linux-kernel - Re: [PATCH] mfd: cros-ec: copy the whole event in get_next_event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 28 Sep 2018 20:16:21 +0300
From:   Emil Karlson <jekarlson@...il.com>
To:     Emil Renner Berthing <kernel@...il.dk>,
        Neil Armstrong <narmstrong@...libre.com>,
        Stefan Adolfsson <sadolfsson@...omium.org>,
        Lee Jones <lee.jones@...aro.org>, bleung@...omium.org,
        olof@...om.net,
        Enric Balletbo i Serra <enric.balletbo@...labora.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mfd: cros-ec: copy the whole event in get_next_event_xfer

I failed in In-Reply-To:
<22cc40a7-015b-6038-2093-8cd1ff0c807e@...libre.com> somehow.

I was urged to go for correct rather than conservative fix on IRC. I
have tested this on my message
version 0 Kevin and it fixes the original problem for me, but someone
should perhaps test this on
newer system that has message version 1. Background work documented in
commit message.

Best regards
-Emil
On Fri, Sep 28, 2018 at 8:08 PM Emil Karlson <jekarlson@...il.com> wrote:
>
> Commit 57e94c8b974db2d83c60e1139c89a70806abbea0 caused cros-ec keyboard events
> be truncated on many chromebooks so that Left and Right keys on Column 12 were
> always 0. Use ret as memcpy len to fix this.
>
> drivers/platform/chrome/cros_ec_proto.c:509
> get_next_event_xfer uses ret from cros_ec_cmd_xfer for memcpy for msg->data len
> drivers/platform/chrome/cros_ec_proto.c:445
> cros_ec_cmd_xfer gets ret from send_command
> drivers/platform/chrome/cros_ec_proto.c:93
> send_command gets ret from bus specific xfer_fn
> drivers/mfd/cros_ec_spi.c:598
> cros_ec_cmd_xfer_spi copies len amount to ec_msg->data and returns len as ret
> drivers/mfd/cros_ec_i2c.c:267
> cros_ec_cmd_xfer_i2c copies len amount to ec_msg->data and returns len as ret
>
> so msg->data length is always the same as ret.
>
> Fixes: 57e94c8b974d ("mfd: cros-ec: Increase maximum mkbp event size")
> Signed-off-by: Emil Karlson <jekarlson@...il.com>
> ---
>  drivers/platform/chrome/cros_ec_proto.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
> index 398393ab5df8..b6fd4838f60f 100644
> --- a/drivers/platform/chrome/cros_ec_proto.c
> +++ b/drivers/platform/chrome/cros_ec_proto.c
> @@ -520,7 +520,7 @@ static int get_next_event_xfer(struct cros_ec_device *ec_dev,
>         ret = cros_ec_cmd_xfer(ec_dev, msg);
>         if (ret > 0) {
>                 ec_dev->event_size = ret - 1;
> -               memcpy(&ec_dev->event_data, msg->data, ec_dev->event_size);
> +               memcpy(&ec_dev->event_data, msg->data, ret);
>         }
>
>         return ret;
> --
> 2.19.0
>