linux-kernel - Re: [PATCH] mfd: cros-ec: copy the whole event when msg->version is 0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <22cc40a7-015b-6038-2093-8cd1ff0c807e@baylibre.com>
Date:   Fri, 28 Sep 2018 14:15:22 +0200
From:   Neil Armstrong <narmstrong@...libre.com>
To:     Emil Karlson <jekarlson@...il.com>,
        Emil Renner Berthing <kernel@...il.dk>,
        Stefan Adolfsson <sadolfsson@...omium.org>,
        linux-kernel@...r.kernel.org, lee.jones@...aro.org,
        bleung@...omium.org, olof@...om.net,
        Enric Balletbo i Serra <enric.balletbo@...labora.com>
Subject: Re: [PATCH] mfd: cros-ec: copy the whole event when msg->version is 0

Hi All,

On 27/09/2018 11:24, Emil Karlson wrote:
> Commit 57e94c8b974db2d83c60e1139c89a70806abbea0 caused cros-ec keyboard events
> be truncated on many chromebooks so that Left and Right keys on Column 12 were
> always 0. This commit fixes the issue by restoring the old semantics when the
> protocol version is 0.

OK for me, can someone confirms it fixes the issue ??

Thanks,
Neil

> ---
>  drivers/platform/chrome/cros_ec_proto.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
> index 398393ab5df8..457e4940dba4 100644
> --- a/drivers/platform/chrome/cros_ec_proto.c
> +++ b/drivers/platform/chrome/cros_ec_proto.c
> @@ -519,8 +519,14 @@ static int get_next_event_xfer(struct cros_ec_device *ec_dev,
>  
>  	ret = cros_ec_cmd_xfer(ec_dev, msg);
>  	if (ret > 0) {
> +		unsigned int copy_size;
> +
>  		ec_dev->event_size = ret - 1;
> -		memcpy(&ec_dev->event_data, msg->data, ec_dev->event_size);
> +		if (!version)
> +			copy_size = sizeof(struct ec_response_get_next_event);
> +		else
> +			copy_size = ec_dev->event_size;
> +		memcpy(&ec_dev->event_data, msg->data, copy_size);
>  	}
>  
>  	return ret;
>