linux-kernel - Re: Linux USB HID should ignore values outside Logical Minimum/Maximum range

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LNX.2.00.1110281817380.3541@pobox.suse.cz>
Date:	Fri, 28 Oct 2011 18:23:17 +0200 (CEST)
From:	Jiri Kosina <jkosina@...e.cz>
To:	Dmitry Torokhov <dmitry.torokhov@...il.com>
Cc:	Christoph Fritz <chf.fritz@...glemail.com>,
	Denilson Figueiredo de Sá 
	<denilsonsa@...il.com>, linux-kernel@...r.kernel.org,
	linux-input@...r.kernel.org, linux-usb@...r.kernel.org
Subject: Re: Linux USB HID should ignore values outside Logical Minimum/Maximum
 range

On Mon, 24 Oct 2011, Dmitry Torokhov wrote:

> While input core does not clam or validate the values reported by the 
> driver it might make sense to do so in hid-input; I am not sure how 
> often these limits programmed intorrectly. Jiri i sprobably the best 
> person to answer this question.

I haven't met such a device myself yet.

On the other hand I feel like just dropping the report on the floor should 
be the proper thing to do.


Christoph, how about the (untested at my side yet) patch below? It'd be 
nice if you could test with the device you are seeing the problem with and 
let me know.

It's definitely not something I'll be pushing for 3.1 though; I'd first 
like to verify the batch of the device records I have (or I have received) 
to see whehter we can't introduce regressions this way.


From: Jiri Kosina <jkosina@...e.cz>
Subject: [PATCH] HID: ignore absolute values which don't fit between logical min and max

Linux should ignore values outside logical min/max range, as they are not
meaningful. This is what at least some of other OSes do, and it also makes
sense (currently the value gets misinterpreted larger up the stack).

Reported-by: Denilson Figueiredo de Sá <denilsonsa@...il.com>
Signed-off-by: Jiri Kosina <jkosina@...e.cz>
---
 drivers/hid/hid-input.c |    7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index f333139..ca923de 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -822,6 +822,13 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
 		return;
 	}
 
+	/* Ignore absolute values that are out of bounds */
+	if ((usage->type == EV_ABS && (value < field->logical_minimum ||
+					value > field->logical_maximum))) {
+		dbg_hid("Ignoring out-of-range value %x\n", value);
+		return;
+	}
+
 	/* report the usage code as scancode if the key status has changed */
 	if (usage->type == EV_KEY && !!test_bit(usage->code, input->key) != value)
 		input_event(input, EV_MSC, MSC_SCAN, usage->hid);
-- 
Jiri Kosina
SUSE Labs
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/