Eric Lee / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 844580ff63ef4eb19eec4cfd8cd6e0b62d81279f

Authored by Nestor Lopez Casado
Committed by Jiri Kosina
1 parent 534a7b8e10
Exists in master and in 38 other branches 8mp-imx_5.4.70_2.3.0, 8qm-imx_5.4.70_2.3.0, emb_imx_lf-5.15.y, emb_lf-6.1.y, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, imx_4.1.15_1.0.0_ga, pitx_8mp_lf-5.10.y, rt-smarc-imx_4.1.15_1.0.0_ga, rt_linux_5.15.71, smarc-8m-android-11.0.0_2.0.0, smarc-imx6_4.14.98_2.0.0_ga, smarc-imx6_4.9.88_2.0.0_ga, smarc-imx7_4.14.98_2.0.0_ga, smarc-imx7_4.9.11_1.0.0_ga, smarc-imx7_4.9.88_2.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-imx_4.1.15_1.0.0_ga, smarc-imx_4.9.11_1.0.0_ga, smarc-imx_4.9.51_imx8m_ga, smarc-imx_4.9.88_2.0.0_ga, smarc-m6.0.1_2.1.0-ga, smarc-n7.1.2_2.0.0-ga, smarc-rel_imx_4.1.15_1.2.0_ga, smarc_8m_00d0_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.14.78_1.0.0_ga, smarc_8m_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.19.35_1.1.0, smarc_8mm_imx_4.14.78_1.0.0_ga, smarc_8mm_imx_4.14.98_2.0.0_ga, smarc_8mm_imx_4.19.35_1.1.0, smarc_8mm_imx_5.4.24_2.1.0, smarc_8mp_lf-5.10.y, smarc_8mq_imx_5.4.24_2.1.0, smarc_8mq_lf-5.10.y, smarc_imx_lf-5.15.y

HID: hid-logitech-dj: fix off by one 

There is a bug where a device with index 6 would write out of bounds in
the array of paired devices.
This patch fixes that problem.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: Olivier Gay <ogay@logitech.com>
Signed-off-by: Nestor Lopez Casado <nlopezcasad@logitech.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Showing 2 changed files with 5 additions and 5 deletions Side-by-side Diff

drivers/hid/hid-logitech-dj.c
Diff comments   View file @ 844580f
... ... @@ -179,9 +179,6 @@
179 179  
180 180 #define LOGITECH_DJ_INTERFACE_NUMBER 0x02
181 181  
182   -#define DJ_DEVICE_INDEX_MIN 1
183   -#define DJ_DEVICE_INDEX_MAX 6
184   -
185 182 static struct hid_ll_driver logi_dj_ll_driver;
186 183  
187 184 static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
... ... @@ -823,7 +820,7 @@
823 820 * have finished and no more raw_event callbacks should arrive after
824 821 * the remove callback was triggered so no locks are put around the
825 822 * code below */
826   - for (i = 0; i < DJ_MAX_PAIRED_DEVICES; i++) {
  823 + for (i = 0; i < (DJ_MAX_PAIRED_DEVICES + DJ_DEVICE_INDEX_MIN); i++) {
827 824 dj_dev = djrcv_dev->paired_dj_devices[i];
828 825 if (dj_dev != NULL) {
829 826 hid_destroy_device(dj_dev->hdev);
drivers/hid/hid-logitech-dj.h
Diff comments   View file @ 844580f
... ... @@ -27,6 +27,8 @@
27 27  
28 28 #define DJ_MAX_PAIRED_DEVICES 6
29 29 #define DJ_MAX_NUMBER_NOTIFICATIONS 8
  30 +#define DJ_DEVICE_INDEX_MIN 1
  31 +#define DJ_DEVICE_INDEX_MAX 6
30 32  
31 33 #define DJREPORT_SHORT_LENGTH 15
32 34 #define DJREPORT_LONG_LENGTH 32
... ... @@ -94,7 +96,8 @@
94 96  
95 97 struct dj_receiver_dev {
96 98 struct hid_device *hdev;
97   - struct dj_device *paired_dj_devices[DJ_MAX_PAIRED_DEVICES];
  99 + struct dj_device *paired_dj_devices[DJ_MAX_PAIRED_DEVICES +
  100 + DJ_DEVICE_INDEX_MIN];
98 101 struct work_struct work;
99 102 struct kfifo notif_fifo;
100 103 spinlock_t lock;