git: 9c61c3f7e4b1 - stable/15 - iichid(4): Do not add 2 leading "length" bytes to input report length

The branch stable/15 has been updated by wulf:

URL: https://cgit.FreeBSD.org/src/commit/?id=9c61c3f7e4b1e6e68cddf6ac9ecc33ea11198ef6

commit 9c61c3f7e4b1e6e68cddf6ac9ecc33ea11198ef6
Author:     Vladimir Kondratyev <wulf@FreeBSD.org>
AuthorDate: 2025-09-22 08:37:20 +0000
Commit:     Vladimir Kondratyev <wulf@FreeBSD.org>
CommitDate: 2025-09-29 21:51:07 +0000

    iichid(4): Do not add 2 leading "length" bytes to input report length
    
    MFC after:      1 week
    fixes:          36027361f9cf ("iichid: Stop using split I²C bus transactions")
    
    (cherry picked from commit 1e74951b6cd8132ae417177336b7180e174a5e3f)
---
 sys/dev/iicbus/iichid.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/sys/dev/iicbus/iichid.c b/sys/dev/iicbus/iichid.c
index 6d95d6d2d4f8..5ca3f1b84e48 100644
--- a/sys/dev/iicbus/iichid.c
+++ b/sys/dev/iicbus/iichid.c
@@ -540,7 +540,7 @@ iichid_sampling_task(void *context, int pending)
 	error = iichid_cmd_read(sc, sc->intr_buf, sc->intr_bufsize, &actual);
 	if (error == 0) {
 		if (actual > 0) {
-			sc->intr_handler(sc->intr_ctx, sc->intr_buf + 2, actual);
+			sc->intr_handler(sc->intr_ctx, sc->intr_buf + 2, actual - 2);
 			sc->missing_samples = 0;
 			if (sc->dup_size != actual ||
 			    memcmp(sc->dup_buf, sc->intr_buf, actual) != 0) {
@@ -607,7 +607,7 @@ iichid_intr(void *context)
 		if (sc->power_on && sc->open) {
 			if (actual != 0)
 				sc->intr_handler(sc->intr_ctx, sc->intr_buf + 2,
-				    actual);
+				    actual - 2);
 			else
 				DPRINTF(sc, "no data received\n");
 		}
@@ -822,7 +822,7 @@ iichid_intr_setup(device_t dev, device_t child __unused, hid_intr_t intr,
 	 * report in the descriptor, and add two for the length field.
 	 */
 	rdesc->rdsize = rdesc->rdsize == 0 ?
-	    le16toh(sc->desc.wMaxInputLength) : rdesc->isize + 2;
+	    le16toh(sc->desc.wMaxInputLength) - 2 : rdesc->isize;
 	/* Write and get/set_report sizes are limited by I2C-HID protocol. */
 	rdesc->grsize = rdesc->srsize = IICHID_SIZE_MAX;
 	rdesc->wrsize = IICHID_SIZE_MAX;
@@ -832,7 +832,7 @@ iichid_intr_setup(device_t dev, device_t child __unused, hid_intr_t intr,
 
 	sc->intr_handler = intr;
 	sc->intr_ctx = context;
-	sc->intr_bufsize = rdesc->rdsize;
+	sc->intr_bufsize = rdesc->rdsize + 2;
 	sc->intr_buf = realloc(sc->intr_buf, sc->intr_bufsize,
 	    M_DEVBUF, M_WAITOK | M_ZERO);
 #ifdef IICHID_SAMPLING
@@ -1094,7 +1094,8 @@ iichid_probe(device_t dev)
 	}
 
 	if (le16toh(sc->desc.wHIDDescLength) != 30 ||
-	    le16toh(sc->desc.bcdVersion) != 0x100) {
+	    le16toh(sc->desc.bcdVersion) != 0x100 ||
+	    le16toh(sc->desc.wMaxInputLength) < 2) {
 		DPRINTF(sc, "HID descriptor is broken\n");
 		return (ENXIO);
 	}