Commit 2a039bf5 authored by Henrik Rydberg's avatar Henrik Rydberg Committed by Jiri Kosina
Browse files

HID: hid-logitech: Collect report descriptors before sending 



The current code allows several consecutive calls to hid_parse_report(),
which may have happened to work before, but would cause a memory leak
and generally be incorrect. This patch collects all the reports
before sending them once.

Cc: Nestor Lopez Casado <nlopezcasad@logitech.com>
Tested-by: default avatarBenjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: default avatarHenrik Rydberg <rydberg@euromail.se>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 07d9ab4f

drivers/hid/hid-logitech-dj.c

+29 −42
Original line number Diff line number Diff line
@@ -155,6 +155,14 @@ static const char media_descriptor[] = { 
/* Maximum size of all defined hid reports in bytes (including report id) */

#define MAX_REPORT_SIZE 8



/* Make sure all descriptors are present here */

#define MAX_RDESC_SIZE				\

	(sizeof(kbd_descriptor) +		\

	 sizeof(mse_descriptor) +		\

	 sizeof(consumer_descriptor) +		\

	 sizeof(syscontrol_descriptor) +	\

	 sizeof(media_descriptor))



/* Number of possible hid report types that can be created by this driver.

 *

 * Right now, RF report types have the same report types (or report id's)
@@ -473,9 +481,17 @@ static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf, 
	return 0;

}



static void rdcat(char **rdesc, unsigned int *rsize, const char *data, unsigned int size)

{

	memcpy(*rdesc + *rsize, data, size);

	*rsize += size;

}



static int logi_dj_ll_parse(struct hid_device *hid)

{

	struct dj_device *djdev = hid->driver_data;

	unsigned int rsize = 0;

	char *rdesc;

	int retval;



	dbg_hid("%s\n", __func__);
@@ -483,70 +499,38 @@ static int logi_dj_ll_parse(struct hid_device *hid) 
	djdev->hdev->version = 0x0111;

	djdev->hdev->country = 0x00;



	rdesc = kmalloc(MAX_RDESC_SIZE, GFP_KERNEL);

	if (!rdesc)

		return -ENOMEM;



	if (djdev->reports_supported & STD_KEYBOARD) {

		dbg_hid("%s: sending a kbd descriptor, reports_supported: %x\n",

			__func__, djdev->reports_supported);

		retval = hid_parse_report(hid,

					  (u8 *) kbd_descriptor,

					  sizeof(kbd_descriptor));

		if (retval) {

			dbg_hid("%s: sending a kbd descriptor, hid_parse failed"

				" error: %d\n", __func__, retval);

			return retval;

		}

		rdcat(&rdesc, &rsize, kbd_descriptor, sizeof(kbd_descriptor));

	}



	if (djdev->reports_supported & STD_MOUSE) {

		dbg_hid("%s: sending a mouse descriptor, reports_supported: "

			"%x\n", __func__, djdev->reports_supported);

		retval = hid_parse_report(hid,

					  (u8 *) mse_descriptor,

					  sizeof(mse_descriptor));

		if (retval) {

			dbg_hid("%s: sending a mouse descriptor, hid_parse "

				"failed error: %d\n", __func__, retval);

			return retval;

		}

		rdcat(&rdesc, &rsize, mse_descriptor, sizeof(mse_descriptor));

	}



	if (djdev->reports_supported & MULTIMEDIA) {

		dbg_hid("%s: sending a multimedia report descriptor: %x\n",

			__func__, djdev->reports_supported);

		retval = hid_parse_report(hid,

					  (u8 *) consumer_descriptor,

					  sizeof(consumer_descriptor));

		if (retval) {

			dbg_hid("%s: sending a consumer_descriptor, hid_parse "

				"failed error: %d\n", __func__, retval);

			return retval;

		}

		rdcat(&rdesc, &rsize, consumer_descriptor, sizeof(consumer_descriptor));

	}



	if (djdev->reports_supported & POWER_KEYS) {

		dbg_hid("%s: sending a power keys report descriptor: %x\n",

			__func__, djdev->reports_supported);

		retval = hid_parse_report(hid,

					  (u8 *) syscontrol_descriptor,

					  sizeof(syscontrol_descriptor));

		if (retval) {

			dbg_hid("%s: sending a syscontrol_descriptor, "

				"hid_parse failed error: %d\n",

				__func__, retval);

			return retval;

		}

		rdcat(&rdesc, &rsize, syscontrol_descriptor, sizeof(syscontrol_descriptor));

	}



	if (djdev->reports_supported & MEDIA_CENTER) {

		dbg_hid("%s: sending a media center report descriptor: %x\n",

			__func__, djdev->reports_supported);

		retval = hid_parse_report(hid,

					  (u8 *) media_descriptor,

					  sizeof(media_descriptor));

		if (retval) {

			dbg_hid("%s: sending a media_descriptor, hid_parse "

				"failed error: %d\n", __func__, retval);

			return retval;

		}

		rdcat(&rdesc, &rsize, media_descriptor, sizeof(media_descriptor));

	}



	if (djdev->reports_supported & KBD_LEDS) {
@@ -554,7 +538,10 @@ static int logi_dj_ll_parse(struct hid_device *hid) 
			__func__, djdev->reports_supported);

	}



	return 0;

	retval = hid_parse_report(hid, rdesc, rsize);

	kfree(rdesc);



	return retval;

}



static int logi_dj_ll_input_event(struct input_dev *dev, unsigned int type,

CRA Git | Maintained and supported by SUSTech CRA and CCSE