linux-kernel - Re: [PATCH 0/3] HID: make raw output callback more flexible

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87636jhs29.fsf@troilus.org>
Date:	Sat, 30 Jan 2010 22:27:42 -0500
From:	Michael Poole <mdpoole@...ilus.org>
To:	Bastien Nocera <hadess@...ess.net>
Cc:	Marcel Holtmann <marcel@...tmann.org>,
	Jiri Kosina <jkosina@...e.cz>,
	"Gunn\, Brian" <bgunn@...ekai.com>, Ping <pinglinux@...il.com>,
	linux-kernel@...r.kernel.org,
	BlueZ development <linux-bluetooth@...r.kernel.org>
Subject: Re: [PATCH 0/3] HID: make raw output callback more flexible

Bastien Nocera writes:

> On Fri, 2010-01-29 at 19:46 -0500, Michael Poole wrote:
>> > [1]: Comments on the patch at
>> > http://thread.gmane.org/gmane.linux.bluez.kernel/4279 would be
>> > appreciated
>> 
>> This patch does not work for me.  Before, the first time after each
>> boot
>> that I tried to connect to an Apple Magic Mouse, it failed with -14
>> (EFAULT).  With this patch, it fails with -22 (EINVAL) instead.  The
>> -EFAULT *was* due to hidp_parse()'s copy_from_user().  I have not
>> looked
>> yet to see where the -EINVAL is coming from -- would that help?  (Both
>> with and without your patch, the second attempt to connect works.) 
>
> I don't get -EFAULT anymore (it was failing to copy the rd_data from
> user-space), but I do get -EINVALs now. I haven't investigated it
> though. My guess is that the hid parser fails.
>
> Could you compare the sizes of the data gathered in user-space?

It looks like something else is overwriting parts of the hidp_session
structure; I hope to find out what that is tomorrow.  Based on a
printk() in hidp_sock_ioctl(), user space consistently passes a 99-byte
HID report descriptor.  I added another printk() to hidp_parse() to
characterize things:
  printk("hidp_parse(%p): %u@%p\n", hid, req->rd_size, req->rd_data);

With your patch, the first time I connect to the mouse:
[  244.109619] hidp_parse(ffff880138f90000): 0@...0002800000000
[  244.109694] magicmouse 0005:05AC:030D.0001: magicmouse hid parse
  failed
[  244.109708] magicmouse: probe of 0005:05AC:030D.0001 failed with
  error -22

With your patch, the second time:
[  258.840542] hidp_parse(ffff880134e14000): 99@...f88008fd8f880
[  258.841415] input: Apple Wireless Mouse as
  /devices/pci0000:00/0000:00:1d.2/usb8/8-1/8-1:1.0/bluetooth/hci0/hci0:12/input11

Without your patch, the first time:
[  157.569000] hidp_parse(ffff8801313cc000): 11859@...fffff811397c0
[  157.569018] magicmouse 0005:05AC:030D.0001: magicmouse hid parse
  failed
[  157.569031] magicmouse: probe of 0005:05AC:030D.0001 failed with
  error -14

Without your patch, the second time:
[  178.983956] hidp_parse(ffff88012e660000): 99@...07f40d7d44880
[  178.984977] input: Apple Wireless Mouse as
  /devices/pci0000:00/0000:00:1d.2/usb8/8-1/8-1:1.0/bluetooth/hci0/hci0:12/input11

Michael Poole
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/