* [PATCH v2] hid-appleir: Fix kernel panic due to null pointer
@ 2014-07-01 2:14 Nicholas Krause
2014-07-01 6:39 ` Jiri Kosina
0 siblings, 1 reply; 5+ messages in thread
From: Nicholas Krause @ 2014-07-01 2:14 UTC (permalink / raw)
To: jkosina; +Cc: linux-input, linux-kernel
Fixes a null pointer in appleir_input_configured due to reading
into wrong size array. Changed the variable to input_dev->keycodemax.
Signed-off-by: Nicholas Krause <xerofoify@gmail.com>
---
drivers/hid/hid-appleir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/hid-appleir.c b/drivers/hid/hid-appleir.c
index 0e6a42d..cc02df4 100644
--- a/drivers/hid/hid-appleir.c
+++ b/drivers/hid/hid-appleir.c
@@ -272,7 +272,7 @@ static void appleir_input_configured(struct hid_device *hid,
input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_REP);
memcpy(appleir->keymap, appleir_key_table, sizeof(appleir->keymap));
- for (i = 0; i < ARRAY_SIZE(appleir_key_table); i++)
+ for (i = 0; i < appleir->keymap; i++)
set_bit(appleir->keymap[i], input_dev->keybit);
clear_bit(KEY_RESERVED, input_dev->keybit);
}
--
1.9.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v2] hid-appleir: Fix kernel panic due to null pointer
2014-07-01 2:14 [PATCH v2] hid-appleir: Fix kernel panic due to null pointer Nicholas Krause
@ 2014-07-01 6:39 ` Jiri Kosina
2014-07-01 6:50 ` Mateusz Guzik
0 siblings, 1 reply; 5+ messages in thread
From: Jiri Kosina @ 2014-07-01 6:39 UTC (permalink / raw)
To: Nicholas Krause; +Cc: linux-input, linux-kernel
On Mon, 30 Jun 2014, Nicholas Krause wrote:
> Fixes a null pointer in appleir_input_configured due to reading
> into wrong size array. Changed the variable to input_dev->keycodemax.
This is a stale changelog from the previous buggy version.
> Signed-off-by: Nicholas Krause <xerofoify@gmail.com>
> ---
> drivers/hid/hid-appleir.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hid/hid-appleir.c b/drivers/hid/hid-appleir.c
> index 0e6a42d..cc02df4 100644
> --- a/drivers/hid/hid-appleir.c
> +++ b/drivers/hid/hid-appleir.c
> @@ -272,7 +272,7 @@ static void appleir_input_configured(struct hid_device *hid,
> input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_REP);
>
> memcpy(appleir->keymap, appleir_key_table, sizeof(appleir->keymap));
> - for (i = 0; i < ARRAY_SIZE(appleir_key_table); i++)
> + for (i = 0; i < appleir->keymap; i++)
This is wrong. appleir->keymap is an array, and you want to count its
elements.
Third time is the charm perhaps?
--
Jiri Kosina
SUSE Labs
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] hid-appleir: Fix kernel panic due to null pointer
2014-07-01 6:39 ` Jiri Kosina
@ 2014-07-01 6:50 ` Mateusz Guzik
2014-07-01 6:55 ` Jiri Kosina
0 siblings, 1 reply; 5+ messages in thread
From: Mateusz Guzik @ 2014-07-01 6:50 UTC (permalink / raw)
To: Jiri Kosina; +Cc: Nicholas Krause, linux-input, linux-kernel
On Tue, Jul 01, 2014 at 08:39:06AM +0200, Jiri Kosina wrote:
> On Mon, 30 Jun 2014, Nicholas Krause wrote:
>
> > Fixes a null pointer in appleir_input_configured due to reading
> > into wrong size array. Changed the variable to input_dev->keycodemax.
>
> This is a stale changelog from the previous buggy version.
>
> > Signed-off-by: Nicholas Krause <xerofoify@gmail.com>
> > ---
> > drivers/hid/hid-appleir.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/hid/hid-appleir.c b/drivers/hid/hid-appleir.c
> > index 0e6a42d..cc02df4 100644
> > --- a/drivers/hid/hid-appleir.c
> > +++ b/drivers/hid/hid-appleir.c
> > @@ -272,7 +272,7 @@ static void appleir_input_configured(struct hid_device *hid,
> > input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_REP);
> >
> > memcpy(appleir->keymap, appleir_key_table, sizeof(appleir->keymap));
> > - for (i = 0; i < ARRAY_SIZE(appleir_key_table); i++)
> > + for (i = 0; i < appleir->keymap; i++)
>
> This is wrong. appleir->keymap is an array, and you want to count its
> elements.
>
But where the claim of 'null pointer' is coming from (or reading/writing
past the array for that matter)?
Replacing appleir_key_table with appleir->keymap is a noop anyway
because:
unsigned short keymap[ARRAY_SIZE(appleir_key_table)];
although one may argue is slightly nicer since it is used in memcpy line
earlier.
