HID: core: fix computation of the report size

The extra seven bits are only required when allocating the report buffer.
We can not use those extra bytes for the length of the report in the
generic implementation of .request because the device might (will) refuse
the set_report command.
This has been verified on the Atmel touchpad found on the Samsung Ativ 9
plus, which uses hid-multitouch and HID over I2C. Without this fix, the
device refuses to switch to the multitouch mode, and it becomes unresponsive
from the user point of view.

Actually, this has been discussed during the initial submission of the
commit 4fa5a7f76cc7b6ac87f57741edd2b124851d119f, see
https://patchwork.kernel.org/patch/3621751/

Unfortunately, I completely forgot about it later.

Reported-by: Matthias Bayer <thematthiasbayer@gmail.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

1 files changed, 3 insertions, 2 deletions

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 10a2c0866459..da52279de939 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1253,7 +1253,8 @@ EXPORT_SYMBOL_GPL(hid_output_report);
 
 static int hid_report_len(struct hid_report *report)
 {
-        return ((report->size - 1) >> 3) + 1 + (report->id > 0) + 7;
+        /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */
+        return ((report->size - 1) >> 3) + 1 + (report->id > 0);
 }
 
 /*
@@ -1266,7 +1267,7 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags)
          * of implement() working on 8 byte chunks
          */
 
-        int len = hid_report_len(report);
+        int len = hid_report_len(report) + 7;
 
         return kmalloc(len, flags);
 }