From patchwork Sat Jul 14 21:59:25 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vinicius Costa Gomes X-Patchwork-Id: 1198261 X-Patchwork-Delegate: jikos@jikos.cz Return-Path: X-Original-To: patchwork-linux-input@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork1.kernel.org (Postfix) with ESMTP id 3D8283FC4C for ; Sat, 14 Jul 2012 21:59:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751785Ab2GNV7l (ORCPT ); Sat, 14 Jul 2012 17:59:41 -0400 Received: from mail-gg0-f174.google.com ([209.85.161.174]:47593 "EHLO mail-gg0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751566Ab2GNV7k (ORCPT ); Sat, 14 Jul 2012 17:59:40 -0400 Received: by gglu4 with SMTP id u4so4398065ggl.19 for ; Sat, 14 Jul 2012 14:59:40 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer:x-gm-message-state; bh=agEEE42aGOjz+9r45Dm7oy8ELylxYUWuTyzgy94xtC4=; b=nw+TspWqe9dA6lnkR6O6DEYW9HlD6IGYf23LPblbD9JOUd8oLAYX00/QGpv+rcb0Wb 6+zzLluR45ewTO0143V9Qlr69fn4/IF1k6iWkNYZKFgDQR1kgFRf6gnINBuGvz4oKdg8 9d+hlUk1xP3UFA4gM4nkQBsdDjeRYZerMTNjq5IDW86lI+/YxPkvG5UHW+OkzCic0+F/ HsGo2sL6EYCJPTPdTLUQhbnoK6T/B/B6II51zmHw5YcZHF+fVuUnr42ONQlmOq3ntmjK W3ub8C3gytBVnVbCC8w5eDv4OlpH0C3uB9stIrXBOdEfUx7nkqYWbtST6qH+Ojy16dCq p1pg== Received: by 10.236.201.195 with SMTP id b43mr5276007yho.27.1342303179914; Sat, 14 Jul 2012 14:59:39 -0700 (PDT) Received: from localhost.localdomain ([187.113.117.7]) by mx.google.com with ESMTPS id a7sm17450977yhm.0.2012.07.14.14.59.37 (version=TLSv1/SSLv3 cipher=OTHER); Sat, 14 Jul 2012 14:59:38 -0700 (PDT) From: Vinicius Costa Gomes To: linux-input@vger.kernel.org Cc: dh.herrmann@googlemail.com, Vinicius Costa Gomes Subject: [PATCH] HID: uhid: Fix sending events with invalid data Date: Sat, 14 Jul 2012 18:59:25 -0300 Message-Id: <1342303165-28708-1-git-send-email-vinicius.gomes@openbossa.org> X-Mailer: git-send-email 1.7.10.4 X-Gm-Message-State: ALoCoQmmYaJcX3/5wEP6jPs/pya6JNDIY6P2Hbq4I/tI9LdefARlsXeHAfE8CGK25dq95Jm82tRC Sender: linux-input-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-input@vger.kernel.org This was detected because events with invalid types were arriving to userspace. The code before this patch would only work for the first event in the queue (when uhid->tail is 0). Signed-off-by: Vinicius Costa Gomes Reviewed-by: David Herrmann --- David, Do you have any clue why it took so long for us to detect this issue? Cheers, drivers/hid/uhid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c index 119b7e6..714cd8c 100644 --- a/drivers/hid/uhid.c +++ b/drivers/hid/uhid.c @@ -465,7 +465,7 @@ try_again: goto try_again; } else { len = min(count, sizeof(**uhid->outq)); - if (copy_to_user(buffer, &uhid->outq[uhid->tail], len)) { + if (copy_to_user(buffer, uhid->outq[uhid->tail], len)) { ret = -EFAULT; } else { kfree(uhid->outq[uhid->tail]);