HID: uhid: Fix sending events with invalid data

This was detected because events with invalid types were arriving
to userspace.

The code before this patch would only work for the first event in the
queue (when uhid->tail is 0).

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Reviewed-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 119b7e6..714cd8c 100644 (file)
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -465,7 +465,7 @@ try_again:
                goto try_again;
        } else {
                len = min(count, sizeof(**uhid->outq));
-               if (copy_to_user(buffer, &uhid->outq[uhid->tail], len)) {
+               if (copy_to_user(buffer, uhid->outq[uhid->tail], len)) {
                        ret = -EFAULT;
                } else {
                        kfree(uhid->outq[uhid->tail]);