1 files changed, 19 insertions, 0 deletions

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 157c62775053..b403fe2c5cbe 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -427,6 +427,7 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item)
 {
         __u32 data;
         unsigned n;
+        __u32 count;
 
         data = item_udata(item);
 
@@ -490,6 +491,24 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item)
                 if (item->size <= 2)
                         data = (parser->global.usage_page << 16) + data;
 
+                count = data - parser->local.usage_minimum;
+                if (count + parser->local.usage_index >= HID_MAX_USAGES) {
+                        /*
+                         * We do not warn if the name is not set, we are
+                         * actually pre-scanning the device.
+                         */
+                        if (dev_name(&parser->device->dev))
+                                hid_warn(parser->device,
+                                         "ignoring exceeding usage max\n");
+                        data = HID_MAX_USAGES - parser->local.usage_index +
+                                parser->local.usage_minimum - 1;
+                        if (data <= 0) {
+                                hid_err(parser->device,
+                                        "no more usage index available\n");
+                                return -1;
+                        }
+                }
+
                 for (n = parser->local.usage_minimum; n <= data; n++)
                         if (hid_add_usage(parser, n)) {
                                 dbg_hid("hid_add_usage failed\n");