From: Dmitry Torokhov <dtor_core@ameritech.net>
To: Linus Torvalds <torvalds@osdl.org>
Cc: Vojtech Pavlik <vojtech@suse.cz>, linux-kernel@vger.kernel.org
Subject: [GIT PATCH 18/18] hiddev: fix off-by-one for num_values in uref_multi requests
Date: Tue, 31 Jan 2006 23:55:32 -0500 [thread overview]
Message-ID: <20060201050735.359475000.dtor_core@ameritech.net> (raw)
In-Reply-To: 20060201045514.178498000.dtor_core@ameritech.net
[-- Attachment #1: hiddev-fix-uref-multi-requests.patch --]
[-- Type: text/plain, Size: 1048 bytes --]
From: Ben Collins <bcollins@ubuntu.com>
Input: hiddev - fix off-by-one for num_values in uref_multi requests
Found this when working with a HAPP UGCI device. It has a usage with 7
indexes. I could read them all one at a time, but using a multiref it
would only allow me to read the first 6. The patch below fixed it.
Signed-off-by: Ben Collins <bcollins@ubuntu.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
---
drivers/usb/input/hiddev.c | 2 +-
1 files changed, 1 insertion(+), 1 deletion(-)
Index: work/drivers/usb/input/hiddev.c
===================================================================
--- work.orig/drivers/usb/input/hiddev.c
+++ work/drivers/usb/input/hiddev.c
@@ -631,7 +631,7 @@ static int hiddev_ioctl(struct inode *in
else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
(uref_multi->num_values > HID_MAX_MULTI_USAGES ||
- uref->usage_index + uref_multi->num_values >= field->report_count))
+ uref->usage_index + uref_multi->num_values > field->report_count))
goto inval;
}
prev parent reply other threads:[~2006-02-01 5:09 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-02-01 4:55 [GIT PATCH 00/18] Input updates for 2.6.16-rc1 Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 01/18] NSLU2 beeper driver Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 02/18] psmouse: set name for Genius mice Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 03/18] iforce: do not return ENOMEM upon successful allocation Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 04/18] mousedev: fix memory leak Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 05/18] Make needlessly global code static Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 06/18] grip: fix crash when accessing device Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 07/18] grip: handle errors from input_register_device() Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 08/18] db9: fix possible crash with Saturn gamepads Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 09/18] db9: handle errors from input_register_device() Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 10/18] sidewinder: fix an oops Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 11/18] sidewinder: handle errors from input_register_device() Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 12/18] gamecon: fix crash when accessing device Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 13/18] gamecon: handle errors from input_register_device() Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 14/18] turbografx: " Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 15/18] tmdc: " Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 16/18] a3d: convert to dynamic input_dev allocation Dmitry Torokhov
2006-02-01 4:55 ` [GIT PATCH 17/18] iforce - fix detection of USB devices Dmitry Torokhov
2006-02-01 4:55 ` Dmitry Torokhov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20060201050735.359475000.dtor_core@ameritech.net \
--to=dtor_core@ameritech.net \
--cc=linux-kernel@vger.kernel.org \
--cc=torvalds@osdl.org \
--cc=vojtech@suse.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.