• Xin Zhao's avatar
    HID: core: Fix deadloop in hid_apply_multiplier. · ea427a22
    Xin Zhao authored
    The initial value of hid->collection[].parent_idx if 0. When
    Report descriptor doesn't contain "HID Collection", the value
    remains as 0.
    
    In the meanwhile, when the Report descriptor fullfill
    all following conditions, it will trigger hid_apply_multiplier
    function call.
    1. Usage page is Generic Desktop Ctrls (0x01)
    2. Usage is RESOLUTION_MULTIPLIER (0x48)
    3. Contain any FEATURE items
    
    The while loop in hid_apply_multiplier will search the top-most
    collection by searching parent_idx == -1. Because all parent_idx
    is 0. The loop will run forever.
    
    There is a Report Descriptor triggerring the deadloop
    0x05, 0x01,        // Usage Page (Generic Desktop Ctrls)
    0x09, 0x48,        // Usage (0x48)
    0x95, 0x01,        // Report Count (1)
    0x75, 0x08,        // Report Size (8)
    0xB1, 0x01,        // Feature
    Signed-off-by: default avatarXin Zhao <xnzhao@google.com>
    Link: https://lore.kernel.org/r/20230130212947.1315941-1-xnzhao@google.comSigned-off-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
    ea427a22
hid-core.c 72.2 KB