Merge branch 'for-6.2/hyperv' into for-linus (91e9b021) · Commits · jan.koester / Linux

drivers/hid/hid-hyperv.c

+10 −21

Original line number	Original line	Diff line number	Diff line
	@@ -22,9 +22,6 @@ struct hv_input_dev_info {
	unsigned short reserved[11];		unsigned short reserved[11];
	};		};

	/* The maximum size of a synthetic input message. */
	#define SYNTHHID_MAX_INPUT_REPORT_SIZE 16

	/*		/*
	* Current version		* Current version
	*		*
	@@ -59,11 +56,6 @@ struct synthhid_msg_hdr {
	u32 size;		u32 size;
	};		};

	struct synthhid_msg {
	struct synthhid_msg_hdr header;
	char data[1]; /* Enclosed message */
	};

	union synthhid_version {		union synthhid_version {
	struct {		struct {
	u16 minor_version;		u16 minor_version;
	@@ -99,7 +91,7 @@ struct synthhid_device_info_ack {

	struct synthhid_input_report {		struct synthhid_input_report {
	struct synthhid_msg_hdr header;		struct synthhid_msg_hdr header;
	char buffer[1];		char buffer[];
	};		};

	#pragma pack(pop)		#pragma pack(pop)
	@@ -118,7 +110,7 @@ enum pipe_prot_msg_type {
	struct pipe_prt_msg {		struct pipe_prt_msg {
	enum pipe_prot_msg_type type;		enum pipe_prot_msg_type type;
	u32 size;		u32 size;
	char data[1];		char data[];
	};		};

	struct mousevsc_prt_msg {		struct mousevsc_prt_msg {
	@@ -232,7 +224,7 @@ static void mousevsc_on_receive_device_info(struct mousevsc_dev *input_device,

	ret = vmbus_sendpacket(input_device->device->channel,		ret = vmbus_sendpacket(input_device->device->channel,
	&ack,		&ack,
	sizeof(struct pipe_prt_msg) - sizeof(unsigned char) +		sizeof(struct pipe_prt_msg) +
	sizeof(struct synthhid_device_info_ack),		sizeof(struct synthhid_device_info_ack),
	(unsigned long)&ack,		(unsigned long)&ack,
	VM_PKT_DATA_INBAND,		VM_PKT_DATA_INBAND,
	@@ -251,7 +243,7 @@ static void mousevsc_on_receive(struct hv_device *device,
	struct vmpacket_descriptor *packet)		struct vmpacket_descriptor *packet)
	{		{
	struct pipe_prt_msg *pipe_msg;		struct pipe_prt_msg *pipe_msg;
	struct synthhid_msg *hid_msg;		struct synthhid_msg_hdr *hid_msg_hdr;
	struct mousevsc_dev *input_dev = hv_get_drvdata(device);		struct mousevsc_dev *input_dev = hv_get_drvdata(device);
	struct synthhid_input_report *input_report;		struct synthhid_input_report *input_report;
	size_t len;		size_t len;
	@@ -262,25 +254,23 @@ static void mousevsc_on_receive(struct hv_device *device,
	if (pipe_msg->type != PIPE_MESSAGE_DATA)		if (pipe_msg->type != PIPE_MESSAGE_DATA)
	return;		return;

	hid_msg = (struct synthhid_msg *)pipe_msg->data;		hid_msg_hdr = (struct synthhid_msg_hdr *)pipe_msg->data;

	switch (hid_msg->header.type) {		switch (hid_msg_hdr->type) {
	case SYNTH_HID_PROTOCOL_RESPONSE:		case SYNTH_HID_PROTOCOL_RESPONSE:
	/*		/*
	* While it will be impossible for us to protect against		* While it will be impossible for us to protect against
	* malicious/buggy hypervisor/host, add a check here to		* malicious/buggy hypervisor/host, add a check here to
	* ensure we don't corrupt memory.		* ensure we don't corrupt memory.
	*/		*/
	if ((pipe_msg->size + sizeof(struct pipe_prt_msg)		if (struct_size(pipe_msg, data, pipe_msg->size)
	- sizeof(unsigned char))
	> sizeof(struct mousevsc_prt_msg)) {		> sizeof(struct mousevsc_prt_msg)) {
	WARN_ON(1);		WARN_ON(1);
	break;		break;
	}		}

	memcpy(&input_dev->protocol_resp, pipe_msg,		memcpy(&input_dev->protocol_resp, pipe_msg,
	pipe_msg->size + sizeof(struct pipe_prt_msg) -		struct_size(pipe_msg, data, pipe_msg->size));
	sizeof(unsigned char));
	complete(&input_dev->wait_event);		complete(&input_dev->wait_event);
	break;		break;

	@@ -311,7 +301,7 @@ static void mousevsc_on_receive(struct hv_device *device,
	break;		break;
	default:		default:
	pr_err("unsupported hid msg type - type %d len %d\n",		pr_err("unsupported hid msg type - type %d len %d\n",
	hid_msg->header.type, hid_msg->header.size);		hid_msg_hdr->type, hid_msg_hdr->size);
	break;		break;
	}		}

	@@ -359,8 +349,7 @@ static int mousevsc_connect_to_vsp(struct hv_device *device)
	request->request.version_requested.version = SYNTHHID_INPUT_VERSION;		request->request.version_requested.version = SYNTHHID_INPUT_VERSION;

	ret = vmbus_sendpacket(device->channel, request,		ret = vmbus_sendpacket(device->channel, request,
	sizeof(struct pipe_prt_msg) -		sizeof(struct pipe_prt_msg) +
	sizeof(unsigned char) +
	sizeof(struct synthhid_protocol_request),		sizeof(struct synthhid_protocol_request),
	(unsigned long)request,		(unsigned long)request,
	VM_PKT_DATA_INBAND,		VM_PKT_DATA_INBAND,