Bluetooth: hidp: buffer overflow in hidp_process_report

[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / hidp / core.c

diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index f2cec70d520cc2b29606f51a5c2b3c19a7fdc838..c3b23ab2b7234d92effb2c92e1580ec0c86d3334 100644 (file)
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -431,8 +431,8 @@ static void hidp_del_timer(struct hidp_session *session)
                del_timer(&session->timer);
 }
 
-static void hidp_process_report(struct hidp_session *session,
-                               int type, const u8 *data, int len, int intr)
+static void hidp_process_report(struct hidp_session *session, int type,
+                               const u8 *data, unsigned int len, int intr)
 {
        if (len > HID_MAX_BUFFER_SIZE)
                len = HID_MAX_BUFFER_SIZE;