From: Alexander Potapenko <glider@google.com>
To: dmitry.torokhov@gmail.com
Cc: dvyukov@google.com, elver@google.com,
linux-input@vger.kernel.org,
Alexander Potapenko <glider@google.com>
Subject: [PATCH] Input: psmouse: check the result of PSMOUSE_CMD_GET* commands
Date: Mon, 29 Nov 2021 15:38:45 +0100 [thread overview]
Message-ID: <20211129143845.1472453-1-glider@google.com> (raw)
Execution of a PSMOUSE_CMD_GET* command may fail, leaving the output
buffer uninitialized. Make sure to check the return value of
ps2_command() and bail out before checking the buffer contents.
The use of uninitialized data in genius_detect() was detected by KMSAN,
other places were fixed for the sake of uniformity.
Signed-off-by: Alexander Potapenko <glider@google.com>
---
drivers/input/mouse/psmouse-base.c | 21 ++++++++++++++++-----
1 file changed, 16 insertions(+), 5 deletions(-)
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 0b4a3039f312f..a3305653ce891 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -546,13 +546,16 @@ static int genius_detect(struct psmouse *psmouse, bool set_properties)
{
struct ps2dev *ps2dev = &psmouse->ps2dev;
u8 param[4];
+ int error;
param[0] = 3;
ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES);
ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE11);
ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE11);
ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE11);
- ps2_command(ps2dev, param, PSMOUSE_CMD_GETINFO);
+ error = ps2_command(ps2dev, param, PSMOUSE_CMD_GETINFO);
+ if (error)
+ return error;
if (param[0] != 0x00 || param[1] != 0x33 || param[2] != 0x55)
return -ENODEV;
@@ -578,6 +581,7 @@ static int intellimouse_detect(struct psmouse *psmouse, bool set_properties)
{
struct ps2dev *ps2dev = &psmouse->ps2dev;
u8 param[2];
+ int error;
param[0] = 200;
ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
@@ -585,7 +589,9 @@ static int intellimouse_detect(struct psmouse *psmouse, bool set_properties)
ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
param[0] = 80;
ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
- ps2_command(ps2dev, param, PSMOUSE_CMD_GETID);
+ error = ps2_command(ps2dev, param, PSMOUSE_CMD_GETID);
+ if (error)
+ return error;
if (param[0] != 3)
return -ENODEV;
@@ -611,6 +617,7 @@ static int im_explorer_detect(struct psmouse *psmouse, bool set_properties)
{
struct ps2dev *ps2dev = &psmouse->ps2dev;
u8 param[2];
+ int error;
intellimouse_detect(psmouse, 0);
@@ -620,7 +627,9 @@ static int im_explorer_detect(struct psmouse *psmouse, bool set_properties)
ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
param[0] = 80;
ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
- ps2_command(ps2dev, param, PSMOUSE_CMD_GETID);
+ error = ps2_command(ps2dev, param, PSMOUSE_CMD_GETID);
+ if (error)
+ return error;
if (param[0] != 4)
return -ENODEV;
@@ -658,7 +667,7 @@ static int thinking_detect(struct psmouse *psmouse, bool set_properties)
struct ps2dev *ps2dev = &psmouse->ps2dev;
u8 param[2];
static const u8 seq[] = { 20, 60, 40, 20, 20, 60, 40, 20, 20 };
- int i;
+ int error, i;
param[0] = 10;
ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
@@ -668,7 +677,9 @@ static int thinking_detect(struct psmouse *psmouse, bool set_properties)
param[0] = seq[i];
ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
}
- ps2_command(ps2dev, param, PSMOUSE_CMD_GETID);
+ error = ps2_command(ps2dev, param, PSMOUSE_CMD_GETID);
+ if (error)
+ return error;
if (param[0] != 2)
return -ENODEV;
--
2.34.0.rc2.393.gf8c9666880-goog
next reply other threads:[~2021-11-29 17:48 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-29 14:38 Alexander Potapenko [this message]
2021-12-11 2:54 ` [PATCH] Input: psmouse: check the result of PSMOUSE_CMD_GET* commands Dmitry Torokhov
2021-12-13 11:26 ` Alexander Potapenko
2021-12-13 11:32 ` Alexander Potapenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211129143845.1472453-1-glider@google.com \
--to=glider@google.com \
--cc=dmitry.torokhov@gmail.com \
--cc=dvyukov@google.com \
--cc=elver@google.com \
--cc=linux-input@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.