diff options
| author | Jason Gunthorpe <jgg@mellanox.com> | 2018-12-11 14:24:57 -0700 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@mellanox.com> | 2018-12-11 14:24:57 -0700 |
| commit | 28ab1bb0e8f031dd7dd3462ff8f6b2e93fc77e7f (patch) | |
| tree | 3c0d2177d9bfc513c2d06c1efb5ab62c74fd1953 /drivers/hid/usbhid/hiddev.c | |
| parent | b874155a5fa450bf5e4b5303cbfff05958805bf8 (diff) | |
| parent | 40e020c129cfc991e8ab4736d2665351ffd1468d (diff) | |
Merge tag 'v4.20-rc6' into rdma.git for-next
For dependencies in following patches.
Diffstat (limited to 'drivers/hid/usbhid/hiddev.c')
| -rw-r--r-- | drivers/hid/usbhid/hiddev.c | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c index 23872d08308c..a746017fac17 100644 --- a/drivers/hid/usbhid/hiddev.c +++ b/drivers/hid/usbhid/hiddev.c @@ -512,14 +512,24 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, if (cmd == HIDIOCGCOLLECTIONINDEX) { if (uref->usage_index >= field->maxusage) goto inval; + uref->usage_index = + array_index_nospec(uref->usage_index, + field->maxusage); } else if (uref->usage_index >= field->report_count) goto inval; } - if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) && - (uref_multi->num_values > HID_MAX_MULTI_USAGES || - uref->usage_index + uref_multi->num_values > field->report_count)) - goto inval; + if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) { + if (uref_multi->num_values > HID_MAX_MULTI_USAGES || + uref->usage_index + uref_multi->num_values > + field->report_count) + goto inval; + + uref->usage_index = + array_index_nospec(uref->usage_index, + field->report_count - + uref_multi->num_values); + } switch (cmd) { case HIDIOCGUSAGE: |