linux-kernel - Re: [GIT PULL] HID fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 20 Jun 2018 16:12:24 +0900
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Hans de Goede <hdegoede@...hat.com>
Cc:     Julian Sax <jsbc@....de>, Jiri Kosina <jikos@...nel.org>,
        Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [GIT PULL] HID fixes

On Wed, Jun 20, 2018 at 4:06 PM Hans de Goede <hdegoede@...hat.com> wrote:
>
>
> Julian let me know if you need any help with this,
> to format the HID descriptor take a file with
> the raw descriptor in binary format and do:
>
> cat descriptor.bin | hidrd-convert -o code

But what is the *source* of this binary crud?

Because no way in hell do we take binary crud from random places, and
then add it to the kernel.

NOT EVEN IF IT WENT THROUGH SOME "hidrd-convert" PHASE!

And yes, now that I google for that hidrd-convert pattern, I see that
we already have other broken chunks like this.

Not ok. At least some of them seem to mention where the data comes from, eg

   "This is the original report descriptor as reported by lsusb -vd 046d:c294"

but this one has no such information.

So guys, you need to think about where things come from, and document
how some random garbage came to be. Not just add it to the kernel.

                     Linus