linux-kernel - [PATCH v2] Input: spaceball - fix parsing of movement data packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 21 Dec 2021 02:16:31 -0800
From:   "Leo L. Schwab" <ewhac@...ac.org>
To:     Dmitry Torokhov <dmitry.torokhov@...il.com>,
        "Leo L. Schwab" <ewhac@...ac.org>, linux-input@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH v2] Input: spaceball - fix parsing of movement data packets

The spaceball.c module was not properly parsing the movement reports
coming from the device.  The code read axis data as signed 16-bit
little-endian values starting at offset 2.

In fact, axis data in Spaceball movement reports are signed 16-bit
big-endian values starting at offset 3.  This was determined first by
visually inspecting the data packets, and later verified by consulting:
http://spacemice.org/pdf/SpaceBall_2003-3003_Protocol.pdf

If this ever worked properly, it was in the time before Git...

Signed-off-by: Leo L. Schwab <ewhac@...ac.org>
---
Changes in v2:
  - Coding style changes requested by <dmitry.torokhov@...il.com>.

 drivers/input/joystick/spaceball.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/input/joystick/spaceball.c b/drivers/input/joystick/spaceball.c
index 429411c6c0a8..10e09c86e067 100644
--- a/drivers/input/joystick/spaceball.c
+++ b/drivers/input/joystick/spaceball.c
@@ -19,6 +19,7 @@
 #include <linux/module.h>
 #include <linux/input.h>
 #include <linux/serio.h>
+#include <asm/unaligned.h>
 
 #define DRIVER_DESC	"SpaceTec SpaceBall 2003/3003/4000 FLX driver"
 
@@ -74,10 +75,16 @@ static void spaceball_process_packet(struct spaceball* spaceball)
 	switch (spaceball->data[0]) {
 
 		case 'D':					/* Ball data */
+			/*
+			 * Skip first three bytes; read six axes worth of data.
+			 * Axis values are signed 16-bit big-endian.
+			 */
 			if (spaceball->idx != 15) return;
-			for (i = 0; i < 6; i++)
+			data += 3;
+			for (i = 0;  i < ARRAY_SIZE(spaceball_axes);  ++i) {
 				input_report_abs(dev, spaceball_axes[i],
-					(__s16)((data[2 * i + 3] << 8) | data[2 * i + 2]));
+					(__s16)get_unaligned_be16(&data[i * 2]));
+			}
 			break;
 
 		case 'K':					/* Button data */
-- 
2.34.1