diff options
| author |   Aaron Ma <aaron.ma@canonical.com> | 2018-01-08 10:41:41 +0800 |
|---|---|---|
| committer |   Jiri Kosina <jkosina@suse.cz> | 2018-02-16 13:30:56 +0100 |
| commit | 6de0b13cc0b4ba10e98a9263d7a83b940720b77a (patch) | |
| tree | df6ee2f81950bfddbf9b3719692a9fcfa2f82275 /include/linux/hid.h | |
| parent | HID: i2c-hid: fix size check and type usage (diff) | |
| download | linux-dev-6de0b13cc0b4ba10e98a9263d7a83b940720b77a.tar.xz linux-dev-6de0b13cc0b4ba10e98a9263d7a83b940720b77a.zip | |
HID: core: Fix size as type u32
When size is negative, calling memset will make segment fault.
Declare the size as type u32 to keep memset safe.
size in struct hid_report is unsigned, fix return type of
hid_report_len to u32.
Cc: stable@vger.kernel.org
Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'include/linux/hid.h')
| -rw-r--r-- | include/linux/hid.h | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/include/linux/hid.h b/include/linux/hid.h index 091a81cf330f..0efe80b59156 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -851,7 +851,7 @@ extern int hidinput_connect(struct hid_device *hid, unsigned int force); extern void hidinput_disconnect(struct hid_device *); int hid_set_field(struct hid_field *, unsigned, __s32); -int hid_input_report(struct hid_device *, int type, u8 *, int, int); +int hid_input_report(struct hid_device *, int type, u8 *, u32, int); int hidinput_find_field(struct hid_device *hid, unsigned int type, unsigned int code, struct hid_field **field); struct hid_field *hidinput_get_led_field(struct hid_device *hid); unsigned int hidinput_count_leds(struct hid_device *hid); @@ -1102,13 +1102,13 @@ static inline void hid_hw_wait(struct hid_device *hdev) * * @report: the report we want to know the length */ -static inline int hid_report_len(struct hid_report *report) +static inline u32 hid_report_len(struct hid_report *report) { /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */ return ((report->size - 1) >> 3) + 1 + (report->id > 0); } -int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size, +int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, int interrupt); /* HID quirks API */ |