linux-kernel - Re: [PATCH] hid: Add support for the xp-pen deco mini7 tablet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 25 Jun 2022 17:24:38 +0200
From:   José Expósito <jose.exposito89@...il.com>
To:     Nikolai Kondrashov <spbnick@...il.com>
Cc:     Stefan Berzl <stefanberzl@...il.com>,
        Jiri Kosina <jikos@...nel.org>, benjamin.tissoires@...hat.com,
        linux-input@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] hid: Add support for the xp-pen deco mini7 tablet

Hi Nickolai,

Nikolai Kondrashov wrote:
> I think it's OK to just ignore the first packet for these devices, even if the
> ACK packet is not sent for some of them. Even with the report rate of 20 years
> ago nobody would've noticed if you dropped one packet.

A bit more of context about this initial packet:

These XP-PEN devices need to receive a packet of data to be fully functional.
The driver sends it:

	02 b0 04 00 00 00 00 00 00 00

And in response to the activation packet, the tablet sends an ACK:

	02 b1 04 00 00 00 00 00 00 00

In my case the packet is ignored but on Stepfan's tablet, this packet sends to
mouse pointer to the 0,0 coordinates.

Looking at the data he added to his last email, his tablet ACK has 2 extra
bytes, making it match the size of a pen report.
Because the ACK packet starts with 02 it looks like it is  interpreted as a pen
report with all values set to 0, including X and Y.

We are not worried about a packet being dropped, we would like to filter the
ACK so it does not get handled as a pen report. This should allow to
avoid sending the pointer to 0,0 on device connection.

It is not a super anoying bug, but it'll be nice if we could avoid it.

Best wishes,
Jose