diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c index 1f9bc4483465..f27b177107bc 100644 --- a/drivers/hid/usbhid/hiddev.c +++ b/drivers/hid/usbhid/hiddev.c @@ -528,6 +528,9 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, array_index_nospec(uref->usage_index, field->report_count - uref_multi->num_values); + + if (uref->usage_index >= report->maxfield) + goto inval; } switch (cmd) {