diff options
| author | Ingo Molnar <mingo@kernel.org> | 2020-02-24 13:36:09 +0300 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2020-02-24 13:36:09 +0300 |
| commit | 546121b65f47384e11ec1fa2e55449fc9f4846b2 (patch) | |
| tree | 8f18470ec7c0c77b0f48eb1b2338e591b0b0aaff /drivers/hid/hid-core.c | |
| parent | 000619680c3714020ce9db17eef6a4a7ce2dc28b (diff) | |
| parent | f8788d86ab28f61f7b46eb6be375f8a726783636 (diff) | |
| download | linux-546121b65f47384e11ec1fa2e55449fc9f4846b2.tar.xz | |
Merge tag 'v5.6-rc3' into sched/core, to pick up fixes and dependent patches
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'drivers/hid/hid-core.c')
| -rw-r--r-- | drivers/hid/hid-core.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index e0b241bd3070..851fe54ea59e 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -288,6 +288,12 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign offset = report->size; report->size += parser->global.report_size * parser->global.report_count; + /* Total size check: Allow for possible report index byte */ + if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) { + hid_err(parser->device, "report is too long\n"); + return -1; + } + if (!parser->local.usage_index) /* Ignore padding fields */ return 0; |