[PATCH 3.18 18/52] HID: i2c-hid: fix size check and type usage

[PATCH 3.18 18/52] HID: i2c-hid: fix size check and type usage

[John Smith]

> - if (ret_size > size) {
> + if ((ret_size > size) || (ret_size <= 2)) {
> dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",
> __func__, size, ret_size);
> return;


This change spams in the dmesg output. Could you please undo this change? Or

- if ((ret_size > size) || (ret_size <= 2)) {
+ if ((ret_size > size) || (ret_size < 2)) {


$ dmesg

[ 1781.266353] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
[ 1781.273898] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
[ 1781.281464] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
[ 1781.289064] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
[ 1781.296607] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
[ 1781.304131] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
[ 1781.311751] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
[ 1781.319315] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
[ 1781.326882] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)

Re: [PATCH 3.18 18/52] HID: i2c-hid: fix size check and type usage

[Greg KH]

On Sat, Apr 28, 2018 at 11:09:00PM +0200, John Smith wrote:
> > - if (ret_size > size) {
> > + if ((ret_size > size) || (ret_size <= 2)) {
> > dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",
> > __func__, size, ret_size);
> > return;
> 
> 
> This change spams in the dmesg output. Could you please undo this change? Or
> 
> - if ((ret_size > size) || (ret_size <= 2)) {
> + if ((ret_size > size) || (ret_size < 2)) {
> 
> 
> $ dmesg
> 
> [ 1781.266353] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.273898] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.281464] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.289064] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.296607] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.304131] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.311751] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.319315] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.326882] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)

Does this happen in newer kernels as well?  Is there a patch there that
I need to just backport to 3.18.y to remove this "noise"?

thanks,

greg k-h

Aw: Re: [PATCH 3.18 18/52] HID: i2c-hid: fix size check and type usage

[John Smith]

[-- Attachment #1: Type: text/plain, Size: 1694 bytes --]

Issue happens on 4.16.5 as well.
 
Thanks.

Best John 

Gesendet: Sonntag, 29. April 2018 um 07:27 Uhr
Von: "Greg KH" <gregkh@linuxfoundation.org>
An: "John Smith" <john-s-84@gmx.net>
Cc: stable@vger.kernel.org
Betreff: Re: [PATCH 3.18 18/52] HID: i2c-hid: fix size check and type usage
On Sat, Apr 28, 2018 at 11:09:00PM +0200, John Smith wrote:
> > - if (ret_size > size) {
> > + if ((ret_size > size) || (ret_size <= 2)) {
> > dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",
> > __func__, size, ret_size);
> > return;
>
>
> This change spams in the dmesg output. Could you please undo this change? Or
>
> - if ((ret_size > size) || (ret_size <= 2)) {
> + if ((ret_size > size) || (ret_size < 2)) {
>
>
> $ dmesg
>
> [ 1781.266353] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.273898] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.281464] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.289064] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.296607] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.304131] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.311751] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.319315] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)
> [ 1781.326882] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)

Does this happen in newer kernels as well? Is there a patch there that
I need to just backport to 3.18.y to remove this "noise"?

thanks,

greg k-h

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: i2c_hid.patch --]
[-- Type: text/x-patch, Size: 512 bytes --]

diff -uNr linux-4.16.5/drivers/hid/i2c-hid/i2c-hid.c linux-4.16.5_patch2/drivers/hid/i2c-hid/i2c-hid.c
--- linux-4.16.5/drivers/hid/i2c-hid/i2c-hid.c	2018-04-26 11:00:39.000000000 +0200
+++ linux-4.16.5_patch2/drivers/hid/i2c-hid/i2c-hid.c	2018-04-29 12:42:53.867780866 +0200
@@ -484,7 +484,7 @@
 		return;
 	}
 
-	if ((ret_size > size) || (ret_size <= 2)) {
+	if ((ret_size > size) || (ret_size < 2)) {
 		dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",
 			__func__, size, ret_size);
 		return;

Re: Re: [PATCH 3.18 18/52] HID: i2c-hid: fix size check and type usage

[Greg KH]

On Sun, Apr 29, 2018 at 12:54:22PM +0200, John Smith wrote:
> Issue happens on 4.16.5 as well.

