| Message ID | 20211019152917.79666-1-andrew.shadura@collabora.co.uk (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | b7abf78b7a6c4a29a6e0ba0bb883fe44a2f3d693 |
| Delegated to: | Jiri Kosina |
| Headers | show |
| Series | [v3,1/2] HID: u2fzero: clarify error check and length calculations | expand |
On Tue, 19 Oct 2021, Andrej Shadura wrote: > The previous commit fixed handling of incomplete packets but broke error > handling: offsetof returns an unsigned value (size_t), but when compared > against the signed return value, the return value is interpreted as if > it were unsigned, so negative return values are never less than the > offset. > > To make the code easier to read, calculate the minimal packet length > once and separately, and assign it to a signed int variable to eliminate > unsigned math and the need for type casts. It then becomes immediately > obvious how the actual data length is calculated and why the return > value cannot be less than the minimal length. > > Fixes: 22d65765f211 ("HID: u2fzero: ignore incomplete packets without data") > Fixes: 42337b9d4d95 ("HID: add driver for U2F Zero built-in LED and RNG") > Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk> Both now applied, thanks.
diff --git a/drivers/hid/hid-u2fzero.c b/drivers/hid/hid-u2fzero.c index d70cd3d7f583..94f78ffb76d0 100644 --- a/drivers/hid/hid-u2fzero.c +++ b/drivers/hid/hid-u2fzero.c @@ -191,6 +191,8 @@ static int u2fzero_rng_read(struct hwrng *rng, void *data, struct u2f_hid_msg resp; int ret; size_t actual_length; + /* valid packets must have a correct header */ + int min_length = offsetof(struct u2f_hid_msg, init.data); if (!dev->present) { hid_dbg(dev->hdev, "device not present"); @@ -200,12 +202,12 @@ static int u2fzero_rng_read(struct hwrng *rng, void *data, ret = u2fzero_recv(dev, &req, &resp); /* ignore errors or packets without data */ - if (ret < offsetof(struct u2f_hid_msg, init.data)) + if (ret < min_length) return 0; /* only take the minimum amount of data it is safe to take */ - actual_length = min3((size_t)ret - offsetof(struct u2f_hid_msg, - init.data), U2F_HID_MSG_LEN(resp), max); + actual_length = min3((size_t)ret - min_length, + U2F_HID_MSG_LEN(resp), max); memcpy(data, resp.init.data, actual_length);
The previous commit fixed handling of incomplete packets but broke error handling: offsetof returns an unsigned value (size_t), but when compared against the signed return value, the return value is interpreted as if it were unsigned, so negative return values are never less than the offset. To make the code easier to read, calculate the minimal packet length once and separately, and assign it to a signed int variable to eliminate unsigned math and the need for type casts. It then becomes immediately obvious how the actual data length is calculated and why the return value cannot be less than the minimal length. Fixes: 22d65765f211 ("HID: u2fzero: ignore incomplete packets without data") Fixes: 42337b9d4d95 ("HID: add driver for U2F Zero built-in LED and RNG") Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk> --- drivers/hid/hid-u2fzero.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)