diff options
| author | Jiri Kosina | 2007-10-15 15:17:41 +0200 |
|---|---|---|
| committer | Linus Torvalds | 2007-10-15 08:12:00 -0700 |
| commit | 57d292bd7e6e72898e533687af481603597b1ca7 (patch) | |
| tree | d9594d10bfc843b44eb4ad1b32f945b000330f8c /include | |
| parent | 23fd50450a34f2558070ceabb0bfebc1c9604af5 (diff) | |
HID: fix HIDIOCGRDESC memory access in hidraw
Fix bogus copying of data into userspace when HIDIOCGRDESC is issued.
HID-transport layer makes sure that dev->hid->rdesc is not larger than
HID_MAX_DESCRIPTOR_SIZE.
Noticed-by: Al Viro <viro@ftp.linux.org.uk>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/hid.h | 20 | ||||
| -rw-r--r-- | include/linux/hidraw.h | 6 |
2 files changed, 15 insertions, 11 deletions
diff --git a/include/linux/hid.h b/include/linux/hid.h index 55e51f9f76cb..edb8024d744b 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -29,13 +29,6 @@ * Vojtech Pavlik, Simunkova 1594, Prague 8, 182 00 Czech Republic */ -#include <linux/types.h> -#include <linux/slab.h> -#include <linux/list.h> -#include <linux/timer.h> -#include <linux/workqueue.h> -#include <linux/input.h> - /* * USB HID (Human Interface Device) interface class code */ @@ -69,6 +62,17 @@ #define HID_DT_REPORT (USB_TYPE_CLASS | 0x02) #define HID_DT_PHYSICAL (USB_TYPE_CLASS | 0x03) +#define HID_MAX_DESCRIPTOR_SIZE 4096 + +#ifdef __KERNEL__ + +#include <linux/types.h> +#include <linux/slab.h> +#include <linux/list.h> +#include <linux/timer.h> +#include <linux/workqueue.h> +#include <linux/input.h> + /* * We parse each description item into this structure. Short items data * values are expanded to 32-bit signed int, long items contain a pointer @@ -311,7 +315,6 @@ struct hid_global { * This is the local environment. It is persistent up the next main-item. */ -#define HID_MAX_DESCRIPTOR_SIZE 4096 #define HID_MAX_USAGES 8192 #define HID_DEFAULT_NUM_COLLECTIONS 16 @@ -560,4 +563,5 @@ static inline int hid_ff_init(struct hid_device *hid) { return -1; } #define err_hid(format, arg...) printk(KERN_ERR "%s: " format "\n" , \ __FILE__ , ## arg) #endif +#endif diff --git a/include/linux/hidraw.h b/include/linux/hidraw.h index 6676cd5e9954..0536f299f7ff 100644 --- a/include/linux/hidraw.h +++ b/include/linux/hidraw.h @@ -15,9 +15,11 @@ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA. */ +#include <linux/hid.h> + struct hidraw_report_descriptor { __u32 size; - __u8 *value; + __u8 value[HID_MAX_DESCRIPTOR_SIZE]; }; struct hidraw_devinfo { @@ -40,8 +42,6 @@ struct hidraw_devinfo { /* kernel-only API declarations */ #ifdef __KERNEL__ -#include <linux/hid.h> - struct hidraw { unsigned int minor; int exist; |