 +669,19 @@ static int i2c_hid_output_raw_report(struct hid_device *hid, __u8 *buf,
 
 	mutex_lock(&ihid->reset_lock);
 
-	if (report_id) {
-		buf++;
-		count--;
-	}
-
+	/*
+	 * Note that both numbered and unnumbered reports passed here
+	 * are supposed to have report ID stored in the 1st byte of the
+	 * buffer, so we strip it off unconditionally before passing payload
+	 * to i2c_hid_set_or_send_report which takes care of encoding
+	 * everything properly.
+	 */
 	ret = i2c_hid_set_or_send_report(client,
 				report_type == HID_FEATURE_REPORT ? 0x03 : 0x02,
-				report_id, buf, count, use_data);
+				report_id, buf + 1, count - 1, use_data);
 
-	if (report_id && ret >= 0)
-		ret++; /* add report_id to the number of transfered bytes */
+	if (ret >= 0)
+		ret++; /* add report_id to the number of transferred bytes */
 
 	mutex_unlock(&ihid->reset_lock);