tpm_tis: fix potential buffer overruns caused by bit glitches on the bus

[pandora-kernel.git] / drivers / hid / hid-sony.c

diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 963bda1..4142c21 100644 (file)
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -44,9 +44,19 @@ static __u8 *sony_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 {
        struct sony_sc *sc = hid_get_drvdata(hdev);
 
-       if ((sc->quirks & VAIO_RDESC_CONSTANT) &&
-                       *rsize >= 56 && rdesc[54] == 0x81 && rdesc[55] == 0x07) {
+       /*
+        * Some Sony RF receivers wrongly declare the mouse pointer as a
+        * a constant non-data variable.
+        */
+       if ((sc->quirks & VAIO_RDESC_CONSTANT) && *rsize >= 56 &&
+           /* usage page: generic desktop controls */
+           /* rdesc[0] == 0x05 && rdesc[1] == 0x01 && */
+           /* usage: mouse */
+           rdesc[2] == 0x09 && rdesc[3] == 0x02 &&
+           /* input (usage page for x,y axes): constant, variable, relative */
+           rdesc[54] == 0x81 && rdesc[55] == 0x07) {
                hid_info(hdev, "Fixing up Sony RF Receiver report descriptor\n");
+               /* input: data, variable, relative */
                rdesc[55] = 0x06;
        }