| Message ID | 20150729101606.GA12100@mwanda (mailing list archive) |
|---|---|
| State | New, archived |
| Delegated to: | Jiri Kosina |
| Headers | show |
On 07/29/2015 01:16 PM, Dan Carpenter wrote: > The limit should be ARRAY_SIZE(params) (5 elements) here instead of > sizeof(params) (20 bytes). > > Fixes: 08177f40bd00 ('HID: uclogic: merge hid-huion driver in hid-uclogic') > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > diff --git a/drivers/hid/hid-uclogic.c b/drivers/hid/hid-uclogic.c > index 9416731..b905d50 100644 > --- a/drivers/hid/hid-uclogic.c > +++ b/drivers/hid/hid-uclogic.c > @@ -858,7 +858,7 @@ static int uclogic_tablet_enable(struct hid_device *hdev) > for (p = drvdata->rdesc; > p <= drvdata->rdesc + drvdata->rsize - 4;) { > if (p[0] == 0xFE && p[1] == 0xED && p[2] == 0x1D && > - p[3] < sizeof(params)) { > + p[3] < ARRAY_SIZE(params)) { > v = params[p[3]]; > put_unaligned(cpu_to_le32(v), (s32 *)p); > p += 4; Argh, that's embarrassing. Thanks, Dan! Reviewed-by: Nikolai Kondrashov <spbnick@gmail.com> Nick -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Wed, 29 Jul 2015, Nikolai Kondrashov wrote: > On 07/29/2015 01:16 PM, Dan Carpenter wrote: > > The limit should be ARRAY_SIZE(params) (5 elements) here instead of > > sizeof(params) (20 bytes). > > > > Fixes: 08177f40bd00 ('HID: uclogic: merge hid-huion driver in hid-uclogic') > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > > > diff --git a/drivers/hid/hid-uclogic.c b/drivers/hid/hid-uclogic.c > > index 9416731..b905d50 100644 > > --- a/drivers/hid/hid-uclogic.c > > +++ b/drivers/hid/hid-uclogic.c > > @@ -858,7 +858,7 @@ static int uclogic_tablet_enable(struct hid_device > > *hdev) > > for (p = drvdata->rdesc; > > p <= drvdata->rdesc + drvdata->rsize - 4;) { > > if (p[0] == 0xFE && p[1] == 0xED && p[2] == 0x1D && > > - p[3] < sizeof(params)) { > > + p[3] < ARRAY_SIZE(params)) { > > v = params[p[3]]; > > put_unaligned(cpu_to_le32(v), (s32 *)p); > > p += 4; > > Argh, that's embarrassing. Thanks, Dan! Good catch Dan, thanks. Applied to for-4.2/upstream-fixes.
diff --git a/drivers/hid/hid-uclogic.c b/drivers/hid/hid-uclogic.c index 9416731..b905d50 100644 --- a/drivers/hid/hid-uclogic.c +++ b/drivers/hid/hid-uclogic.c @@ -858,7 +858,7 @@ static int uclogic_tablet_enable(struct hid_device *hdev) for (p = drvdata->rdesc; p <= drvdata->rdesc + drvdata->rsize - 4;) { if (p[0] == 0xFE && p[1] == 0xED && p[2] == 0x1D && - p[3] < sizeof(params)) { + p[3] < ARRAY_SIZE(params)) { v = params[p[3]]; put_unaligned(cpu_to_le32(v), (s32 *)p); p += 4;
The limit should be ARRAY_SIZE(params) (5 elements) here instead of sizeof(params) (20 bytes). Fixes: 08177f40bd00 ('HID: uclogic: merge hid-huion driver in hid-uclogic') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html