Re: HID: hid-logitech - missing HID_OUTPUT_REPORT 0

[Kees Cook <keescook@chromium.org>]

On Thu, Apr 17, 2014 at 11:27 AM,  <simon@mungewell.org> wrote:
>
>>>> Ah-ha, actually, when taking a closer look at this, I see that lgff
>>>> isn't using ID "0", it's actually using "the first report in the
>>>> list", without using an ID at all. This appears to be true for all the
>>>> lg*ff devices, actually. Instead of validating ID 0, it needs to
>>>> validate "the first report".
>
>
>> +       if (!report && id == 0) {
>> +               /*
>> +                * Requesting id 0 means we should fall back to the first
>> +                * report in the list.
>> +                */
>> +               report = list_entry(
>> +                               hid->report_enum[type].report_list.next,
>> +                               struct hid_report, list);
>> +       }
>
> Is the task of this check to locate/check the 'output' report? Because for
> this particular device it is defined in Report ID 3, the third one in
> descriptor. So would presumably still fail to be found.

The driver currently uses "the first entry in the report list",
regardless of ID. The bug that got introduced here was that the driver
was effectively forced to look up reports by ID, and the code didn't
acknowledge the concept of ID 0 effectively being a wildcard ID.

-Kees

-- 
Kees Cook
Chrome OS Security