* [PATCH] HID: i2c-hid: Limit reads to wMaxInputLength bytes for input events
@ 2015-02-20 17:45 Seth Forshee
2015-02-20 19:38 ` Benjamin Tissoires
2015-02-23 14:10 ` Jiri Kosina
0 siblings, 2 replies; 3+ messages in thread
From: Seth Forshee @ 2015-02-20 17:45 UTC (permalink / raw)
To: Jiri Kosina; +Cc: linux-input, linux-kernel, Seth Forshee, Benjamin Tissoires
d1c7e29e8d27 (HID: i2c-hid: prevent buffer overflow in early IRQ)
changed hid_get_input() to read ihid->bufsize bytes, which can be
more than wMaxInputLength. This is the case with the Dell XPS 13
9343, and it is causing events to be missed. In some cases the
missed events are releases, which can cause the cursor to jump or
freeze, among other problems. Limit the number of bytes read to
min(wMaxInputLength, ihid->bufsize) to prevent such problems.
Fixes: d1c7e29e8d27 "HID: i2c-hid: prevent buffer overflow in early IRQ"
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
---
drivers/hid/i2c-hid/i2c-hid.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index d43e967..5e72fc2 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -370,7 +370,10 @@ static int i2c_hid_hwreset(struct i2c_client *client)
static void i2c_hid_get_input(struct i2c_hid *ihid)
{
int ret, ret_size;
- int size = ihid->bufsize;
+ int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
+
+ if (size > ihid->bufsize)
+ size = ihid->bufsize;
ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
if (ret != size) {
--
1.9.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] HID: i2c-hid: Limit reads to wMaxInputLength bytes for input events
2015-02-20 17:45 [PATCH] HID: i2c-hid: Limit reads to wMaxInputLength bytes for input events Seth Forshee
@ 2015-02-20 19:38 ` Benjamin Tissoires
2015-02-23 14:10 ` Jiri Kosina
1 sibling, 0 replies; 3+ messages in thread
From: Benjamin Tissoires @ 2015-02-20 19:38 UTC (permalink / raw)
To: Seth Forshee; +Cc: Jiri Kosina, linux-input, linux-kernel
On Feb 20 2015 or thereabouts, Seth Forshee wrote:
> d1c7e29e8d27 (HID: i2c-hid: prevent buffer overflow in early IRQ)
> changed hid_get_input() to read ihid->bufsize bytes, which can be
> more than wMaxInputLength. This is the case with the Dell XPS 13
> 9343, and it is causing events to be missed. In some cases the
> missed events are releases, which can cause the cursor to jump or
> freeze, among other problems. Limit the number of bytes read to
> min(wMaxInputLength, ihid->bufsize) to prevent such problems.
>
> Fixes: d1c7e29e8d27 "HID: i2c-hid: prevent buffer overflow in early IRQ"
> Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Thanks!
Benjamin
> ---
> drivers/hid/i2c-hid/i2c-hid.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
> index d43e967..5e72fc2 100644
> --- a/drivers/hid/i2c-hid/i2c-hid.c
> +++ b/drivers/hid/i2c-hid/i2c-hid.c
> @@ -370,7 +370,10 @@ static int i2c_hid_hwreset(struct i2c_client *client)
> static void i2c_hid_get_input(struct i2c_hid *ihid)
> {
> int ret, ret_size;
> - int size = ihid->bufsize;
> + int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
> +
> + if (size > ihid->bufsize)
> + size = ihid->bufsize;
>
> ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
> if (ret != size) {
> --
> 1.9.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] HID: i2c-hid: Limit reads to wMaxInputLength bytes for input events
2015-02-20 17:45 [PATCH] HID: i2c-hid: Limit reads to wMaxInputLength bytes for input events Seth Forshee
2015-02-20 19:38 ` Benjamin Tissoires
@ 2015-02-23 14:10 ` Jiri Kosina
1 sibling, 0 replies; 3+ messages in thread
From: Jiri Kosina @ 2015-02-23 14:10 UTC (permalink / raw)
To: Seth Forshee; +Cc: linux-input, linux-kernel, Benjamin Tissoires
On Fri, 20 Feb 2015, Seth Forshee wrote:
> d1c7e29e8d27 (HID: i2c-hid: prevent buffer overflow in early IRQ)
> changed hid_get_input() to read ihid->bufsize bytes, which can be
> more than wMaxInputLength. This is the case with the Dell XPS 13
> 9343, and it is causing events to be missed. In some cases the
> missed events are releases, which can cause the cursor to jump or
> freeze, among other problems. Limit the number of bytes read to
> min(wMaxInputLength, ihid->bufsize) to prevent such problems.
>
> Fixes: d1c7e29e8d27 "HID: i2c-hid: prevent buffer overflow in early IRQ"
> Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
> ---
> drivers/hid/i2c-hid/i2c-hid.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
Applied, thanks.
> diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
> index d43e967..5e72fc2 100644
> --- a/drivers/hid/i2c-hid/i2c-hid.c
> +++ b/drivers/hid/i2c-hid/i2c-hid.c
> @@ -370,7 +370,10 @@ static int i2c_hid_hwreset(struct i2c_client *client)
> static void i2c_hid_get_input(struct i2c_hid *ihid)
> {
> int ret, ret_size;
> - int size = ihid->bufsize;
> + int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
> +
> + if (size > ihid->bufsize)
> + size = ihid->bufsize;
>
> ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
> if (ret != size) {
--
Jiri Kosina
SUSE Labs
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-02-23 14:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-02-20 17:45 [PATCH] HID: i2c-hid: Limit reads to wMaxInputLength bytes for input events Seth Forshee
2015-02-20 19:38 ` Benjamin Tissoires
2015-02-23 14:10 ` Jiri Kosina
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).