lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 005/563] HID: wacom: Avoid using stale array indicies to read contact count
    Date
    From: Jason Gerecke <killertofu@gmail.com>

    commit 20f3cf5f860f9f267a6a6e5642d3d0525edb1814 upstream.

    If we ever see a touch report with contact count data we initialize
    several variables used to read the contact count in the pre-report
    phase. These variables are never reset if we process a report which
    doesn't contain a contact count, however. This can cause the pre-
    report function to trigger a read of arbitrary memory (e.g. NULL
    if we're lucky) and potentially crash the driver.

    This commit restores resetting of the variables back to default
    "none" values that were used prior to the commit mentioned
    below.

    Link: https://github.com/linuxwacom/input-wacom/issues/276
    Fixes: 003f50ab673c (HID: wacom: Update last_slot_field during pre_report phase)
    CC: stable@vger.kernel.org
    Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
    Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/hid/wacom_wac.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/drivers/hid/wacom_wac.c
    +++ b/drivers/hid/wacom_wac.c
    @@ -2654,6 +2654,10 @@ static void wacom_wac_finger_pre_report(

    hid_data->confidence = true;

    + hid_data->cc_report = 0;
    + hid_data->cc_index = -1;
    + hid_data->cc_value_index = -1;
    +
    for (i = 0; i < report->maxfield; i++) {
    struct hid_field *field = report->field[i];
    int j;

    \
     
     \ /
      Last update: 2022-01-25 04:09    [W:3.002 / U:4.148 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site