Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland...

[linux-2.6-omap-h63xx.git] / drivers / hid / hidraw.c

diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 8503197a8131c1c1daf8f8b2d6fee2d2fa807a28..1ca6f4635eeb3e0474abada594892ac5683ce7ba 100644 (file)
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -113,13 +113,13 @@ static ssize_t hidraw_write(struct file *file, const char __user *buffer, size_t
 
        if (count > HID_MIN_BUFFER_SIZE) {
                printk(KERN_WARNING "hidraw: pid %d passed too large report\n",
-                               current->pid);
+                               task_pid_nr(current));
                return -EINVAL;
        }
 
        if (count < 2) {
                printk(KERN_WARNING "hidraw: pid %d passed too short report\n",
-                               current->pid);
+                               task_pid_nr(current));
                return -EINVAL;
        }
 
@@ -229,9 +229,15 @@ static int hidraw_ioctl(struct inode *inode, struct file *file, unsigned int cmd
 
                                if (get_user(len, (int __user *)arg))
                                        return -EFAULT;
-                               if (copy_to_user(*((__u8 **)(user_arg +
-                                                       sizeof(__u32))),
-                                                       dev->hid->rdesc, len))
+
+                               if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
+                                       return -EINVAL;
+
+                               if (copy_to_user(user_arg + offsetof(
+                                                               struct hidraw_report_descriptor,
+                                                               value[0]),
+                                                       dev->hid->rdesc,
+                                                       min(dev->hid->rsize, len)))
                                                return -EFAULT;
                                return 0;
                        }