Attachment 889103 Details for Bug 1090161 – 0001-HID-rmi-do-not-fetch-more-than-16-bytes-in-a-query.patch

[patch] 0001-HID-rmi-do-not-fetch-more-than-16-bytes-in-a-query.patch

0001-HID-rmi-do-not-fetch-more-than-16-bytes-in-a-query.patch (text/plain), 1.72 KB, created by Benjamin Tissoires on 2014-04-23 21:54:03 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Benjamin Tissoires

Created: 2014-04-23 21:54:03 UTC

Size: 1.72 KB

patch

obsolete

>From dbd5f3f6c5cf0ed9ab40ae45624c6ed76d47e00b Mon Sep 17 00:00:00 2001
>From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
>Date: Wed, 23 Apr 2014 17:40:50 -0400
>Subject: [PATCH] HID: rmi: do not fetch more than 16 bytes in a query
>
>A firmware bug is present on the XPS Haswell edition which silently
>split the request in two responses when the caller ask for a read of
>more than 16 bytes.
>The FW sends the first 16 then the 4 next, but it says that it answered
>the 20 bytes in the first report.
>
>This occurs only on the retrieving of the min/max of X and Y of the F11
>function.
>We only use the first 10 bytes of the Ctrl register, so we can get only
>those 10 bytes to prevent the bug from happening.
>
>Resolves:
>https://bugzilla.redhat.com/show_bug.cgi?id=1090161
>
>Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
>---
> drivers/hid/hid-rmi.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
>diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
>index 7da9509..cee89c9 100644
>--- a/drivers/hid/hid-rmi.c
>+++ b/drivers/hid/hid-rmi.c
>@@ -613,10 +613,15 @@ static int rmi_populate_f11(struct hid_device *hdev)
> 		}
> 	}
> 
>-	/* retrieve the ctrl registers */
>-	ret = rmi_read_block(hdev, data->f11.control_base_addr, buf, 20);
>+	/*
>+	 * retrieve the ctrl registers
>+	 * the ctrl register has a size of 20 but a fw bug split it into 16 + 4,
>+	 * and there is no way to know if the first 20 bytes are here or not.
>+	 * We use only the first 10 bytes, so get only them.
>+	 */
>+	ret = rmi_read_block(hdev, data->f11.control_base_addr, buf, 10);
> 	if (ret) {
>-		hid_err(hdev, "can not read ctrl block of size 20: %d.\n", ret);
>+		hid_err(hdev, "can not read ctrl block of size 10: %d.\n", ret);
> 		return ret;
> 	}
> 
>-- 
>1.9.0
>

Actions: View | Diff

Attachments on bug 1090161: 888631 | 888632 | 888633 | 888648 | 888649 | 889049 | 889103 | 889344