linux-kernel - [PATCH] Input: spaceball - fix parsing of movement data packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 26 Jul 2021 21:06:24 -0700
From:   "Leo L. Schwab" <ewhac@...ac.org>
To:     Dmitry Torokhov <dmitry.torokhov@...il.com>
Cc:     ewhac@...ac.org, linux-input@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH] Input: spaceball - fix parsing of movement data packets

The spaceball.c module was not properly parsing the movement reports
coming from the device.  The code read axis data as signed 16-bit
little-endian values starting at offset 2.

In fact, axis data in Spaceball movement reports are signed 16-bit
big-endian values starting at offset 3.  This was determined first by
visually inspecting the data packets, and later verified by consulting:
http://spacemice.org/pdf/SpaceBall_2003-3003_Protocol.pdf

If this ever worked properly, it was in the time before Git...

Signed-off-by: Leo L. Schwab <ewhac@...ac.org>
---
 drivers/input/joystick/spaceball.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/input/joystick/spaceball.c b/drivers/input/joystick/spaceball.c
index 429411c6c0a8..43bfb3d2fa8a 100644
--- a/drivers/input/joystick/spaceball.c
+++ b/drivers/input/joystick/spaceball.c
@@ -74,10 +74,20 @@ static void spaceball_process_packet(struct spaceball* spaceball)
 	switch (spaceball->data[0]) {
 
 		case 'D':					/* Ball data */
+			/*
+			 * Skip first three bytes; read six axes worth of data.
+			 * Axis values are signed 16-bit big-endian.
+			 */
 			if (spaceball->idx != 15) return;
-			for (i = 0; i < 6; i++)
-				input_report_abs(dev, spaceball_axes[i],
-					(__s16)((data[2 * i + 3] << 8) | data[2 * i + 2]));
+			data += 3;
+			for (i = 0;
+			     i < ARRAY_SIZE(spaceball_axes);
+			     ++i, data += sizeof(__s16)) {
+				input_report_abs(
+					dev,
+					spaceball_axes[i],
+					(__s16)((data[0] << 8) | data[1]));
+			}
 			break;
 
 		case 'K':					/* Button data */
-- 
2.32.0