mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Wei Jie Law <98lawweijie@gmail.com>
To: Jiri Kosina <jikos@kernel.org>, Benjamin Tissoires <bentiss@kernel.org>
Cc: Andrew Duggan <aduggan@synaptics.com>,
	linux-input@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2] HID: rmi: fix OOB access with undersized RMI reports
Date: Mon, 24 Aug 2026 20:38:29 +0800	[thread overview]
Message-ID: <20260824123829.78659-1-98lawweijie@gmail.com> (raw)
In-Reply-To: <00a489f38b240624dcb5a4bae36a53fcba9cfb47.1787549195.git.98lawweijie@gmail.com>

Superseded by v3:
https://lore.kernel.org/linux-input/20260824122708.76168-1-98lawweijie@gmail.com/

Please do not apply this version.  It bails out of the read loop on a
zero-length reply without clearing RMI_READ_DATA_PENDING, and that flag
is what the wait at the top of the loop tests.  Leaving it set makes
every later wait_event_timeout() return immediately on the stale reply,
so the four remaining retries of that call -- and every subsequent
rmi_hid_read_block() -- fail instantly with -EIO without ever waiting
for the device again.  One zero-length reply from an otherwise honest
device is enough to kill the read path for the rest of the device's
life.

v3 clears the flag on that path.

Please mark this one superseded.

Thanks,
Wei Jie

      reply	other threads:[~2026-08-24 12:38 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-24  5:43 Wei Jie Law
2026-08-24 12:38 ` Wei Jie Law [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260824123829.78659-1-98lawweijie@gmail.com \
    --to=98lawweijie@gmail.com \
    --cc=aduggan@synaptics.com \
    --cc=bentiss@kernel.org \
    --cc=jikos@kernel.org \
    --cc=linux-input@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®