[PATCH v3] hid: hid-sensor-hub: clear memory to avoid random data

[PATCH v3] hid: hid-sensor-hub: clear memory to avoid random data

[Song Hongyan]

When user tried to read some fields like hysteresis from IIO sysfs on some
systems, it fails. The reason is that this field is a byte field and caller
of sensor_hub_get_feature() passes a buffer of 4 bytes. Here the function
sensor_hub_get_feature() copies the single byte from the report to the
caller buffer and returns "1" as the number of bytes copied. So caller
can use the return value, which is actually not right.

Since this is done by multiple callers, if we change the
sensor_hub_get_feature() can make sure the caller buffer is initialized
with 0s then we don't need to change all functions.

Signed-off-by: Song Hongyan <hongyan.song@intel.com>
---
 drivers/hid/hid-sensor-hub.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 658a607..b74d954 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -252,6 +252,7 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
 	int report_size;
 	int ret = 0;
 
+	memset(buffer, 0, buffer_size);
 	mutex_lock(&data->mutex);
 	report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
 	if (!report || (field_index >= report->maxfield) ||
-- 
1.9.1

Re: [PATCH v3] hid: hid-sensor-hub: clear memory to avoid random data

[Pandruvada, Srinivas]

On Mon, 2016-11-14 at 02:09 +0000, Song Hongyan wrote:
> When user tried to read some fields like hysteresis from IIO sysfs on
> some
> systems, it fails. The reason is that this field is a byte field and
> caller
> of sensor_hub_get_feature() passes a buffer of 4 bytes. Here the
> function
> sensor_hub_get_feature() copies the single byte from the report to
> the
> caller buffer and returns "1" as the number of bytes copied.

Is the following sentence accurate?
>  So caller
> can use the return value, which is actually not right.
Caller could have used a single byte from the result buffer as this is
valid data ignoring other bytes.


> Since this is done by multiple callers, if we change the
> sensor_hub_get_feature() can make sure the caller buffer is
> initialized
> with 0s then we don't need to change all functions.
> 
> Signed-off-by: Song Hongyan <hongyan.song@intel.com>
> ---
>  drivers/hid/hid-sensor-hub.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-
> hub.c
> index 658a607..b74d954 100644
> --- a/drivers/hid/hid-sensor-hub.c
> +++ b/drivers/hid/hid-sensor-hub.c
> @@ -252,6 +252,7 @@ int sensor_hub_get_feature(struct
> hid_sensor_hub_device *hsdev, u32 report_id,
>  	int report_size;
>  	int ret = 0;
>  
> +	memset(buffer, 0, buffer_size);
>  	mutex_lock(&data->mutex);
>  	report = sensor_hub_report(report_id, hsdev->hdev,
> HID_FEATURE_REPORT);
>  	if (!report || (field_index >= report->maxfield) ||

Re: [PATCH v3] hid: hid-sensor-hub: clear memory to avoid random data

[Pandruvada, Srinivas]

