hc
2024-12-19 9370bb92b2d16684ee45cf24e879c93c509162da
kernel/drivers/hid/hid-core.c
....@@ -32,6 +32,7 @@
3232 #include <linux/hiddev.h>
3333 #include <linux/hid-debug.h>
3434 #include <linux/hidraw.h>
35
+#include <linux/uhid.h>
3536
3637 #include "hid-ids.h"
3738
....@@ -258,6 +259,7 @@
258259 {
259260 struct hid_report *report;
260261 struct hid_field *field;
262
+ unsigned int max_buffer_size = HID_MAX_BUFFER_SIZE;
261263 unsigned int usages;
262264 unsigned int offset;
263265 unsigned int i;
....@@ -288,8 +290,11 @@
288290 offset = report->size;
289291 report->size += parser->global.report_size * parser->global.report_count;
290292
293
+ if (IS_ENABLED(CONFIG_UHID) && parser->device->ll_driver == &uhid_hid_driver)
294
+ max_buffer_size = UHID_DATA_MAX;
295
+
291296 /* Total size check: Allow for possible report index byte */
292
- if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) {
297
+ if (report->size > (max_buffer_size - 1) << 3) {
293298 hid_err(parser->device, "report is too long\n");
294299 return -1;
295300 }
....@@ -988,8 +993,8 @@
988993 * Validating on id 0 means we should examine the first
989994 * report in the list.
990995 */
991
- report = list_entry(
992
- hid->report_enum[type].report_list.next,
996
+ report = list_first_entry_or_null(
997
+ &hid->report_enum[type].report_list,
993998 struct hid_report, list);
994999 } else {
9951000 report = hid->report_enum[type].report_id_hash[id];
....@@ -1197,6 +1202,7 @@
11971202 __u8 *end;
11981203 __u8 *next;
11991204 int ret;
1205
+ int i;
12001206 static int (*dispatch_type[])(struct hid_parser *parser,
12011207 struct hid_item *item) = {
12021208 hid_parser_main,
....@@ -1247,6 +1253,8 @@
12471253 goto err;
12481254 }
12491255 device->collection_size = HID_DEFAULT_NUM_COLLECTIONS;
1256
+ for (i = 0; i < HID_DEFAULT_NUM_COLLECTIONS; i++)
1257
+ device->collection[i].parent_idx = -1;
12501258
12511259 ret = -EINVAL;
12521260 while ((next = fetch_item(start, end, &item)) != NULL) {
....@@ -1749,6 +1757,7 @@
17491757 struct hid_report_enum *report_enum = hid->report_enum + type;
17501758 struct hid_report *report;
17511759 struct hid_driver *hdrv;
1760
+ int max_buffer_size = HID_MAX_BUFFER_SIZE;
17521761 unsigned int a;
17531762 u32 rsize, csize = size;
17541763 u8 *cdata = data;
....@@ -1765,10 +1774,13 @@
17651774
17661775 rsize = hid_compute_report_size(report);
17671776
1768
- if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE)
1769
- rsize = HID_MAX_BUFFER_SIZE - 1;
1770
- else if (rsize > HID_MAX_BUFFER_SIZE)
1771
- rsize = HID_MAX_BUFFER_SIZE;
1777
+ if (IS_ENABLED(CONFIG_UHID) && hid->ll_driver == &uhid_hid_driver)
1778
+ max_buffer_size = UHID_DATA_MAX;
1779
+
1780
+ if (report_enum->numbered && rsize >= max_buffer_size)
1781
+ rsize = max_buffer_size - 1;
1782
+ else if (rsize > max_buffer_size)
1783
+ rsize = max_buffer_size;
17721784
17731785 if (csize < rsize) {
17741786 dbg_hid("report %d is too short, (%d < %d)\n", report->id,