Great, please report this to the i2c and hid developers on their mailing
lists and they will be glad to help you out.

greg k-h

[PATCH 3.18 00/52] 3.18.106-stable review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 3.18.106 release.
There are 52 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Tue Apr 24 13:53:02 UTC 2018.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.106-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 3.18.106-rc1

Amir Goldstein <amir73il@gmail.com>
    fanotify: fix logic of events on child

Ian Kent <raven@themaw.net>
    autofs: mount point create should honour passed in mode

Al Viro <viro@zeniv.linux.org.uk>
    Don't leak MNT_INTERNAL away from internal mounts

Al Viro <viro@zeniv.linux.org.uk>
    rpc_pipefs: fix double-dput()

Al Viro <viro@zeniv.linux.org.uk>
    hypfs_kill_super(): deal with failed allocations

Al Viro <viro@zeniv.linux.org.uk>
    jffs2_kill_sb(): deal with failed allocations

Michael Ellerman <mpe@ellerman.id.au>
    powerpc/lib: Fix off-by-one in alternate feature patching

Matt Redfearn <matt.redfearn@mips.com>
    MIPS: memset.S: Fix clobber of v1 in last_fixup

Matt Redfearn <matt.redfearn@mips.com>
    MIPS: memset.S: Fix return of __clear_user from Lpartial_fixup

Matt Redfearn <matt.redfearn@mips.com>
    MIPS: memset.S: EVA & fault support for small_memset

Rodrigo Rivas Costa <rodrigorivascosta@gmail.com>
    HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device

Takashi Iwai <tiwai@suse.de>
    ALSA: rawmidi: Fix missing input substream checks in compat ioctls

Paul Parsons <lost.distance@yahoo.com>
    drm/radeon: Fix PCIe lane width calculation

Theodore Ts'o <tytso@mit.edu>
    ext4: don't allow r/w mounts if metadata blocks overlap the superblock

Theodore Ts'o <tytso@mit.edu>
    ext4: fail ext4_iget for root directory if unallocated

Theodore Ts'o <tytso@mit.edu>
    ext4: add validity checks for bitmap block numbers

Takashi Iwai <tiwai@suse.de>
    ALSA: pcm: Fix endless loop for XRUN recovery in OSS emulation

Takashi Iwai <tiwai@suse.de>
    ALSA: pcm: Fix mutex unbalance in OSS emulation ioctls

Takashi Iwai <tiwai@suse.de>
    ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams

Takashi Iwai <tiwai@suse.de>
    ALSA: pcm: Avoid potential races between OSS ioctls and read/write

Takashi Iwai <tiwai@suse.de>
    ALSA: pcm: Use ERESTARTSYS instead of EINTR in OSS emulation

Nicholas Mc Guire <hofrat@osadl.org>
    ALSA: oss: consolidate kmalloc/memset 0 call to kzalloc

Igor Pylypiv <igor.pylypiv@gmail.com>
    watchdog: f71808e_wdt: Fix WD_EN register read

Mikhail Lappo <mikhail.lappo@esrlabs.com>
    thermal: imx: Fix race condition in imx_thermal_probe()

Richard Genoud <richard.genoud@gmail.com>
    clk: mvebu: armada-38x: add support for missing clocks

Ralph Sennhauser <ralph.sennhauser@gmail.com>
    clk: mvebu: armada-38x: add support for 1866MHz variants

Alex Smith <alex.smith@imgtec.com>
    mmc: jz4740: Fix race condition in IRQ mask update

Theodore Ts'o <tytso@mit.edu>
    jbd2: if the journal is aborted then don't allow update of the log tail

Theodore Ts'o <tytso@mit.edu>
    random: use a tighter cap in credit_entropy_bits_safe()

Mika Westerberg <mika.westerberg@linux.intel.com>
    thunderbolt: Resume control channel after hibernation image is created

James Kelly <jamespeterkelly@gmail.com>
    ASoC: ssm2602: Replace reg_default_raw with reg_default

Nicholas Piggin <npiggin@gmail.com>
    powerpc/powernv: Fix OPAL NVRAM driver OPAL_BUSY loops

Nicholas Piggin <npiggin@gmail.com>
    powerpc/64: Fix smp_wmb barrier definition use use lwsync consistently

Nicholas Piggin <npiggin@gmail.com>
    powerpc/powernv: Handle unknown OPAL errors in opal_nvram_write()

Aaron Ma <aaron.ma@canonical.com>
    HID: i2c-hid: fix size check and type usage

Thinh Nguyen <Thinh.Nguyen@synopsys.com>
    usb: dwc3: pci: Properly cleanup resource

Zhengjun Xing <zhengjun.xing@linux.intel.com>
    USB:fix USB3 devices behind USB3 hubs not resuming at hibernate thaw

Mika Westerberg <mika.westerberg@linux.intel.com>
    ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status()

Jason Andryuk <jandryuk@gmail.com>
    xen-netfront: Fix hang on device removal

Nicolas Ferre <nicolas.ferre@microchip.com>
    ARM: dts: at91: at91sam9g25: fix mux-mask pinctrl property

Heinrich Schuchardt <xypron.glpk@gmx.de>
    usb: musb: gadget: misplaced out of bounds check

Takashi Iwai <tiwai@suse.de>
    resource: fix integer overflow at reallocation

Andrew Morton <akpm@linux-foundation.org>
    fs/reiserfs/journal.c: add missing resierfs_warning() arg

Richard Weinberger <richard@nod.at>
    ubi: Reject MLC NAND

Romain Izard <romain.izard.pro@gmail.com>
    ubi: Fix error for write access

Richard Weinberger <richard@nod.at>
    ubifs: Check ubifs_wbuf_sync() return code

Tejaswi Tanikella <tejaswit@codeaurora.org>
    slip: Check if rstate is initialized before uncompressing

Vasily Gorbik <gor@linux.ibm.com>
    s390/ipl: ensure loadparm valid flag is set

Julian Wiedmann <jwi@linux.vnet.ibm.com>
    s390/qdio: don't merge ERROR output buffers

Julian Wiedmann <jwi@linux.vnet.ibm.com>
    s390/qdio: don't retry EQBS after CCQ 96

Helge Deller <deller@gmx.de>
    parisc: Fix out of array access in match_pci_device()

Mauro Carvalho Chehab <mchehab@s-opensource.com>
    media: v4l2-compat-ioctl32: don't oops on overlay


-------------

Diffstat:

