samsung_sm8750/android_kernel_samsung_sm8750
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HID: core: ensure the allocated report buffer can contain the reserved report ID

Browse Source 
commit 4f15ee98304b96e164ff2340e1dfd6181c3f42aa upstream.

When the report ID is not used, the low level transport drivers expect
the first byte to be 0. However, currently the allocated buffer not
account for that extra byte, meaning that instead of having 8 guaranteed
bytes for implement to be working, we only have 7.

Reported-by: Alan Stern <stern@rowland.harvard.edu>
Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/
Cc: stable@vger.kernel.org
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20250710-report-size-null-v2-1-ccf922b7c4e5@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Benjamin Tissoires
2025-07-10 16:01:33 +02:00
committed by Greg Kroah-Hartman
parent 469a39a33a
commit fcda39a9c5
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/hid/hid-core.c
View File

@@ -1873,9 +1873,12 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags)
/* /*
* 7 extra bytes are necessary to achieve proper functionality * 7 extra bytes are necessary to achieve proper functionality
* of implement() working on 8 byte chunks * of implement() working on 8 byte chunks
* 1 extra byte for the report ID if it is null (not used) so
* we can reserve that extra byte in the first position of the buffer
* when sending it to .raw_request()
*/ */
u32 len = hid_report_len(report) + 7; u32 len = hid_report_len(report) + 7 + (report->id == 0);
return kzalloc(len, flags); return kzalloc(len, flags);
} }