Thread (3 messages) 3 messages, 1 author, 2011-04-28

BUG: hid_report_raw_event() crash

From: Armando Visconti <hidden>
Date: 2011-04-28 09:17:12

Hello,

I'm using a particular multi touch screen module, which is the
TP 72055 from Data Modul. They have tested it only for Win7.

Using it I have found a crash in hid_report_raw_event() on kernel
2.6.37, but I believe is there also in latest one.

Debugging the issue it seems that it is caused by the fact that
TP72055 module issues a hid report with a size equals to 0. The rsize
value gets set to 536870912 and Linux is crashing in the memset because 
the value is too big.

I think a proper checking on rsize must be made to avoid cases like that.
I'm attaching the simple patch I made.

Pls let me know if the fix makes sense or not.

THx,
Arm

Attachments

Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help