--
Mateusz Guzik
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] hid-appleir: Fix kernel panic due to null pointer
2014-07-01 6:50 ` Mateusz Guzik
@ 2014-07-01 6:55 ` Jiri Kosina
2014-07-01 22:21 ` Nick Krause
0 siblings, 1 reply; 5+ messages in thread
From: Jiri Kosina @ 2014-07-01 6:55 UTC (permalink / raw)
To: Mateusz Guzik; +Cc: Nicholas Krause, linux-input, linux-kernel
On Tue, 1 Jul 2014, Mateusz Guzik wrote:
> > > Fixes a null pointer in appleir_input_configured due to reading
> > > into wrong size array. Changed the variable to input_dev->keycodemax.
> >
> > This is a stale changelog from the previous buggy version.
> >
> > > Signed-off-by: Nicholas Krause <xerofoify@gmail.com>
> > > ---
> > > drivers/hid/hid-appleir.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/hid/hid-appleir.c b/drivers/hid/hid-appleir.c
> > > index 0e6a42d..cc02df4 100644
> > > --- a/drivers/hid/hid-appleir.c
> > > +++ b/drivers/hid/hid-appleir.c
> > > @@ -272,7 +272,7 @@ static void appleir_input_configured(struct hid_device *hid,
> > > input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_REP);
> > >
> > > memcpy(appleir->keymap, appleir_key_table, sizeof(appleir->keymap));
> > > - for (i = 0; i < ARRAY_SIZE(appleir_key_table); i++)
> > > + for (i = 0; i < appleir->keymap; i++)
> >
> > This is wrong. appleir->keymap is an array, and you want to count its
> > elements.
> >
>
> But where the claim of 'null pointer' is coming from (or reading/writing
> past the array for that matter)?
>
> Replacing appleir_key_table with appleir->keymap is a noop anyway
> because:
> unsigned short keymap[ARRAY_SIZE(appleir_key_table)];
It's not really equivalent. ARRAY_SIZE counts the number of short-sized
elements, sizeof() counts the number of bytes that fit into the data
structure (which is twice as much, as sizeof(unsigned short) == 2).
--
Jiri Kosina
SUSE Labs
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] hid-appleir: Fix kernel panic due to null pointer
2014-07-01 6:55 ` Jiri Kosina
@ 2014-07-01 22:21 ` Nick Krause
0 siblings, 0 replies; 5+ messages in thread
From: Nick Krause @ 2014-07-01 22:21 UTC (permalink / raw)
To: Jiri Kosina; +Cc: Mateusz Guzik, linux-input, linux-kernel@vger.kernel.org
So I am wondering them should I can it to sizeof(appleir_keymap)?
Nick
On Tue, Jul 1, 2014 at 2:55 AM, Jiri Kosina <jkosina@suse.cz> wrote:
> On Tue, 1 Jul 2014, Mateusz Guzik wrote:
>
>> > > Fixes a null pointer in appleir_input_configured due to reading
>> > > into wrong size array. Changed the variable to input_dev->keycodemax.
>> >
>> > This is a stale changelog from the previous buggy version.
>> >
>> > > Signed-off-by: Nicholas Krause <xerofoify@gmail.com>
>> > > ---
>> > > drivers/hid/hid-appleir.c | 2 +-
>> > > 1 file changed, 1 insertion(+), 1 deletion(-)
>> > >
>> > > diff --git a/drivers/hid/hid-appleir.c b/drivers/hid/hid-appleir.c
>> > > index 0e6a42d..cc02df4 100644
>> > > --- a/drivers/hid/hid-appleir.c
>> > > +++ b/drivers/hid/hid-appleir.c
>> > > @@ -272,7 +272,7 @@ static void appleir_input_configured(struct hid_device *hid,
>> > > input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_REP);
>> > >
>> > > memcpy(appleir->keymap, appleir_key_table, sizeof(appleir->keymap));
>> > > - for (i = 0; i < ARRAY_SIZE(appleir_key_table); i++)
>> > > + for (i = 0; i < appleir->keymap; i++)
>> >
>> > This is wrong. appleir->keymap is an array, and you want to count its
>> > elements.
>> >
>>
>> But where the claim of 'null pointer' is coming from (or reading/writing
>> past the array for that matter)?
>>
>> Replacing appleir_key_table with appleir->keymap is a noop anyway
>> because:
>> unsigned short keymap[ARRAY_SIZE(appleir_key_table)];
>
> It's not really equivalent. ARRAY_SIZE counts the number of short-sized
> elements, sizeof() counts the number of bytes that fit into the data
> structure (which is twice as much, as sizeof(unsigned short) == 2).
>
> --
> Jiri Kosina
> SUSE Labs
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2014-07-01 22:21 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-07-01 2:14 [PATCH v2] hid-appleir: Fix kernel panic due to null pointer Nicholas Krause
2014-07-01 6:39 ` Jiri Kosina
2014-07-01 6:50 ` Mateusz Guzik
2014-07-01 6:55 ` Jiri Kosina
2014-07-01 22:21 ` Nick Krause
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).