diff options
| author | Benjamin Tissoires <benjamin.tissoires@redhat.com> | 2014-04-24 18:26:38 -0400 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2014-05-13 16:42:50 +0200 |
| commit | dcce583792d2b9a83dd9cb62551831f09f971fda (patch) | |
| tree | b699e7bed4a729a10bf0fa5cb110bbd44483a167 /drivers/hid | |
| parent | f15475c397f496c0907be5e95f8556c8f5908d54 (diff) | |
| download | linux-dcce583792d2b9a83dd9cb62551831f09f971fda.tar.gz linux-dcce583792d2b9a83dd9cb62551831f09f971fda.tar.bz2 linux-dcce583792d2b9a83dd9cb62551831f09f971fda.zip | |
HID: rmi: do not fetch more than 16 bytes in a query
A firmware bug is present on the XPS Haswell edition which silently
split the request in two responses when the caller ask for a read of
more than 16 bytes.
The FW sends the first 16 then the 4 next, but it says that it answered
the 20 bytes in the first report.
This occurs only on the retrieving of the min/max of X and Y of the F11
function.
We only use the first 10 bytes of the Ctrl register, so we can get only
those 10 bytes to prevent the bug from happening.
Resolves:
https://bugzilla.redhat.com/show_bug.cgi?id=1090161
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid')
| -rw-r--r-- | drivers/hid/hid-rmi.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c index eda7ef41c291..05e4928c06f1 100644 --- a/drivers/hid/hid-rmi.c +++ b/drivers/hid/hid-rmi.c @@ -641,10 +641,15 @@ static int rmi_populate_f11(struct hid_device *hdev) } } - /* retrieve the ctrl registers */ - ret = rmi_read_block(hdev, data->f11.control_base_addr, buf, 20); + /* + * retrieve the ctrl registers + * the ctrl register has a size of 20 but a fw bug split it into 16 + 4, + * and there is no way to know if the first 20 bytes are here or not. + * We use only the first 10 bytes, so get only them. + */ + ret = rmi_read_block(hdev, data->f11.control_base_addr, buf, 10); if (ret) { - hid_err(hdev, "can not read ctrl block of size 20: %d.\n", ret); + hid_err(hdev, "can not read ctrl block of size 10: %d.\n", ret); return ret; } |