HID: hid-goodix: Fix type promotion bug in goodix_hid_get_raw_report()
authorDan Carpenter <dan.carpenter@linaro.org>
Thu, 29 Aug 2024 19:30:39 +0000 (22:30 +0300)
committerJiri Kosina <jkosina@suse.com>
Thu, 29 Aug 2024 19:49:22 +0000 (21:49 +0200)
commit252ed1f7f7c657812ee864a9dad0a935f7bed08b
tree85ce807e75ab32065ef282d3124f506b2a6f068e
parent9184b17fbc232554f91e9a01d29cea3a47bca2ea
HID: hid-goodix: Fix type promotion bug in goodix_hid_get_raw_report()

The issue is GOODIX_HID_PKG_LEN_SIZE is defined as sizeof(u16) which is
type size_t.  However, goodix_hid_check_ack_status() returns negative
error codes or potentially a positive but invalid length which is too
small.  So when we compare "if ((response_data_len <=
GOODIX_HID_PKG_LEN_SIZE)" then negative error codes are type promoted to
size_t and counted as a positive large value and treated as valid.

It would have been easy enough to add some casting to avoid the type
promotion, however this patch takes a more thourough approach and moves
the length check into goodix_hid_check_ack_status().  Now the function
only return negative error codes or zero on success and the length
pointer is never set to an invalid length.

Fixes: 75e16c8ce283 ("HID: hid-goodix: Add Goodix HID-over-SPI driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
drivers/hid/hid-goodix-spi.c