linux-kernel - Re: [PATCH] HID: vivaldi: fix handling devices not using numbered reports

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <nycvar.YFH.7.76.2201140932160.28059@cbobk.fhfr.pm>
Date:   Fri, 14 Jan 2022 09:33:12 +0100 (CET)
From:   Jiri Kosina <jikos@...nel.org>
To:     Dmitry Torokhov <dmitry.torokhov@...il.com>
cc:     Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        Sean O'Brien <seobrien@...omium.org>,
        Ting Shen <phoenixshen@...gle.com>,
        Stephen Boyd <swboyd@...gle.com>, linux-input@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] HID: vivaldi: fix handling devices not using numbered
 reports

On Fri, 7 Jan 2022, Dmitry Torokhov wrote:

> Unfortunately details of USB HID transport bled into HID core and
> handling of numbered/unnumbered reports is quite a mess, with
> hid_report_len() calculating the length according to USB rules,
> and hid_hw_raw_request() adding report ID to the buffer for both
> numbered and unnumbered reports.

Yeah, I agree that's unfortunate, and untangling this has been on my TODO 
for quite some time :/

> Fixes: 14c9c014babe ("HID: add vivaldi HID driver")
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@...il.com>
> ---
> 
> CrOS folks, please help testing this as I do not have the affected
> hardware.
> 
> Thanks!
> 
>  drivers/hid/hid-vivaldi.c | 34 ++++++++++++++++++++++++++++------
>  1 file changed, 28 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/hid/hid-vivaldi.c b/drivers/hid/hid-vivaldi.c
> index cd7ada48b1d9..1804de1ef9b8 100644
> --- a/drivers/hid/hid-vivaldi.c
> +++ b/drivers/hid/hid-vivaldi.c
> @@ -71,10 +71,11 @@ static void vivaldi_feature_mapping(struct hid_device *hdev,
>  				    struct hid_usage *usage)
>  {
>  	struct vivaldi_data *drvdata = hid_get_drvdata(hdev);
> +	struct hid_report *report = field->report;
>  	int fn_key;
>  	int ret;
>  	u32 report_len;
> -	u8 *buf;
> +	u8 *report_data, *buf;
>  
>  	if (field->logical != HID_USAGE_FN_ROW_PHYSMAP ||
>  	    (usage->hid & HID_USAGE_PAGE) != HID_UP_ORDINAL)
> @@ -86,12 +87,24 @@ static void vivaldi_feature_mapping(struct hid_device *hdev,
>  	if (fn_key > drvdata->max_function_row_key)
>  		drvdata->max_function_row_key = fn_key;
>  
> -	buf = hid_alloc_report_buf(field->report, GFP_KERNEL);
> -	if (!buf)
> +	report_data = buf = hid_alloc_report_buf(report, GFP_KERNEL);
> +	if (!report_data)
>  		return;
>  
> -	report_len = hid_report_len(field->report);
> -	ret = hid_hw_raw_request(hdev, field->report->id, buf,
> +	report_len = hid_report_len(report);
> +	if (!report->id) {
> +		/*
> +		 * hid_hw_raw_request() will stuff report ID (which will be 0)
> +		 * into the first byte of the buffer even for unnumbered
> +		 * reports, so we need to account for this to avoid getting
> +		 * -EOVERFLOW in return.
> +		 * Note that hid_alloc_report_buf() adds 7 bytes to the size
> +		 * so we can safely say that we have space for an extra byte.
> +		 */
> +		report_len++;
> +	}
> +
> +	ret = hid_hw_raw_request(hdev, field->report->id, report_data,

I've changed this to report->id and applied, thanks.

-- 
Jiri Kosina
SUSE Labs