From patchwork Tue Apr 25 18:29:56 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Gerecke, Jason" X-Patchwork-Id: 9699185 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5A571603F4 for ; Tue, 25 Apr 2017 18:30:32 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 49DAC28450 for ; Tue, 25 Apr 2017 18:30:32 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3EC2928485; Tue, 25 Apr 2017 18:30:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9AF0028450 for ; Tue, 25 Apr 2017 18:30:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1953101AbdDYSaT (ORCPT ); Tue, 25 Apr 2017 14:30:19 -0400 Received: from mail-qt0-f196.google.com ([209.85.216.196]:35461 "EHLO mail-qt0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1953084AbdDYSaD (ORCPT ); Tue, 25 Apr 2017 14:30:03 -0400 Received: by mail-qt0-f196.google.com with SMTP id o36so26374092qtb.2 for ; Tue, 25 Apr 2017 11:30:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=0fWfexqBFffaUnoFSxANRHQHI4uZqzLqXBeQH4jsvDk=; b=b0VjGyN37gwlj/edLFsEms9RFDJHm8463VoO3q89TSTnvP8/SWszCHtIrMHX1ix0VU aaw1yzPQC8du/qGeeqJ0CgsAQ0tFNfAbOhDgFtOf7Qe61PKiZ4uLtsPuyqkL9BNg7mFI kkkA4hX/7NkTjZThIevcyS6WCcCOAAe5iAD++kEN/j+QLPgyEBgh15A1C8QsKmlshTjU LNTgFrbNPIgqinR5Wiwbub6rEBDoY8wAUK1A9STZBtxPSYis6KgatwsB8AQ3h/8JR2zc cTuKfYOtTNl/gcZSXJRcckKuoLI1GiX/bQ5VxEeFJyBo1r/0yz8WHWVDLg8TX47DobFN /4Nw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=0fWfexqBFffaUnoFSxANRHQHI4uZqzLqXBeQH4jsvDk=; b=sCfmzLhkXJg9rDyXRaPT2iL1o3vchp66pdXdpntySdp41ykHkP9I6vRx43NAMgJdsd wn7KWn7gRj1I7imQOihRGZZzp+sXhoYiioNnOZ7G6azBgDEbuwOuw6pH+fzWXrfiICw7 5CG9Je70L1ytUaVlR7BYxnMJK/KJ/aqBbKV7wwSu/Hp6gVIJZjOpYpPwytIU7dIb2su4 4o0ioiQe8NeuEr18x+rdIGUEW7Mb8fr93Oosz/wDlsoymgXmT6YojNzjushiAsuVGr5Y m/EXWnFZsSxF/GSDq4Om6SclSJTQNhTPWPzKL66SRZkehKF3s3hBkv+OYKDl6jCm5m35 ReQw== X-Gm-Message-State: AN3rC/4vSkx/MBObhSVr8CbkabCvS951gKWhzwuJ2TMfXlOsnY+pPM4+ GChMmzU551nQ4g== X-Received: by 10.200.51.28 with SMTP id t28mr36814506qta.16.1493145002622; Tue, 25 Apr 2017 11:30:02 -0700 (PDT) Received: from wacom-arch2.corp.onewacom.com ([50.225.60.4]) by smtp.gmail.com with ESMTPSA id 94sm15674894qte.37.2017.04.25.11.30.01 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 25 Apr 2017 11:30:02 -0700 (PDT) From: Jason Gerecke To: linux-input@vger.kernel.org Cc: Jiri Kosina , Benjamin Tissoires , Ping Cheng , Aaron Skomra , Jason Gerecke , Jason Gerecke Subject: [PATCH] HID: wacom: Have wacom_tpc_irq guard against possible NULL dereference Date: Tue, 25 Apr 2017 11:29:56 -0700 Message-Id: <20170425182956.15406-1-killertofu@gmail.com> X-Mailer: git-send-email 2.12.2 In-Reply-To: <20170412203123.GA3915@mwanda> References: <20170412203123.GA3915@mwanda> Sender: linux-input-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-input@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The following Smatch complaint was generated in response to commit 2a6cdbd ("HID: wacom: Introduce new 'touch_input' device"): drivers/hid/wacom_wac.c:1586 wacom_tpc_irq() error: we previously assumed 'wacom->touch_input' could be null (see line 1577) The 'touch_input' and 'pen_input' variables point to the 'struct input_dev' used for relaying touch and pen events to userspace, respectively. If a device does not have a touch interface or pen interface, the associated input variable is NULL. The 'wacom_tpc_irq()' function is responsible for forwarding input reports to a more-specific IRQ handler function. An unknown report could theoretically be mistaken as e.g. a touch report on a device which does not have a touch interface. This can be prevented by only calling the pen/touch functions are called when the pen/touch pointers are valid. Signed-off-by: Jason Gerecke Reviewed-by: Ping Cheng --- drivers/hid/wacom_wac.c | 45 +++++++++++++++++++++++---------------------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c index 6b8f6b816195..b963499e3351 100644 --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -1571,37 +1571,38 @@ static int wacom_tpc_irq(struct wacom_wac *wacom, size_t len) { unsigned char *data = wacom->data; - if (wacom->pen_input) + if (wacom->pen_input) { dev_dbg(wacom->pen_input->dev.parent, "%s: received report #%d\n", __func__, data[0]); - else if (wacom->touch_input) + + if (len == WACOM_PKGLEN_PENABLED || + data[0] == WACOM_REPORT_PENABLED) + return wacom_tpc_pen(wacom); + } + else if (wacom->touch_input) { dev_dbg(wacom->touch_input->dev.parent, "%s: received report #%d\n", __func__, data[0]); - switch (len) { - case WACOM_PKGLEN_TPC1FG: - return wacom_tpc_single_touch(wacom, len); + switch (len) { + case WACOM_PKGLEN_TPC1FG: + return wacom_tpc_single_touch(wacom, len); - case WACOM_PKGLEN_TPC2FG: - return wacom_tpc_mt_touch(wacom); + case WACOM_PKGLEN_TPC2FG: + return wacom_tpc_mt_touch(wacom); - case WACOM_PKGLEN_PENABLED: - return wacom_tpc_pen(wacom); + default: + switch (data[0]) { + case WACOM_REPORT_TPC1FG: + case WACOM_REPORT_TPCHID: + case WACOM_REPORT_TPCST: + case WACOM_REPORT_TPC1FGE: + return wacom_tpc_single_touch(wacom, len); - default: - switch (data[0]) { - case WACOM_REPORT_TPC1FG: - case WACOM_REPORT_TPCHID: - case WACOM_REPORT_TPCST: - case WACOM_REPORT_TPC1FGE: - return wacom_tpc_single_touch(wacom, len); - - case WACOM_REPORT_TPCMT: - case WACOM_REPORT_TPCMT2: - return wacom_mt_touch(wacom); + case WACOM_REPORT_TPCMT: + case WACOM_REPORT_TPCMT2: + return wacom_mt_touch(wacom); - case WACOM_REPORT_PENABLED: - return wacom_tpc_pen(wacom); + } } }