1 files changed, 14 insertions, 4 deletions

diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 23872d08308c..a746017fac17 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -512,14 +512,24 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
                         if (cmd == HIDIOCGCOLLECTIONINDEX) {
                                 if (uref->usage_index >= field->maxusage)
                                         goto inval;
+                                uref->usage_index =
+                                        array_index_nospec(uref->usage_index,
+                                                           field->maxusage);
                         } else if (uref->usage_index >= field->report_count)
                                 goto inval;
                 }
 
-                if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
-                    (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
-                     uref->usage_index + uref_multi->num_values > field->report_count))
-                        goto inval;
+                if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
+                        if (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
+                            uref->usage_index + uref_multi->num_values >
+                            field->report_count)
+                                goto inval;
+
+                        uref->usage_index =
+                                array_index_nospec(uref->usage_index,
+                                                   field->report_count -
+                                                   uref_multi->num_values);
+                }
 
                 switch (cmd) {
                 case HIDIOCGUSAGE: