Re: Linux USB HID should ignore values outside Logical Minimum/Maximum range

Jiri Kosina
2011-10-28T16:23:21Z

On Mon, 24 Oct 2011, Dmitry Torokhov wrote:

> While input core does not clam or validate the values reported by the
> driver it might make sense to do so in hid-input; I am not sure how
> often these limits programmed intorrectly. Jiri i sprobably the best
> person to answer this question.

I haven't met such a device myself yet.

On the other hand I feel like just dropping the report on the floor should
be the proper thing to do.

Christoph, how about the (untested at my side yet) patch below? It'd be
nice if you could test with the device you are seeing the problem with and
let me know.

It's definitely not something I'll be pushing for 3.1 though; I'd first
like to verify the batch of the device records I have (or I have received)
to see whehter we can't introduce regressions this way.

From: Jiri Kosina <jkosina@suse.cz>
Subject: [PATCH] HID: ignore absolute values which don't fit between logical min and max

Linux should ignore values outside logical min/max range, as they are not
meaningful. This is what at least some of other OSes do, and it also makes
sense (currently the value gets misinterpreted larger up the stack).

Reported-by: Denilson Figueiredo de Sá <denilsonsa@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
---
drivers/hid/hid-input.c | 7 +++++++
1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index f333139..ca923de 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -822,6 +822,13 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
return;
}

+ /* Ignore absolute values that are out of bounds */
+ if ((usage->type == EV_ABS && (value < field->logical_minimum ||
+ value > field->logical_maximum))) {
+ dbg_hid("Ignoring out-of-range value %x\n", value);
+ return;
+ }
+
/* report the usage code as scancode if the key status has changed */
if (usage->type == EV_KEY && !!test_bit(usage->code, input->key) != value)
input_event(input, EV_MSC, MSC_SCAN, usage->hid);
--
Jiri Kosina
SUSE Labs