aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/hid
diff options
context:
space:
mode:
authorJiri Kosina <jkosina@suse.cz>2007-10-15 09:17:41 -0400
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-10-15 11:12:00 -0400
commit57d292bd7e6e72898e533687af481603597b1ca7 (patch)
treed9594d10bfc843b44eb4ad1b32f945b000330f8c /drivers/hid
parent23fd50450a34f2558070ceabb0bfebc1c9604af5 (diff)
HID: fix HIDIOCGRDESC memory access in hidraw
Fix bogus copying of data into userspace when HIDIOCGRDESC is issued. HID-transport layer makes sure that dev->hid->rdesc is not larger than HID_MAX_DESCRIPTOR_SIZE. Noticed-by: Al Viro <viro@ftp.linux.org.uk> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/hid')
-rw-r--r--drivers/hid/hidraw.c12
1 files changed, 9 insertions, 3 deletions
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 8503197a8131..a702e2f6da7d 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -229,9 +229,15 @@ static int hidraw_ioctl(struct inode *inode, struct file *file, unsigned int cmd
229 229
230 if (get_user(len, (int __user *)arg)) 230 if (get_user(len, (int __user *)arg))
231 return -EFAULT; 231 return -EFAULT;
232 if (copy_to_user(*((__u8 **)(user_arg + 232
233 sizeof(__u32))), 233 if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
234 dev->hid->rdesc, len)) 234 return -EINVAL;
235
236 if (copy_to_user(user_arg + offsetof(
237 struct hidraw_report_descriptor,
238 value[0]),
239 dev->hid->rdesc,
240 min(dev->hid->rsize, len)))
235 return -EFAULT; 241 return -EFAULT;
236 return 0; 242 return 0;
237 } 243 }