diff options
| -rw-r--r-- | drivers/hid/hid-hyperv.c | 31 |
1 files changed, 10 insertions, 21 deletions
diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c index ab57b49a44ed..cf12f17e6533 100644 --- a/drivers/hid/hid-hyperv.c +++ b/drivers/hid/hid-hyperv.c @@ -22,9 +22,6 @@ struct hv_input_dev_info { unsigned short reserved[11]; }; -/* The maximum size of a synthetic input message. */ -#define SYNTHHID_MAX_INPUT_REPORT_SIZE 16 - /* * Current version * @@ -59,11 +56,6 @@ struct synthhid_msg_hdr { u32 size; }; -struct synthhid_msg { - struct synthhid_msg_hdr header; - char data[1]; /* Enclosed message */ -}; - union synthhid_version { struct { u16 minor_version; @@ -99,7 +91,7 @@ struct synthhid_device_info_ack { struct synthhid_input_report { struct synthhid_msg_hdr header; - char buffer[1]; + char buffer[]; }; #pragma pack(pop) @@ -118,7 +110,7 @@ enum pipe_prot_msg_type { struct pipe_prt_msg { enum pipe_prot_msg_type type; u32 size; - char data[1]; + char data[]; }; struct mousevsc_prt_msg { @@ -232,7 +224,7 @@ static void mousevsc_on_receive_device_info(struct mousevsc_dev *input_device, ret = vmbus_sendpacket(input_device->device->channel, &ack, - sizeof(struct pipe_prt_msg) - sizeof(unsigned char) + + sizeof(struct pipe_prt_msg) + sizeof(struct synthhid_device_info_ack), (unsigned long)&ack, VM_PKT_DATA_INBAND, @@ -251,7 +243,7 @@ static void mousevsc_on_receive(struct hv_device *device, struct vmpacket_descriptor *packet) { struct pipe_prt_msg *pipe_msg; - struct synthhid_msg *hid_msg; + struct synthhid_msg_hdr *hid_msg_hdr; struct mousevsc_dev *input_dev = hv_get_drvdata(device); struct synthhid_input_report *input_report; size_t len; @@ -262,25 +254,23 @@ static void mousevsc_on_receive(struct hv_device *device, if (pipe_msg->type != PIPE_MESSAGE_DATA) return; - hid_msg = (struct synthhid_msg *)pipe_msg->data; + hid_msg_hdr = (struct synthhid_msg_hdr *)pipe_msg->data; - switch (hid_msg->header.type) { + switch (hid_msg_hdr->type) { case SYNTH_HID_PROTOCOL_RESPONSE: /* * While it will be impossible for us to protect against * malicious/buggy hypervisor/host, add a check here to * ensure we don't corrupt memory. */ - if ((pipe_msg->size + sizeof(struct pipe_prt_msg) - - sizeof(unsigned char)) + if (struct_size(pipe_msg, data, pipe_msg->size) > sizeof(struct mousevsc_prt_msg)) { WARN_ON(1); break; } memcpy(&input_dev->protocol_resp, pipe_msg, - pipe_msg->size + sizeof(struct pipe_prt_msg) - - sizeof(unsigned char)); + struct_size(pipe_msg, data, pipe_msg->size)); complete(&input_dev->wait_event); break; @@ -311,7 +301,7 @@ static void mousevsc_on_receive(struct hv_device *device, break; default: pr_err("unsupported hid msg type - type %d len %d\n", - hid_msg->header.type, hid_msg->header.size); + hid_msg_hdr->type, hid_msg_hdr->size); break; } @@ -359,8 +349,7 @@ static int mousevsc_connect_to_vsp(struct hv_device *device) request->request.version_requested.version = SYNTHHID_INPUT_VERSION; ret = vmbus_sendpacket(device->channel, request, - sizeof(struct pipe_prt_msg) - - sizeof(unsigned char) + + sizeof(struct pipe_prt_msg) + sizeof(struct synthhid_protocol_request), (unsigned long)request, VM_PKT_DATA_INBAND, |