T24gTW9uLCAyMDE2LTExLTE0IGF0IDAyOjA5ICswMDAwLCBTb25nIEhvbmd5YW4gd3JvdGU6DQo+
IFdoZW4gdXNlciB0cmllZCB0byByZWFkIHNvbWUgZmllbGRzIGxpa2UgaHlzdGVyZXNpcyBmcm9t
IElJTyBzeXNmcyBvbg0KPiBzb21lDQo+IHN5c3RlbXMsIGl0IGZhaWxzLiBUaGUgcmVhc29uIGlz
IHRoYXQgdGhpcyBmaWVsZCBpcyBhIGJ5dGUgZmllbGQgYW5kDQo+IGNhbGxlcg0KPiBvZiBzZW5z
b3JfaHViX2dldF9mZWF0dXJlKCkgcGFzc2VzIGEgYnVmZmVyIG9mIDQgYnl0ZXMuIEhlcmUgdGhl
DQo+IGZ1bmN0aW9uDQo+IHNlbnNvcl9odWJfZ2V0X2ZlYXR1cmUoKSBjb3BpZXMgdGhlIHNpbmds
ZSBieXRlIGZyb20gdGhlIHJlcG9ydCB0bw0KPiB0aGUNCj4gY2FsbGVyIGJ1ZmZlciBhbmQgcmV0
dXJucyAiMSIgYXMgdGhlIG51bWJlciBvZiBieXRlcyBjb3BpZWQuDQoNCklzIHRoZSBmb2xsb3dp
bmcgc2VudGVuY2UgYWNjdXJhdGU/DQo+ICBTbyBjYWxsZXINCj4gY2FuIHVzZSB0aGUgcmV0dXJu
IHZhbHVlLCB3aGljaCBpcyBhY3R1YWxseSBub3QgcmlnaHQuDQpDYWxsZXIgY291bGQgaGF2ZSB1
c2VkIGEgc2luZ2xlIGJ5dGUgZnJvbSB0aGUgcmVzdWx0IGJ1ZmZlciBhcyB0aGlzIGlzDQp2YWxp
ZCBkYXRhIGlnbm9yaW5nIG90aGVyIGJ5dGVzLg0KDQoNCj4gU2luY2UgdGhpcyBpcyBkb25lIGJ5
IG11bHRpcGxlIGNhbGxlcnMsIGlmIHdlIGNoYW5nZSB0aGUNCj4gc2Vuc29yX2h1Yl9nZXRfZmVh
dHVyZSgpIGNhbiBtYWtlIHN1cmUgdGhlIGNhbGxlciBidWZmZXIgaXMNCj4gaW5pdGlhbGl6ZWQN
Cj4gd2l0aCAwcyB0aGVuIHdlIGRvbid0IG5lZWQgdG8gY2hhbmdlIGFsbCBmdW5jdGlvbnMuDQo+
IA0KPiBTaWduZWQtb2ZmLWJ5OiBTb25nIEhvbmd5YW4gPGhvbmd5YW4uc29uZ0BpbnRlbC5jb20+
DQo+IC0tLQ0KPiDCoGRyaXZlcnMvaGlkL2hpZC1zZW5zb3ItaHViLmMgfCAxICsNCj4gwqAxIGZp
bGUgY2hhbmdlZCwgMSBpbnNlcnRpb24oKykNCj4gDQo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL2hp
ZC9oaWQtc2Vuc29yLWh1Yi5jIGIvZHJpdmVycy9oaWQvaGlkLXNlbnNvci0NCj4gaHViLmMNCj4g
aW5kZXggNjU4YTYwNy4uYjc0ZDk1NCAxMDA2NDQNCj4gLS0tIGEvZHJpdmVycy9oaWQvaGlkLXNl
bnNvci1odWIuYw0KPiArKysgYi9kcml2ZXJzL2hpZC9oaWQtc2Vuc29yLWh1Yi5jDQo+IEBAIC0y
NTIsNiArMjUyLDcgQEAgaW50IHNlbnNvcl9odWJfZ2V0X2ZlYXR1cmUoc3RydWN0DQo+IGhpZF9z
ZW5zb3JfaHViX2RldmljZSAqaHNkZXYsIHUzMiByZXBvcnRfaWQsDQo+IMKgCWludCByZXBvcnRf
c2l6ZTsNCj4gwqAJaW50IHJldCA9IDA7DQo+IMKgDQo+ICsJbWVtc2V0KGJ1ZmZlciwgMCwgYnVm
ZmVyX3NpemUpOw0KPiDCoAltdXRleF9sb2NrKCZkYXRhLT5tdXRleCk7DQo+IMKgCXJlcG9ydCA9
IHNlbnNvcl9odWJfcmVwb3J0KHJlcG9ydF9pZCwgaHNkZXYtPmhkZXYsDQo+IEhJRF9GRUFUVVJF
X1JFUE9SVCk7DQo+IMKgCWlmICghcmVwb3J0IHx8IChmaWVsZF9pbmRleCA+PSByZXBvcnQtPm1h
eGZpZWxkKSB8fA==