1 files changed, 31 insertions, 25 deletions

diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 486dbde2ba2d..9bf8637747a5 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -238,13 +238,6 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
                 return;
         }
 
-        if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
-            (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
-                dev_err(&djrcv_hdev->dev, "%s: invalid device index:%d\n",
-                        __func__, dj_report->device_index);
-                return;
-        }
-
         if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
                 /* The device is already known. No need to reallocate it. */
                 dbg_hid("%s: device is already known\n", __func__);
@@ -557,7 +550,7 @@ static int logi_dj_ll_raw_request(struct hid_device *hid,
         if (!out_buf)
                 return -ENOMEM;
 
-        if (count < DJREPORT_SHORT_LENGTH - 2)
+        if (count > DJREPORT_SHORT_LENGTH - 2)
                 count = DJREPORT_SHORT_LENGTH - 2;
 
         out_buf[0] = REPORT_ID_DJ_SHORT;
@@ -663,7 +656,6 @@ static int logi_dj_raw_event(struct hid_device *hdev,
         struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
         struct dj_report *dj_report = (struct dj_report *) data;
         unsigned long flags;
-        bool report_processed = false;
 
         dbg_hid("%s, size:%d\n", __func__, size);
 
@@ -691,27 +683,41 @@ static int logi_dj_raw_event(struct hid_device *hdev,
          * anything else with it.
          */
 
+        /* case 1) */
+        if (data[0] != REPORT_ID_DJ_SHORT)
+                return false;
+
+        if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
+            (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
+                /*
+                 * Device index is wrong, bail out.
+                 * This driver can ignore safely the receiver notifications,
+                 * so ignore those reports too.
+                 */
+                if (dj_report->device_index != DJ_RECEIVER_INDEX)
+                        dev_err(&hdev->dev, "%s: invalid device index:%d\n",
+                                __func__, dj_report->device_index);
+                return false;
+        }
+
         spin_lock_irqsave(&djrcv_dev->lock, flags);
-        if (dj_report->report_id == REPORT_ID_DJ_SHORT) {
-                switch (dj_report->report_type) {
-                case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
-                case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
-                        logi_dj_recv_queue_notification(djrcv_dev, dj_report);
-                        break;
-                case REPORT_TYPE_NOTIF_CONNECTION_STATUS:
-                        if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] ==
-                            STATUS_LINKLOSS) {
-                                logi_dj_recv_forward_null_report(djrcv_dev, dj_report);
-                        }
-                        break;
-                default:
-                        logi_dj_recv_forward_report(djrcv_dev, dj_report);
+        switch (dj_report->report_type) {
+        case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
+        case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
+                logi_dj_recv_queue_notification(djrcv_dev, dj_report);
+                break;
+        case REPORT_TYPE_NOTIF_CONNECTION_STATUS:
+                if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] ==
+                    STATUS_LINKLOSS) {
+                        logi_dj_recv_forward_null_report(djrcv_dev, dj_report);
                 }
-                report_processed = true;
+                break;
+        default:
+                logi_dj_recv_forward_report(djrcv_dev, dj_report);
         }
         spin_unlock_irqrestore(&djrcv_dev->lock, flags);
 
-        return report_processed;
+        return true;
 }
 
 static int logi_dj_probe(struct hid_device *hdev,