linux-kernel - Re: [PATCH] USB: HID: Fix fields from pen report ID being interpreted for multitouch.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 9 Jun 2015 17:47:54 -0400
From:	Benjamin Tissoires <benjamin.tissoires@...il.com>
To:	Brent Adam <brentadamdev@...il.com>
Cc:	Jiri Kosina <jkosina@...e.cz>,
	linux-input <linux-input@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Brent Adam <brentadam@...rttech.com>
Subject: Re: [PATCH] USB: HID: Fix fields from pen report ID being interpreted
 for multitouch.

On Tue, Jun 9, 2015 at 4:31 PM, Brent Adam <brentadamdev@...il.com> wrote:
> Fields like HID_DG_CONTACTCOUNT are outside of the physical collection,
> but within the application collection and report ID.  Make sure to catch
> those fields that are not part of the mt_report_id and return 0 so they
> can be processed with the pen.  Otherwise, the wrong HID_DG_CONTACTCOUNT
> will be applied to cc_index and result in dereferencing a null pointer in
> mt_touch_report.
>
> Signed-off-by: Brent Adam <brentadam@...rttech.com>
> ---
>  drivers/hid/hid-multitouch.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
> index 6a9b05b..2ee8800 100644
> --- a/drivers/hid/hid-multitouch.c
> +++ b/drivers/hid/hid-multitouch.c
> @@ -781,6 +781,9 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
>          */
>         if (field->physical == HID_DG_STYLUS)
>                 return 0;
> +       else if ((field->physical == 0) &&
> +                (field->report->id != td->mt_report_id))

Hmm... That seems wrong.
td->mt_report_id is set in mt_touch_input_mapping(), so checking for
it before even entering the function seems a little bit odd and
activates my bug alert system :)

Could you please share the report descriptor of the device you are
trying to fix? Ideally, if you could get this by running hid-recorder
(http://bentiss.github.io/hid-replay-docs/) that would be even better
because you could also record some events from the pen and from the
touch.

I would also like to see a comment in the code which explains why we
need to have a special case to abort earlier.

Cheers,
Benjamin

> +               return 0;
>
>         if (field->application == HID_DG_TOUCHSCREEN ||
>             field->application == HID_DG_TOUCHPAD)
> --
> 2.1.4
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-input" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/