linux-kernel - [PATCH v2] i2c-hid: fix length for set/get report in i2c hid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed,  3 Apr 2013 05:45:21 -0700
From:	Huzefa Kankroliwala <huzefa.nomanx.kankroliwala@...el.com>
To:	jkosina@...e.cz
Cc:	benjamin.tissoires@...il.com, mika.westerberg@...el.com,
	linux-kernel@...r.kernel.org,
	Huzefa Kankroliwala <huzefa.nomanx.kankroliwala@...el.com>
Subject: [PATCH v2] i2c-hid: fix length for set/get report in i2c hid

With the current i2c hid driver set/get report does not work
as expected, for e.g sensor hub properties like power state,
frequency etc is not set properly on the device as a result
we do not get events.
The problem is that i2c hid driver in function i2c_hid_request
sets length equal to default buffer size for which the sensor
hub does not respond on get/set commands. Use report length
and calculate it based on report size and id.

Reviewed-by: Mika Westerberg <mika.westerberg@...ux.intel.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@...hat.com>
Signed-off-by: Huzefa Kankroliwala <huzefa.nomanx.kankroliwala@...el.com>
---
 drivers/hid/i2c-hid/i2c-hid.c |    9 ++++-----
 1 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 935f387..2b1799a 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -567,18 +567,17 @@ static void i2c_hid_request(struct hid_device *hid, struct hid_report *rep,
 		int reqtype)
 {
 	struct i2c_client *client = hid->driver_data;
-	struct i2c_hid *ihid = i2c_get_clientdata(client);
 	char *buf;
 	int ret;
+	int len = i2c_hid_get_report_length(rep) - 2;
 
-	buf = kzalloc(ihid->bufsize, GFP_KERNEL);
+	buf = kzalloc(len, GFP_KERNEL);
 	if (!buf)
 		return;
 
 	switch (reqtype) {
 	case HID_REQ_GET_REPORT:
-		ret = i2c_hid_get_raw_report(hid, rep->id, buf, ihid->bufsize,
-					     rep->type);
+		ret = i2c_hid_get_raw_report(hid, rep->id, buf, len, rep->type);
 		if (ret < 0)
 			dev_err(&client->dev, "%s: unable to get report: %d\n",
 				__func__, ret);
@@ -587,7 +586,7 @@ static void i2c_hid_request(struct hid_device *hid, struct hid_report *rep,
 		break;
 	case HID_REQ_SET_REPORT:
 		hid_output_report(rep, buf);
-		i2c_hid_output_raw_report(hid, buf, ihid->bufsize, rep->type);
+		i2c_hid_output_raw_report(hid, buf, len, rep->type);
 		break;
 	}
 
-- 
1.7.4.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/