summaryrefslogtreecommitdiffstats
path: root/kernel/drivers/hid/i2c-hid/i2c-hid.c
diff options
context:
space:
mode:
Diffstat (limited to 'kernel/drivers/hid/i2c-hid/i2c-hid.c')
-rw-r--r--kernel/drivers/hid/i2c-hid/i2c-hid.c16
1 files changed, 10 insertions, 6 deletions
diff --git a/kernel/drivers/hid/i2c-hid/i2c-hid.c b/kernel/drivers/hid/i2c-hid/i2c-hid.c
index 10bd8e6e4..0b80633ba 100644
--- a/kernel/drivers/hid/i2c-hid/i2c-hid.c
+++ b/kernel/drivers/hid/i2c-hid/i2c-hid.c
@@ -282,17 +282,21 @@ static int i2c_hid_set_or_send_report(struct i2c_client *client, u8 reportType,
u16 dataRegister = le16_to_cpu(ihid->hdesc.wDataRegister);
u16 outputRegister = le16_to_cpu(ihid->hdesc.wOutputRegister);
u16 maxOutputLength = le16_to_cpu(ihid->hdesc.wMaxOutputLength);
+ u16 size;
+ int args_len;
+ int index = 0;
+
+ i2c_hid_dbg(ihid, "%s\n", __func__);
+
+ if (data_len > ihid->bufsize)
+ return -EINVAL;
- /* hid_hw_* already checked that data_len < HID_MAX_BUFFER_SIZE */
- u16 size = 2 /* size */ +
+ size = 2 /* size */ +
(reportID ? 1 : 0) /* reportID */ +
data_len /* buf */;
- int args_len = (reportID >= 0x0F ? 1 : 0) /* optional third byte */ +
+ args_len = (reportID >= 0x0F ? 1 : 0) /* optional third byte */ +
2 /* dataRegister */ +
size /* args */;
- int index = 0;
-
- i2c_hid_dbg(ihid, "%s\n", __func__);
if (!use_data && maxOutputLength == 0)
return -ENOSYS;