From c2d072641aa9015fdfab196d095566fea364d4dc Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Thu, 16 Oct 2025 18:57:58 -0700 Subject: [PATCH] shared/uhid.c: Fix 32-bit integer truncation Id paramter given to bt_uhid_set_report_reply() and bt_uhid_get_report_reply() corresponds to a 32-bit tag value passed to us from the kernel side of UHID. Specifying this parameter as uint8_t breaks the synchronization after 255 request and renders the attached BLE device inoperable. Fixes: 92ed637ab2bc ("shared/uhid: Add dedicated functions for each UHID opcode") Cc: Luiz Augusto von Dentz --- src/shared/uhid.c | 4 ++-- src/shared/uhid.h | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/shared/uhid.c b/src/shared/uhid.c index 20bd26781..207afa55e 100644 --- a/src/shared/uhid.c +++ b/src/shared/uhid.c @@ -495,7 +495,7 @@ int bt_uhid_input(struct bt_uhid *uhid, uint8_t number, const void *data, return bt_uhid_send(uhid, &ev); } -int bt_uhid_set_report_reply(struct bt_uhid *uhid, uint8_t id, uint8_t status) +int bt_uhid_set_report_reply(struct bt_uhid *uhid, uint32_t id, uint8_t status) { struct uhid_event ev; struct uhid_set_report_reply_req *rsp = &ev.u.set_report_reply; @@ -514,7 +514,7 @@ int bt_uhid_set_report_reply(struct bt_uhid *uhid, uint8_t id, uint8_t status) return bt_uhid_send(uhid, &ev); } -int bt_uhid_get_report_reply(struct bt_uhid *uhid, uint8_t id, uint8_t number, +int bt_uhid_get_report_reply(struct bt_uhid *uhid, uint32_t id, uint8_t number, uint8_t status, const void *data, size_t size) { struct uhid_event ev; diff --git a/src/shared/uhid.h b/src/shared/uhid.h index e76a6e22b..be180297b 100644 --- a/src/shared/uhid.h +++ b/src/shared/uhid.h @@ -63,8 +63,8 @@ bool bt_uhid_created(struct bt_uhid *uhid); bool bt_uhid_started(struct bt_uhid *uhid); int bt_uhid_input(struct bt_uhid *uhid, uint8_t number, const void *data, size_t size); -int bt_uhid_set_report_reply(struct bt_uhid *uhid, uint8_t id, uint8_t status); -int bt_uhid_get_report_reply(struct bt_uhid *uhid, uint8_t id, uint8_t number, +int bt_uhid_set_report_reply(struct bt_uhid *uhid, uint32_t id, uint8_t status); +int bt_uhid_get_report_reply(struct bt_uhid *uhid, uint32_t id, uint8_t number, uint8_t status, const void *data, size_t size); int bt_uhid_destroy(struct bt_uhid *uhid, bool force); int bt_uhid_replay(struct bt_uhid *uhid); -- 2.47.3