linux-kernel - [PATCH] mfd: cros-ec: copy the whole event in get_next_event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180928170818.32124-1-jekarlson@gmail.com>
Date:   Fri, 28 Sep 2018 20:08:18 +0300
From:   Emil Karlson <jekarlson@...il.com>
To:     Emil Renner Berthing <kernel@...il.dk>,
        Neil Armstrong <narmstrong@...libre.com>,
        Stefan Adolfsson <sadolfsson@...omium.org>,
        lee.jones@...aro.org, bleung@...omium.org, olof@...om.net,
        Enric Balletbo i Serra <enric.balletbo@...labora.com>,
        linux-kernel@...r.kernel.org
Cc:     Emil Karlson <jekarlson@...il.com>
Subject: [PATCH] mfd: cros-ec: copy the whole event in get_next_event_xfer

Commit 57e94c8b974db2d83c60e1139c89a70806abbea0 caused cros-ec keyboard events
be truncated on many chromebooks so that Left and Right keys on Column 12 were
always 0. Use ret as memcpy len to fix this.

drivers/platform/chrome/cros_ec_proto.c:509
get_next_event_xfer uses ret from cros_ec_cmd_xfer for memcpy for msg->data len
drivers/platform/chrome/cros_ec_proto.c:445
cros_ec_cmd_xfer gets ret from send_command
drivers/platform/chrome/cros_ec_proto.c:93
send_command gets ret from bus specific xfer_fn
drivers/mfd/cros_ec_spi.c:598
cros_ec_cmd_xfer_spi copies len amount to ec_msg->data and returns len as ret
drivers/mfd/cros_ec_i2c.c:267
cros_ec_cmd_xfer_i2c copies len amount to ec_msg->data and returns len as ret

so msg->data length is always the same as ret.

Fixes: 57e94c8b974d ("mfd: cros-ec: Increase maximum mkbp event size")
Signed-off-by: Emil Karlson <jekarlson@...il.com>
---
 drivers/platform/chrome/cros_ec_proto.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
index 398393ab5df8..b6fd4838f60f 100644
--- a/drivers/platform/chrome/cros_ec_proto.c
+++ b/drivers/platform/chrome/cros_ec_proto.c
@@ -520,7 +520,7 @@ static int get_next_event_xfer(struct cros_ec_device *ec_dev,
 	ret = cros_ec_cmd_xfer(ec_dev, msg);
 	if (ret > 0) {
 		ec_dev->event_size = ret - 1;
-		memcpy(&ec_dev->event_data, msg->data, ec_dev->event_size);
+		memcpy(&ec_dev->event_data, msg->data, ret);
 	}
 
 	return ret;
-- 
2.19.0