1 files changed, 14 insertions, 10 deletions

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index b420f4a0fd28..d97f2323af57 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -192,6 +192,7 @@ static int hidinput_setkeycode(struct input_dev *dev,
         return -EINVAL;
 }
 
+
 /**
  * hidinput_calc_abs_res - calculate an absolute axis resolution
  * @field: the HID report field to calculate resolution for
@@ -234,23 +235,17 @@ __s32 hidinput_calc_abs_res(const struct hid_field *field, __u16 code)
         case ABS_MT_TOOL_Y:
         case ABS_MT_TOUCH_MAJOR:
         case ABS_MT_TOUCH_MINOR:
-                if (field->unit & 0xffffff00)           /* Not a length */
-                        return 0;
-                unit_exponent += hid_snto32(field->unit >> 4, 4) - 1;
-                switch (field->unit & 0xf) {
-                case 0x1:                               /* If centimeters */
+                if (field->unit == 0x11) {              /* If centimeters */
                         /* Convert to millimeters */
                         unit_exponent += 1;
-                        break;
-                case 0x3:                               /* If inches */
+                } else if (field->unit == 0x13) {       /* If inches */
                         /* Convert to millimeters */
                         prev = physical_extents;
                         physical_extents *= 254;
                         if (physical_extents < prev)
                                 return 0;
                         unit_exponent -= 1;
-                        break;
-                default:
+                } else {
                         return 0;
                 }
                 break;
@@ -485,6 +480,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
         if (field->flags & HID_MAIN_ITEM_CONSTANT)
                 goto ignore;
 
+        /* Ignore if report count is out of bounds. */
+        if (field->report_count < 1)
+                goto ignore;
+
         /* only LED usages are supported in output fields */
         if (field->report_type == HID_OUTPUT_REPORT &&
                         (usage->hid & HID_USAGE_PAGE) != HID_UP_LED) {
@@ -1236,7 +1235,11 @@ static void report_features(struct hid_device *hid)
 
         rep_enum = &hid->report_enum[HID_FEATURE_REPORT];
         list_for_each_entry(rep, &rep_enum->report_list, list)
-                for (i = 0; i < rep->maxfield; i++)
+                for (i = 0; i < rep->maxfield; i++) {
+                        /* Ignore if report count is out of bounds. */
+                        if (rep->field[i]->report_count < 1)
+                                continue;
+
                         for (j = 0; j < rep->field[i]->maxusage; j++) {
                                 /* Verify if Battery Strength feature is available */
                                 hidinput_setup_battery(hid, HID_FEATURE_REPORT, rep->field[i]);
@@ -1245,6 +1248,7 @@ static void report_features(struct hid_device *hid)
                                         drv->feature_mapping(hid, rep->field[i],
                                                              rep->field[i]->usage + j);
                         }
+                }
 }
 
 static struct hid_input *hidinput_allocate(struct hid_device *hid)