Loading drivers/hid/hid-hyperv.c +10 −21 Original line number Diff line number Diff line Loading @@ -22,9 +22,6 @@ struct hv_input_dev_info { unsigned short reserved[11]; }; /* The maximum size of a synthetic input message. */ #define SYNTHHID_MAX_INPUT_REPORT_SIZE 16 /* * Current version * Loading Loading @@ -59,11 +56,6 @@ struct synthhid_msg_hdr { u32 size; }; struct synthhid_msg { struct synthhid_msg_hdr header; char data[1]; /* Enclosed message */ }; union synthhid_version { struct { u16 minor_version; Loading Loading @@ -99,7 +91,7 @@ struct synthhid_device_info_ack { struct synthhid_input_report { struct synthhid_msg_hdr header; char buffer[1]; char buffer[]; }; #pragma pack(pop) Loading @@ -118,7 +110,7 @@ enum pipe_prot_msg_type { struct pipe_prt_msg { enum pipe_prot_msg_type type; u32 size; char data[1]; char data[]; }; struct mousevsc_prt_msg { Loading Loading @@ -232,7 +224,7 @@ static void mousevsc_on_receive_device_info(struct mousevsc_dev *input_device, ret = vmbus_sendpacket(input_device->device->channel, &ack, sizeof(struct pipe_prt_msg) - sizeof(unsigned char) + sizeof(struct pipe_prt_msg) + sizeof(struct synthhid_device_info_ack), (unsigned long)&ack, VM_PKT_DATA_INBAND, Loading @@ -251,7 +243,7 @@ static void mousevsc_on_receive(struct hv_device *device, struct vmpacket_descriptor *packet) { struct pipe_prt_msg *pipe_msg; struct synthhid_msg *hid_msg; struct synthhid_msg_hdr *hid_msg_hdr; struct mousevsc_dev *input_dev = hv_get_drvdata(device); struct synthhid_input_report *input_report; size_t len; Loading @@ -262,25 +254,23 @@ static void mousevsc_on_receive(struct hv_device *device, if (pipe_msg->type != PIPE_MESSAGE_DATA) return; hid_msg = (struct synthhid_msg *)pipe_msg->data; hid_msg_hdr = (struct synthhid_msg_hdr *)pipe_msg->data; switch (hid_msg->header.type) { switch (hid_msg_hdr->type) { case SYNTH_HID_PROTOCOL_RESPONSE: /* * While it will be impossible for us to protect against * malicious/buggy hypervisor/host, add a check here to * ensure we don't corrupt memory. */ if ((pipe_msg->size + sizeof(struct pipe_prt_msg) - sizeof(unsigned char)) if (struct_size(pipe_msg, data, pipe_msg->size) > sizeof(struct mousevsc_prt_msg)) { WARN_ON(1); break; } memcpy(&input_dev->protocol_resp, pipe_msg, pipe_msg->size + sizeof(struct pipe_prt_msg) - sizeof(unsigned char)); struct_size(pipe_msg, data, pipe_msg->size)); complete(&input_dev->wait_event); break; Loading Loading @@ -311,7 +301,7 @@ static void mousevsc_on_receive(struct hv_device *device, break; default: pr_err("unsupported hid msg type - type %d len %d\n", hid_msg->header.type, hid_msg->header.size); hid_msg_hdr->type, hid_msg_hdr->size); break; } Loading Loading @@ -359,8 +349,7 @@ static int mousevsc_connect_to_vsp(struct hv_device *device) request->request.version_requested.version = SYNTHHID_INPUT_VERSION; ret = vmbus_sendpacket(device->channel, request, sizeof(struct pipe_prt_msg) - sizeof(unsigned char) + sizeof(struct pipe_prt_msg) + sizeof(struct synthhid_protocol_request), (unsigned long)request, VM_PKT_DATA_INBAND, Loading Loading
drivers/hid/hid-hyperv.c +10 −21 Original line number Diff line number Diff line Loading @@ -22,9 +22,6 @@ struct hv_input_dev_info { unsigned short reserved[11]; }; /* The maximum size of a synthetic input message. */ #define SYNTHHID_MAX_INPUT_REPORT_SIZE 16 /* * Current version * Loading Loading @@ -59,11 +56,6 @@ struct synthhid_msg_hdr { u32 size; }; struct synthhid_msg { struct synthhid_msg_hdr header; char data[1]; /* Enclosed message */ }; union synthhid_version { struct { u16 minor_version; Loading Loading @@ -99,7 +91,7 @@ struct synthhid_device_info_ack { struct synthhid_input_report { struct synthhid_msg_hdr header; char buffer[1]; char buffer[]; }; #pragma pack(pop) Loading @@ -118,7 +110,7 @@ enum pipe_prot_msg_type { struct pipe_prt_msg { enum pipe_prot_msg_type type; u32 size; char data[1]; char data[]; }; struct mousevsc_prt_msg { Loading Loading @@ -232,7 +224,7 @@ static void mousevsc_on_receive_device_info(struct mousevsc_dev *input_device, ret = vmbus_sendpacket(input_device->device->channel, &ack, sizeof(struct pipe_prt_msg) - sizeof(unsigned char) + sizeof(struct pipe_prt_msg) + sizeof(struct synthhid_device_info_ack), (unsigned long)&ack, VM_PKT_DATA_INBAND, Loading @@ -251,7 +243,7 @@ static void mousevsc_on_receive(struct hv_device *device, struct vmpacket_descriptor *packet) { struct pipe_prt_msg *pipe_msg; struct synthhid_msg *hid_msg; struct synthhid_msg_hdr *hid_msg_hdr; struct mousevsc_dev *input_dev = hv_get_drvdata(device); struct synthhid_input_report *input_report; size_t len; Loading @@ -262,25 +254,23 @@ static void mousevsc_on_receive(struct hv_device *device, if (pipe_msg->type != PIPE_MESSAGE_DATA) return; hid_msg = (struct synthhid_msg *)pipe_msg->data; hid_msg_hdr = (struct synthhid_msg_hdr *)pipe_msg->data; switch (hid_msg->header.type) { switch (hid_msg_hdr->type) { case SYNTH_HID_PROTOCOL_RESPONSE: /* * While it will be impossible for us to protect against * malicious/buggy hypervisor/host, add a check here to * ensure we don't corrupt memory. */ if ((pipe_msg->size + sizeof(struct pipe_prt_msg) - sizeof(unsigned char)) if (struct_size(pipe_msg, data, pipe_msg->size) > sizeof(struct mousevsc_prt_msg)) { WARN_ON(1); break; } memcpy(&input_dev->protocol_resp, pipe_msg, pipe_msg->size + sizeof(struct pipe_prt_msg) - sizeof(unsigned char)); struct_size(pipe_msg, data, pipe_msg->size)); complete(&input_dev->wait_event); break; Loading Loading @@ -311,7 +301,7 @@ static void mousevsc_on_receive(struct hv_device *device, break; default: pr_err("unsupported hid msg type - type %d len %d\n", hid_msg->header.type, hid_msg->header.size); hid_msg_hdr->type, hid_msg_hdr->size); break; } Loading Loading @@ -359,8 +349,7 @@ static int mousevsc_connect_to_vsp(struct hv_device *device) request->request.version_requested.version = SYNTHHID_INPUT_VERSION; ret = vmbus_sendpacket(device->channel, request, sizeof(struct pipe_prt_msg) - sizeof(unsigned char) + sizeof(struct pipe_prt_msg) + sizeof(struct synthhid_protocol_request), (unsigned long)request, VM_PKT_DATA_INBAND, Loading