linux-kernel - [PATCH] HID: alps: pass correct sizes to hid_hw_raw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <alpine.LNX.2.00.1606201122090.6874@cbobk.fhfr.pm>
Date:	Mon, 20 Jun 2016 11:24:12 +0200 (CEST)
From:	Jiri Kosina <jikos@...nel.org>
To:	Masaki Ota <masaki.ota@...alps.com>
cc:	linux-kernel@...r.kernel.org, linux-input@...r.kernel.org,
	kbuild test robot <fengguang.wu@...el.com>
Subject: [PATCH] HID: alps: pass correct sizes to hid_hw_raw_request()

From: Jiri Kosina <jkosina@...e.cz>

Calculating size of the report as sizeof(pointer) always passess the 
length corresponding to the pointer type, not the underlying data report.

Reported-by: kbuild test robot <fengguang.wu@...el.com>
Signed-off-by: Jiri Kosina <jkosina@...e.cz>
---
 drivers/hid/hid-alps.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
index 098bce6..ff64c929 100644
--- a/drivers/hid/hid-alps.c
+++ b/drivers/hid/hid-alps.c
@@ -136,7 +136,8 @@ static int u1_read_write_register(struct hid_device *hdev, u32 address,
 
 	input[7] = check_sum;
 	ret = hid_hw_raw_request(hdev, U1_FEATURE_REPORT_ID, input,
-			sizeof(input), HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+			sizeof(u8)*U1_FEATURE_REPORT_LEN, HID_FEATURE_REPORT,
+			HID_REQ_SET_REPORT);
 
 	if (ret < 0) {
 		dev_err(&hdev->dev, "failed to read command (%d)\n", ret);
@@ -145,8 +146,8 @@ static int u1_read_write_register(struct hid_device *hdev, u32 address,
 
 	if (read_flag) {
 		ret = hid_hw_raw_request(hdev, U1_FEATURE_REPORT_ID, readbuf,
-				sizeof(readbuf), HID_FEATURE_REPORT,
-				HID_REQ_GET_REPORT);
+				sizeof(u8)*U1_FEATURE_REPORT_LEN,
+				HID_FEATURE_REPORT, HID_REQ_GET_REPORT);
 
 		if (ret < 0) {
 			dev_err(&hdev->dev, "failed read register (%d)\n", ret);
-- 
Jiri Kosina
SUSE Labs