linux-kernel - Re: [PATCH] mfd: cros-ec: copy the whole event when msg->version is 0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 27 Sep 2018 12:30:31 +0300
From:   Emil Karlson <jekarlson@...il.com>
To:     Emil Renner Berthing <kernel@...il.dk>,
        Neil Armstrong <narmstrong@...libre.com>,
        Stefan Adolfsson <sadolfsson@...omium.org>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mfd: cros-ec: copy the whole event when msg->version is 0

To note I have almost no idea what I am doing and ended up wondering,
whether the messages are always truncated and it only shows on version
0, because the messages are not padded to longer lenght. Alternatively
the ret could possibly be used as copy length without the -1, right
now I am unable to test with version 1, possibly it requires update of
cros-ec firmware.

Best regards
-Emil
On Thu, Sep 27, 2018 at 12:24 PM Emil Karlson <jekarlson@...il.com> wrote:
>
> Commit 57e94c8b974db2d83c60e1139c89a70806abbea0 caused cros-ec keyboard events
> be truncated on many chromebooks so that Left and Right keys on Column 12 were
> always 0. This commit fixes the issue by restoring the old semantics when the
> protocol version is 0.
> ---
>  drivers/platform/chrome/cros_ec_proto.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
> index 398393ab5df8..457e4940dba4 100644
> --- a/drivers/platform/chrome/cros_ec_proto.c
> +++ b/drivers/platform/chrome/cros_ec_proto.c
> @@ -519,8 +519,14 @@ static int get_next_event_xfer(struct cros_ec_device *ec_dev,
>
>         ret = cros_ec_cmd_xfer(ec_dev, msg);
>         if (ret > 0) {
> +               unsigned int copy_size;
> +
>                 ec_dev->event_size = ret - 1;
> -               memcpy(&ec_dev->event_data, msg->data, ec_dev->event_size);
> +               if (!version)
> +                       copy_size = sizeof(struct ec_response_get_next_event);
> +               else
> +                       copy_size = ec_dev->event_size;
> +               memcpy(&ec_dev->event_data, msg->data, copy_size);
>         }
>
>         return ret;
> --
> 2.19.0
>