 Makefile                                      |   4 +-
 arch/arm/boot/dts/at91sam9g25.dtsi            |   2 +-
 arch/mips/lib/memset.S                        |  11 +-
 arch/parisc/kernel/drivers.c                  |   4 +
 arch/powerpc/include/asm/barrier.h            |   3 +-
 arch/powerpc/include/asm/synch.h              |   4 -
 arch/powerpc/lib/feature-fixups.c             |   2 +-
 arch/powerpc/platforms/powernv/opal-nvram.c   |  11 +-
 arch/s390/hypfs/inode.c                       |   2 +-
 arch/s390/kernel/ipl.c                        |   1 +
 drivers/char/random.c                         |   2 +-
 drivers/clk/mvebu/armada-38x.c                |  15 +-
 drivers/gpu/drm/radeon/si_dpm.c               |   4 +-
 drivers/hid/hidraw.c                          |   5 +
 drivers/hid/i2c-hid/i2c-hid.c                 |  13 +-
 drivers/media/v4l2-core/v4l2-compat-ioctl32.c |   4 +-
 drivers/mmc/host/jz4740_mmc.c                 |   2 +-
 drivers/mtd/ubi/block.c                       |   2 +-
 drivers/mtd/ubi/build.c                       |  11 ++
 drivers/net/slip/slhc.c                       |   5 +
 drivers/net/xen-netfront.c                    |   7 +-
 drivers/pci/hotplug/acpiphp_glue.c            |  23 +++-
 drivers/s390/cio/qdio_main.c                  |  42 +++---
 drivers/thermal/imx_thermal.c                 |   6 +-
 drivers/thunderbolt/nhi.c                     |   1 +
 drivers/usb/core/generic.c                    |   9 +-
 drivers/usb/dwc3/dwc3-pci.c                   |   2 +-
 drivers/usb/musb/musb_gadget_ep0.c            |  14 +-
 drivers/watchdog/f71808e_wdt.c                |   2 +-
 fs/autofs4/root.c                             |   2 +-
 fs/ext4/balloc.c                              |  16 ++-
 fs/ext4/ialloc.c                              |   8 +-
 fs/ext4/inode.c                               |   6 +
 fs/ext4/super.c                               |   6 +
 fs/jbd2/journal.c                             |   5 +-
 fs/jffs2/super.c                              |   2 +-
 fs/namespace.c                                |   3 +-
 fs/notify/fanotify/fanotify.c                 |  34 ++---
 fs/reiserfs/journal.c                         |   2 +-
 fs/ubifs/super.c                              |  14 +-
 include/net/slhc_vj.h                         |   1 +
 include/sound/pcm_oss.h                       |   1 +
 kernel/resource.c                             |   3 +-
 net/sunrpc/rpc_pipe.c                         |   1 +
 sound/core/oss/pcm_oss.c                      | 189 ++++++++++++++++++++------
 sound/core/rawmidi_compat.c                   |  18 ++-
 sound/soc/codecs/ssm2602.c                    |  19 ++-
 47 files changed, 388 insertions(+), 155 deletions(-)

[PATCH 3.18 18/52] HID: i2c-hid: fix size check and type usage

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Aaron Ma <aaron.ma@canonical.com>

commit ac75a041048b8c1f7418e27621ca5efda8571043 upstream.

When convert char array with signed int, if the inbuf[x] is negative then
upper bits will be set to 1. Fix this by using u8 instead of char.

ret_size has to be at least 3, hid_input_report use it after minus 2 bytes.

Cc: stable@vger.kernel.org
Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hid/i2c-hid/i2c-hid.c |   13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -136,10 +136,10 @@ struct i2c_hid {
 						   * register of the HID
 						   * descriptor. */
 	unsigned int		bufsize;	/* i2c buffer size */
-	char			*inbuf;		/* Input buffer */
-	char			*rawbuf;	/* Raw Input buffer */
-	char			*cmdbuf;	/* Command buffer */
-	char			*argsbuf;	/* Command arguments buffer */
+	u8			*inbuf;		/* Input buffer */
+	u8			*rawbuf;	/* Raw Input buffer */
+	u8			*cmdbuf;	/* Command buffer */
+	u8			*argsbuf;	/* Command arguments buffer */
 
 	unsigned long		flags;		/* device flags */
 
@@ -373,7 +373,8 @@ static int i2c_hid_hwreset(struct i2c_cl
 
 static void i2c_hid_get_input(struct i2c_hid *ihid)
 {
-	int ret, ret_size;
+	int ret;
+	u32 ret_size;
 	int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
 
 	if (size > ihid->bufsize)
@@ -398,7 +399,7 @@ static void i2c_hid_get_input(struct i2c
 		return;
 	}
 
-	if (ret_size > size) {
+	if ((ret_size > size) || (ret_size <= 2)) {
 		dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",
 			__func__, size, ret_size);
 		return;