From 0f338e7d92b436932400ebab27e96ca7c837f17b Mon Sep 17 00:00:00 2001
From: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Date: Wed, 5 Dec 2012 15:02:56 +0100
Subject: [PATCH] --- yaml --- r: 343071 b: refs/heads/master c:
 e5b50fe7bea43d0658773c89ba410ecc56867ee6 h: refs/heads/master i:   343069:
 e39e5fb9b59bc23090de8b6ea427a3e5e6fed7ba   343067:
 f7ccdba57e100211012cdf890cf8d69ed895877d   343063:
 4c07b11fba38ac28a3c2b04c579234423c197696   343055:
 7e8a34bb981d1fd18b8005407148b44d3e91babb   343039:
 3256d75475a754ab5e290eb2f8426f08f4328f4c v: v3

---
 [refs]                              |  2 +-
 trunk/drivers/hid/i2c-hid/i2c-hid.c | 16 ++++++++++++----
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/[refs] b/[refs]
index a11ded799fe3..1145660d5d64 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 8a1bbb5319384dab6568ac2ce30d19b922413bec
+refs/heads/master: e5b50fe7bea43d0658773c89ba410ecc56867ee6
diff --git a/trunk/drivers/hid/i2c-hid/i2c-hid.c b/trunk/drivers/hid/i2c-hid/i2c-hid.c
index c6630d442e78..ce01d5916184 100644
--- a/trunk/drivers/hid/i2c-hid/i2c-hid.c
+++ b/trunk/drivers/hid/i2c-hid/i2c-hid.c
@@ -502,23 +502,31 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
 {
 	struct i2c_client *client = hid->driver_data;
 	struct i2c_hid *ihid = i2c_get_clientdata(client);
+	size_t ret_count, ask_count;
 	int ret;
 
 	if (report_type == HID_OUTPUT_REPORT)
 		return -EINVAL;
 
-	if (count > ihid->bufsize)
-		count = ihid->bufsize;
+	/* +2 bytes to include the size of the reply in the query buffer */
+	ask_count = min(count + 2, (size_t)ihid->bufsize);
 
 	ret = i2c_hid_get_report(client,
 			report_type == HID_FEATURE_REPORT ? 0x03 : 0x01,
-			report_number, ihid->inbuf, count);
+			report_number, ihid->inbuf, ask_count);
 
 	if (ret < 0)
 		return ret;
 
-	count = ihid->inbuf[0] | (ihid->inbuf[1] << 8);
+	ret_count = ihid->inbuf[0] | (ihid->inbuf[1] << 8);
 
+	if (!ret_count)
+		return 0;
+
+	ret_count = min(ret_count, ask_count);
+
+	/* The query buffer contains the size, dropping it in the reply */
+	count = min(count, ret_count - 2);
 	memcpy(buf, ihid->inbuf + 2, count);
 
 	return count;