linux-input.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Alexander Larkin <avlarkin82@gmail.com>
To: torvalds@linux-foundation.org
Cc: avlarkin82@gmail.com, dan.carpenter@oracle.com,
	dmitry.torokhov@gmail.com, linux-input@vger.kernel.org,
	linux-kernel@vger.kernel.org, murray.mcallister@gmail.com,
	security@kernel.org
Subject: Re: [PATCH] Input: joydev - prevent potential write out of bounds in ioctl
Date: Mon, 21 Jun 2021 23:06:23 +0300	[thread overview]
Message-ID: <20210621200623.1690329-1-avlarkin82@gmail.com> (raw)
In-Reply-To: <CAHk-=wjtK7XgQqTE_OyGV8uPX3d1RqUhTQO1D+Bk3wGEiea3Ow@mail.gmail.com>

I did manual testing with virtual machine (for /dev/input/js0 the driver name is "VirtualBox USB Tablet").
I used program jswap.c from https://bbs.archlinux.org/viewtopic.php?pid=641803#p641803
I compiled both kernel and all modules (including new module with the patch suggested by Linus) and if using updated module:
1. No fail for the poc anymore.
2. Different tests like "./jswap b:0,1 /dev/input/js0" or "./jswap b:4,5 /dev/input/js0"" gives expected result (with seeing the result by cmd "./jswap /dev/input/js0"").
3. Tried to reboot with older kernel (where panic happened) and replayed these few manual tests: results are the same. Both for this older kernel (before fix) for poc.c still seeing fail.
4. For being sure that the kernel module being tested is the same as source code that
I'm compiled, I used command "objdump -S joydev.ko" (after decompress of /lib/../joydev.ko.xz).

I noted one other minor issue when used jswap.
For some reason jswap expected that ioctl JSIOCGBTNMAP returns 0 on success
(because there is separate JSIOCGBUTTONS for getting amount of buttons),
but instead JSIOCGBTNMAP returns number of buttons too (like JSIOCGBUTTONS is).
Is it mistake inside jswap.c and should then keep it as is for joydev.c?
So, for making jswap working, first I had to change return status check of JSIOCGBUTTONS
inside this test jswap.c program (and I don't know if possible to change return status of
JSIOCGBTNMAP to zero on success or of should keep it as is, because many other programs
could be broken if fixing success ret status to zero instead of amount of return values).
Dmitry, what do you think of this?

If no other tests required, maybe let's commit patch that is suggested by Linus.
Dmitry, could you please continue with this?

Thank you.

  reply	other threads:[~2021-06-21 20:06 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-20 12:00 [PATCH] Input: joydev - prevent potential write out of bounds in ioctl Alexander Larkin
2021-06-20 16:37 ` Linus Torvalds
2021-06-21  5:25   ` Dmitry Torokhov
2021-06-21 15:45     ` Linus Torvalds
2021-06-21 20:06       ` Alexander Larkin [this message]
2021-06-21 21:30       ` Alexander Larkin
2021-06-21 21:32       ` Alexander Larkin
2021-06-21 22:38         ` Dmitry Torokhov
2021-07-03 16:21 ` Denis Efremov
2021-07-05 10:54   ` Dan Carpenter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210621200623.1690329-1-avlarkin82@gmail.com \
    --to=avlarkin82@gmail.com \
    --cc=dan.carpenter@oracle.com \
    --cc=dmitry.torokhov@gmail.com \
    --cc=linux-input@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=murray.mcallister@gmail.com \
    --cc=security@kernel.org \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).