Closed GustavoARSilva closed 1 year ago
Replace one-element arrays with flexible-array members in drivers/hid/hid-hyperv.c:
54 /* 55 * Basic message structures. 56 */ 57 struct synthhid_msg_hdr { 58 enum synthhid_msg_type type; 59 u32 size; 60 }; 61 62 struct synthhid_msg { 63 struct synthhid_msg_hdr header; 64 char data[1]; /* Enclosed message */ 65 }; 66 100 struct synthhid_input_report { 101 struct synthhid_msg_hdr header; 102 char buffer[1]; 103 }; 118 struct pipe_prt_msg { 119 enum pipe_prot_msg_type type; 120 u32 size; 121 char data[1]; 122 };
Audit (at least) all these places where the flex arrays are being used:
diff -u -p ./drivers/hid/hid-hyperv.c /tmp/nothing/drivers/hid/hid-hyperv.c --- ./drivers/hid/hid-hyperv.c +++ /tmp/nothing/drivers/hid/hid-hyperv.c @@ -262,7 +262,6 @@ static void mousevsc_on_receive(struct h if (pipe_msg->type != PIPE_MESSAGE_DATA) return; - hid_msg = (struct synthhid_msg *)pipe_msg->data; switch (hid_msg->header.type) { case SYNTH_HID_PROTOCOL_RESPONSE: @@ -292,17 +291,14 @@ static void mousevsc_on_receive(struct h * hid desc and report desc */ mousevsc_on_receive_device_info(input_dev, - (struct synthhid_device_info *)pipe_msg->data); break; case SYNTH_HID_INPUT_REPORT: input_report = - (struct synthhid_input_report *)pipe_msg->data; if (!input_dev->init_complete) break; len = min(input_report->header.size, (u32)sizeof(input_dev->input_buf)); - memcpy(input_dev->input_buf, input_report->buffer, len); hid_input_report(input_dev->hid_device, HID_INPUT_REPORT, input_dev->input_buf, len, 1);
That one seems to have no owner for now. @GustavoARSilva Could you assign that one to me please?
Done. Thanks! :)
Patch sent: https://lore.kernel.org/lkml/Y00JenqCzKRrcTiF@mail.google.com/T/#u
Patch was merged. You may close this one @GustavoARSilva
Replace one-element arrays with flexible-array members in drivers/hid/hid-hyperv.c:
Audit (at least) all these places where the flex arrays are being used: