mirror of
https://github.com/torvalds/linux.git
synced 2026-10-16 12:50:02 +02:00
035ec4a71c
quickspi_hid_raw_request() receives the caller's buffer length in len, but
quickspi_get_report() never sees it and copies the whole device-supplied
response into buf regardless:
memcpy(buf, qsdev->report_buf, qsdev->report_len);
qsdev->report_len comes from the input report the touch controller returns,
while buf is sized to whatever the caller asked hidraw for through
HIDIOCGFEATURE or HIDIOCGINPUT. A response larger than that overflows buf
with device-controlled content.
The intel-quicki2c sibling already passes the caller length down to
quicki2c_get_report() and validates the response against it before the
copy. Do the same here.
Fixes: 4138f21115 ("HID: intel-thc-hid: intel-quickspi: Complete THC QuickSPI driver")
Suggested-by: Sashiko AI <sashiko-bot@kernel.org>
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Reviewed-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
26 lines
817 B
C
26 lines
817 B
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/* Copyright (c) 2024 Intel Corporation */
|
|
|
|
#ifndef _QUICKSPI_PROTOCOL_H_
|
|
#define _QUICKSPI_PROTOCOL_H_
|
|
|
|
#include <linux/hid-over-spi.h>
|
|
|
|
#define QUICKSPI_ACK_WAIT_TIMEOUT 5
|
|
|
|
struct quickspi_device;
|
|
|
|
void quickspi_handle_input_data(struct quickspi_device *qsdev, u32 buf_len);
|
|
int quickspi_get_report(struct quickspi_device *qsdev, u8 report_type,
|
|
unsigned int report_id, void *buf, u32 buf_len);
|
|
int quickspi_set_report(struct quickspi_device *qsdev, u8 report_type,
|
|
unsigned int report_id, void *buf, u32 buf_len);
|
|
int quickspi_get_report_descriptor(struct quickspi_device *qsdev);
|
|
|
|
int quickspi_set_power(struct quickspi_device *qsdev,
|
|
enum hidspi_power_state power_state);
|
|
|
|
int reset_tic(struct quickspi_device *qsdev);
|
|
|
|
#endif /* _QUICKSPI_PROTOCOL_H_ */
|