linux-kernel - Re: NULL pointer dereference in i2c-hid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1940829.tOcs3CnnyV@xps13>
Date:	Fri, 09 Jan 2015 09:04:48 +0100
From:	Gabriele Mazzotta <gabriele.mzt@...il.com>
To:	Andrew Duggan <aduggan@...aptics.com>
Cc:	Mika Westerberg <mika.westerberg@...ux.intel.com>,
	linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
	benjamin.tissoires@...hat.com, jkosina@...e.cz
Subject: Re: NULL pointer dereference in i2c-hid

On Thursday 08 January 2015 15:58:54 Andrew Duggan wrote:
> On 12/24/2014 03:53 PM, Gabriele Mazzotta wrote:
> [...snip...]
> >>>> Also, if you can get the firmware id from your touchpad that would also
> >>>> be useful.
> >>>>
> >>>> $ sudo ./rmihidtool -f /dev/hidraw0
> >>> firmware id: 1522295
> >> Thanks, I will see if I can get any additional information on this.
> >>
> >> Andrew
> > Hi,
> >
> > I think I found the source of the problem.
> >
> > $ ./rmihidtool /dev/hidraw1 -r 0x50 1
> > 0x01  #PalmDetect Interrupt Enable, right?
> Yes, 0x50 does appear to be the address of the palm detect interrupt 
> enable register.
> > $ ./rmihidtool /dev/hidraw1 -w 0x50 0  #Disable PalmDetect Interrupt
> >
> > It makes more sense now that widths greater than 12 trigger the bug.
> That is weird behavior and I haven't seen anything like that before. I 
> will file a bug to see if firmware has any idea why this is happening.

According to the RMI4 specification, gesture interrupts are cleared
only once specific flag registers, F11_2D_Data8 and F11_2D_Data9, are
read. So I tried to read those register and found that the following
command stops the events:

$ rmihidtool /dev/hidraw1 -r 0x24 1  # I was looking for F11_2D_Data8

I'm not sure I got the right address as reading any register close to
0x24 (such as 0x25, 0x26) has the same effect. I would have expected
this to happen only reading one specific register.

I also honestly don't know why palms are detected when the width is at
least 12, PalmDetectThreshold is 0 and so the palm detection should
be inhibited.

> >
> > Gabriele
> >
> Andrew

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/