HID: i2c-hid: Limit reads to wMaxInputLength bytes for input events
authorSeth Forshee <seth.forshee@canonical.com>
Fri, 20 Feb 2015 17:45:11 +0000 (11:45 -0600)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 6 Mar 2015 22:40:48 +0000 (14:40 -0800)
commitde13322c2802b274eaff42c6027ee32e0567b75a
tree89fa93bfde00296374a673435e4383fb1e7b3d6a
parent4313b9cb8964781bed89316a3c929f56b9651f9d
HID: i2c-hid: Limit reads to wMaxInputLength bytes for input events

commit 6d00f37e49d95e640a3937a4a1ae07dbe92a10cb upstream.

d1c7e29e8d27 (HID: i2c-hid: prevent buffer overflow in early IRQ)
changed hid_get_input() to read ihid->bufsize bytes, which can be
more than wMaxInputLength. This is the case with the Dell XPS 13
9343, and it is causing events to be missed. In some cases the
missed events are releases, which can cause the cursor to jump or
freeze, among other problems. Limit the number of bytes read to
min(wMaxInputLength, ihid->bufsize) to prevent such problems.

Fixes: d1c7e29e8d27 "HID: i2c-hid: prevent buffer overflow in early IRQ"
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/hid/i2c-hid/i2c-hid.c