evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "HID: core: prevent out-of-bound readings"

Browse source
This commit is contained in:
Linux Build Service Account 2016-11-24 06:13:24 -08:00 • committed by Gerrit - the friendly Code Review server
commit a2f553518d
2 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
drivers/hid/hid-core.c
View file

@ -1251,6 +1251,7 @@ static void hid_input_field(struct hid_device *hid, struct hid_field *field,
/* Ignore report if ErrorRollOver */ /* Ignore report if ErrorRollOver */
if (!(field->flags & HID_MAIN_ITEM_VARIABLE) && if (!(field->flags & HID_MAIN_ITEM_VARIABLE) &&
value[n] >= min && value[n] <= max && value[n] >= min && value[n] <= max &&
value[n] - min < field->maxusage &&
field->usage[value[n] - min].hid == HID_UP_KEYBOARD + 1) field->usage[value[n] - min].hid == HID_UP_KEYBOARD + 1)
goto exit; goto exit;
} }
@ -1263,11 +1264,13 @@ static void hid_input_field(struct hid_device *hid, struct hid_field *field,
} }
if (field->value[n] >= min && field->value[n] <= max if (field->value[n] >= min && field->value[n] <= max
&& field->value[n] - min < field->maxusage
&& field->usage[field->value[n] - min].hid && field->usage[field->value[n] - min].hid
&& search(value, field->value[n], count)) && search(value, field->value[n], count))
hid_process_event(hid, field, &field->usage[field->value[n] - min], 0, interrupt); hid_process_event(hid, field, &field->usage[field->value[n] - min], 0, interrupt);
if (value[n] >= min && value[n] <= max if (value[n] >= min && value[n] <= max
&& value[n] - min < field->maxusage
&& field->usage[value[n] - min].hid && field->usage[value[n] - min].hid
&& search(field->value, value[n], count)) && search(field->value, value[n], count))
hid_process_event(hid, field, &field->usage[value[n] - min], 1, interrupt); hid_process_event(hid, field, &field->usage[value[n] - min], 1, interrupt);

7
drivers/tty/tty_ldisc.c
View file

@ -417,6 +417,10 @@ EXPORT_SYMBOL_GPL(tty_ldisc_flush);
* they are not on hot paths so a little discipline won't do * they are not on hot paths so a little discipline won't do
* any harm. * any harm.
* *
* The line discipline-related tty_struct fields are reset to
* prevent the ldisc driver from re-using stale information for
* the new ldisc instance.
*
* Locking: takes termios_rwsem * Locking: takes termios_rwsem
*/ */
@ -425,6 +429,9 @@ static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
down_write(&tty->termios_rwsem); down_write(&tty->termios_rwsem);
tty->termios.c_line = num; tty->termios.c_line = num;
up_write(&tty->termios_rwsem); up_write(&tty->termios_rwsem);
tty->disc_data = NULL;
tty->receive_room = 0;
} }
/** /**