linux-kernel - [PATCH v3] mfd: cros-ec: copy the whole event in get_next_event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20181003184318.856-1-jekarlson@gmail.com>
Date:   Wed,  3 Oct 2018 21:43:18 +0300
From:   Emil Karlson <jekarlson@...il.com>
To:     Emil Renner Berthing <kernel@...il.dk>,
        Neil Armstrong <narmstrong@...libre.com>,
        Stefan Adolfsson <sadolfsson@...omium.org>,
        lee.jones@...aro.org, bleung@...omium.org, olof@...om.net,
        Enric Balletbo i Serra <enric.balletbo@...labora.com>,
        linux-kernel@...r.kernel.org
Cc:     Emil Karlson <jekarlson@...il.com>
Subject: [PATCH v3] mfd: cros-ec: copy the whole event in get_next_event_xfer

Commit 57e94c8b974db2d83c60e1139c89a70806abbea0 caused cros-ec keyboard events
be truncated on many chromebooks so that Left and Right keys on Column 12 were
always 0. Use ret as memcpy len to fix this.

The old code was using ec_dev->event_size, which is the event payload/data size
excluding event_type header, for the length of the memcpy operation. Use ret
as memcpy length to avoid the off by one and copy the whole msg->data.

Fixes: 57e94c8b974d ("mfd: cros-ec: Increase maximum mkbp event size")

Acked-by: Enric Balletbo i Serra <enric.balletbo@...labora.com>
Tested-by: Emil Renner Berthing <kernel@...il.dk>
Signed-off-by: Emil Karlson <jekarlson@...il.com>
---

Notes:
    Changes in v3
    - Improve commit message.
    Changes in v2
    - Fix the off by one in memcpy parameter rather than restoring the old behaviour
      for v0 messages.

 drivers/platform/chrome/cros_ec_proto.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
index 398393ab5df8..b6fd4838f60f 100644
--- a/drivers/platform/chrome/cros_ec_proto.c
+++ b/drivers/platform/chrome/cros_ec_proto.c
@@ -520,7 +520,7 @@ static int get_next_event_xfer(struct cros_ec_device *ec_dev,
 	ret = cros_ec_cmd_xfer(ec_dev, msg);
 	if (ret > 0) {
 		ec_dev->event_size = ret - 1;
-		memcpy(&ec_dev->event_data, msg->data, ec_dev->event_size);
+		memcpy(&ec_dev->event_data, msg->data, ret);
 	}
 
 	return ret;
-- 
2.19.0