HID: uhid: Fix sending events with invalid data

This was detected because events with invalid types were arriving
to userspace.

The code before this patch would only work for the first event in the
queue (when uhid->tail is 0).

Signed-off-by: Vinicius Costa Gomes <[email protected]>
Reviewed-by: David Herrmann <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 119b7e6405beebdac4516b700e63b43048c1d7cc..714cd8cc9579b6cd3c71b8a2aebb140e089f27e6 100644 (file)
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -465,7 +465,7 @@ try_again:
                goto try_again;
        } else {
                len = min(count, sizeof(**uhid->outq));
-               if (copy_to_user(buffer, &uhid->outq[uhid->tail], len)) {
+               if (copy_to_user(buffer, uhid->outq[uhid->tail], len)) {
                        ret = -EFAULT;
                } else {
                        kfree(uhid->outq[uhid->tail]);