diff options
| author | Wolfram Sang <wsa+renesas@sang-engineering.com> | 2025-09-06 10:17:35 +0200 |
|---|---|---|
| committer | Wolfram Sang <wsa+renesas@sang-engineering.com> | 2025-09-06 10:17:35 +0200 |
| commit | d035b4baebfc5112b128b66cafd45d2522a9c8f1 (patch) | |
| tree | fc96e96e81597068c9a869c679d18a1a44394164 /drivers/hid/hid-mcp2221.c | |
| parent | Linux 6.17-rc3 (diff) | |
| parent | i2c: rtl9300: remove broken SMBus Quick operation support (diff) | |
| download | linux-d035b4baebfc5112b128b66cafd45d2522a9c8f1.tar.gz linux-d035b4baebfc5112b128b66cafd45d2522a9c8f1.zip | |
Merge tag 'i2c-host-fixes-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current
i2c-host-fixes for v6.17-rc5
- i801: fix device IDs
- in rtl9300:
- fix channel number check in probe
- check data length boundaries in xfer
- drop unsupported SMBus quick operation
Diffstat (limited to 'drivers/hid/hid-mcp2221.c')
| -rw-r--r-- | drivers/hid/hid-mcp2221.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c index 475ac352df30..33603b019f97 100644 --- a/drivers/hid/hid-mcp2221.c +++ b/drivers/hid/hid-mcp2221.c @@ -906,6 +906,10 @@ static int mcp2221_raw_event(struct hid_device *hdev, } if (data[2] == MCP2221_I2C_READ_COMPL || data[2] == MCP2221_I2C_READ_PARTIAL) { + if (!mcp->rxbuf || mcp->rxbuf_idx < 0 || data[3] > 60) { + mcp->status = -EINVAL; + break; + } buf = mcp->rxbuf; memcpy(&buf[mcp->rxbuf_idx], &data[4], data[3]); mcp->rxbuf_idx = mcp->rxbuf_idx + data[3]; |