linux-kernel - Re: [PATCH] Input: zforce_ts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 28 Jul 2015 12:23:27 +0200
From:	Geert Uytterhoeven <geert@...ux-m68k.org>
To:	Dmitry Torokhov <dmitry.torokhov@...il.com>
Cc:	"linux-input@...r.kernel.org" <linux-input@...r.kernel.org>,
	Dirk Behme <dirk.behme@...bosch.com>,
	Heiko Stuebner <heiko.stuebner@...com>,
	Oleksij Rempel <external.Oleksij.Rempel@...bosch.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] Input: zforce_ts - fix playload length check

On Mon, Jul 27, 2015 at 11:06 PM, Dmitry Torokhov
<dmitry.torokhov@...il.com> wrote:
> Commit 7d01cd261c76f95913c81554a751968a1d282d3a ("Input: zforce - don't
> overwrite the stack") attempted to add a check for payload size being too
> large for the supplied buffer. Unfortunately with the currently selected
> buffer size the comparison is always false as buffer size is larger than
> the value a single byte can hold, and that results in compiler warnings.
> Additionally the check was incorrect as it was not accounting for the
> already read 2 bytes of data stored in the buffer.

The check was indeed incorrect.

> Fixes: 7d01cd261c76f95913c81554a751968a1d282d3a
> Reported-by: kbuild test robot <fengguang.wu@...el.com>
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@...il.com>
> ---
>
> This seems to shut up my GCC, I wonder if it is going to work gfor
> everyone or we better add BUILD_BUG_ON(FRAME_MAXSIZE < 257) and a
> comment and remove check.
>
>  drivers/input/touchscreen/zforce_ts.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c
> index 2554efd..542ff02 100644
> --- a/drivers/input/touchscreen/zforce_ts.c
> +++ b/drivers/input/touchscreen/zforce_ts.c
> @@ -441,7 +441,9 @@ static int zforce_read_packet(struct zforce_ts *ts, u8 *buf)
>                 goto unlock;
>         }
>
> -       if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) {
> +       if (buf[PAYLOAD_LENGTH] == 0 ||
> +           (FRAME_MAXSIZE - 2 < 255 &&
> +            buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE - 2)) {

Doesn't help with gcc 4.1.2 :-(

Before:

drivers/input/touchscreen/zforce_ts.c: In function ‘zforce_read_packet’:
drivers/input/touchscreen/zforce_ts.c:432: warning: comparison is
always false due to limited range of data type

After:

drivers/input/touchscreen/zforce_ts.c: In function ‘zforce_read_packet’:
drivers/input/touchscreen/zforce_ts.c:434: warning: comparison is
always false due to limited range of data type

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/