linux-kernel - Re: [PATCH 1/3] hwmon: (corsair-cpro) Use a separate buffer for sending commands

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 04 May 2024 14:14:18 +0200
From: Marius Zachmann <mail@...iuszachmann.de>
To: linux-hwmon@...r.kernel.org, Aleksa Savic <savicaleksa83@...il.com>
Cc: Jonas Malaco <jonas@...tocubo.io>, Aleksa Savic <savicaleksa83@...il.com>,
 Jean Delvare <jdelvare@...e.com>, Guenter Roeck <linux@...ck-us.net>,
 linux-kernel@...r.kernel.org
Subject:
 Re: [PATCH 1/3] hwmon: (corsair-cpro) Use a separate buffer for sending
 commands

On 04.05.24 at 11:25:01 MESZ, Aleksa Savic wrote
> Introduce cmd_buffer, a separate buffer for storing only
> the command that is sent to the device. Before this separation,
> the existing buffer was shared for both the command and the
> report received in ccp_raw_event(), which was copied into it.
> 
> However, because of hidraw, the raw event parsing may be triggered
> in the middle of sending a command, resulting in outputting gibberish
> to the device. Using a separate buffer resolves this.
> 
> Fixes: 40c3a4454225 ("hwmon: add Corsair Commander Pro driver")
> Signed-off-by: Aleksa Savic <savicaleksa83@...il.com>
> ---
>  drivers/hwmon/corsair-cpro.c | 19 ++++++++++++-------
>  1 file changed, 12 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/hwmon/corsair-cpro.c b/drivers/hwmon/corsair-cpro.c
> index a284a02839fb..8d85f66f8143 100644
> --- a/drivers/hwmon/corsair-cpro.c
> +++ b/drivers/hwmon/corsair-cpro.c
> @@ -79,6 +79,7 @@ struct ccp_device {
>  	struct device *hwmon_dev;
>  	struct completion wait_input_report;
>  	struct mutex mutex; /* whenever buffer is used, lock before send_usb_cmd */
> +	u8 *cmd_buffer;
>  	u8 *buffer;
>  	int target[6];
>  	DECLARE_BITMAP(temp_cnct, NUM_TEMP_SENSORS);
> @@ -111,15 +112,15 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2,
>  	unsigned long t;
>  	int ret;
>  
> -	memset(ccp->buffer, 0x00, OUT_BUFFER_SIZE);
> -	ccp->buffer[0] = command;
> -	ccp->buffer[1] = byte1;
> -	ccp->buffer[2] = byte2;
> -	ccp->buffer[3] = byte3;
> +	memset(ccp->cmd_buffer, 0x00, OUT_BUFFER_SIZE);
> +	ccp->cmd_buffer[0] = command;
> +	ccp->cmd_buffer[1] = byte1;
> +	ccp->cmd_buffer[2] = byte2;
> +	ccp->cmd_buffer[3] = byte3;
>  
>  	reinit_completion(&ccp->wait_input_report);
>  
> -	ret = hid_hw_output_report(ccp->hdev, ccp->buffer, OUT_BUFFER_SIZE);
> +	ret = hid_hw_output_report(ccp->hdev, ccp->cmd_buffer, OUT_BUFFER_SIZE);
>  	if (ret < 0)
>  		return ret;
>  
> @@ -492,7 +493,11 @@ static int ccp_probe(struct hid_device *hdev, const struct hid_device_id *id)
>  	if (!ccp)
>  		return -ENOMEM;
>  
> -	ccp->buffer = devm_kmalloc(&hdev->dev, OUT_BUFFER_SIZE, GFP_KERNEL);
> +	ccp->cmd_buffer = devm_kmalloc(&hdev->dev, OUT_BUFFER_SIZE, GFP_KERNEL);
> +	if (!ccp->cmd_buffer)
> +		return -ENOMEM;
> +
> +	ccp->buffer = devm_kmalloc(&hdev->dev, IN_BUFFER_SIZE, GFP_KERNEL);
>  	if (!ccp->buffer)
>  		return -ENOMEM;
>  
> 

Thank you!
Acked-by: Marius Zachmann <mail@...iuszachmann.de>