From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f172.google.com (mail-oi1-f172.google.com [209.85.167.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 935373F20E3 for ; Mon, 24 Aug 2026 12:38:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787575116; cv=none; b=HzT1p+lponynvtHXz9lojW7HBIJPOkuw+ctO2e45AW9V4ndIDMRj10gPnmL9aEt/5ji2Cd4RVo6gSPB6N7/CC/kuwy30OpLreOoJP7vnXmIEYNEKWOekU5YmuhSKc627Ehqx19D7AdJYLDP6KD1boNQZNCPqg232L9Wfjj+y09A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787575116; c=relaxed/simple; bh=8SXieS64rB24czgYz9k6iF4+Hn+8FHko7SGtPgmurAM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=iu45B1qtbIQVut9WuEUsnN/PcbRpXc1lratJ5sCwVNaY/6XW++GiGojefD5rtq4CJRTy2Gmr8BYwVzUMLhG9+sGVy9LlQ2HwsEjCOnV30qzGuImKWBhcgXDN/J1h0hGK4OLmjKbEF66kj2c5RAJy5zDbsWrtMZG/y6YLSF9hN+o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=lq9ZG45a; arc=none smtp.client-ip=209.85.167.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="lq9ZG45a" Received: by mail-oi1-f172.google.com with SMTP id 5614622812f47-4b21f09ec76so2333374b6e.0 for ; Mon, 24 Aug 2026 05:38:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787575114; x=1788179914; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=BZSSEV3fsCHMk2C/EdG9DdvXqKnsOxZXSr8k9DTxFw8=; b=lq9ZG45aQ+7XiGsn+nm2mgYZ7eWSCewRMiWeEcAiw6jlbrGGDRRNjQc7Tp2+yXh3cN 6SzefUv2mnDacUM8KC3YQFmVWwD1F1iGkVKqu00Stw07yVIKs28F6LuYpGiu2jwX5CDx wl7uGH4nYgMmnPbl4KZnBtssiTlzOf351Ot3qiZpnmhLxaZNdx21CPZGam0WI0G7/rkh ri+RmB8rXjBHRsgimm6nIMHmvoJc42NuVtH3M+muYO7StKdF/PeTIdO7TN3BANEtKgLd 6bKeHMAplMPYZAH+l2lDgu0NncOUcSkMKOEzpc8flvttoy8tzCGabLH/fxjXY5jU55Fi JU6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787575114; x=1788179914; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=BZSSEV3fsCHMk2C/EdG9DdvXqKnsOxZXSr8k9DTxFw8=; b=P3HdfK2I8C3DOezAnjGFULYLW3iwfVVNeT7x6PVKYVuHRNIRI+TX0UMvS70auvcXXh xNgYsEsy/4YlrGtUe1uYqzvSboT+3oGGLuktRLSL3LOgzmOtF6tbo45VXLuy60EB+ndT 3PBsbBOSTY8JJa4hJ/v89b6SUaSKAeMCHbEve7XtKvf6YykAzcuIvIiLQqdJ5WxcNijJ brm2VMvxAZMliMW9h321z1EeOtJ2jM0fJhtU3AjDQTtkdU26RJQeTX1ETjsIqas6KOSb yMe7vkkd2BxEeibUxapDNXct8plt3d6ti8pBmBfEkRgvn50+Gp3xDky8AUEOuPuFaixD mXKA== X-Forwarded-Encrypted: i=1; AHgh+Rqqf99dlkAQkq7NaAzs/353MRiAy1Ff8n0+rDeAYwK0kPOoZFJ/CSen9urnAHdak5j14CwUlazqKoV5F2I=@vger.kernel.org X-Gm-Message-State: AFuF++lpg3q+cFoW2gJO2JnfUL2c8tz/UNu1Tq1MSRP8GjdSwwUVLMDg aUppFcpQc/fwlYfVyaxP0ivR9m7vQU3AEj7F4CGN9D4TYc4a1J51Zc82gqucLGgzRW0= X-Gm-Gg: AR+sD132UOmFe6oIE5X/2PGfWXWqBvAksLaauwuMcrzMMSz1em163RfgQK7I9KWKuel VCSha41XWWSasvBPH0rNgu/pUg8o4pdCi18Ij2tPH0/C8Jtf/DFZQL26+wYC1WiZsTIcpr5hp2q QgjPtfx7petJgBzob2VxJ86hzawDFbcYgtfJd1gIYwhuRaDXW1KOnDfD+LQSDACAJzTAgjw3DNu DsoW9u5SUJzsanS6AOuPyj4BbD5nqaDsD2mHFOulL1A9obVx8DT0p0kR0uKLe6p/JpHpZ/4TznV RW2XGUe4NcHJArPW5WR3tSyY19SxIi7s/DUoLDm/2vo6kzMAJPtayhn0xZRnXv6NZvIv7l77mLq cQPCGA/1Ko5/mCvCBspmxysLXOnkPFoLAYisuK5+GLU7ZbziGlha/ydpub3deIV7GWIPCPyaH/G EY+vSSrbc9DWJSLpM/81qJPKyurOzJxCTCwG9nmN9js0bQhRbOQ3G2RDSu6cC1v4TtRaVlVort5 TT5Rq4oKy9PN/hoWE87lvfhJVTNK1pDuxS68gwc2DVaTrFrTGCHUNiEG0qcLD9kefHP074WyoTg 0AfavIlPfkYCbzBVScb9JSsP X-Received: by 2002:a05:6820:55c6:20b0:6b1:55d0:6e69 with SMTP id 006d021491bc7-6b159334ee0mr17231528eaf.18.1787575114407; Mon, 24 Aug 2026 05:38:34 -0700 (PDT) Received: from LAPTOP-UUUVNN1I.localdomain (bb119-74-6-224.singnet.com.sg. [119.74.6.224]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-7f48fcb8e88sm4444352a34.27.2026.08.24.05.38.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Aug 2026 05:38:33 -0700 (PDT) From: Wei Jie Law <98lawweijie@gmail.com> To: Jiri Kosina , Benjamin Tissoires Cc: Andrew Duggan , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2] HID: rmi: fix OOB access with undersized RMI reports Date: Mon, 24 Aug 2026 20:38:29 +0800 Message-ID: <20260824123829.78659-1-98lawweijie@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <00a489f38b240624dcb5a4bae36a53fcba9cfb47.1787549195.git.98lawweijie@gmail.com> References: <00a489f38b240624dcb5a4bae36a53fcba9cfb47.1787549195.git.98lawweijie@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Superseded by v3: https://lore.kernel.org/linux-input/20260824122708.76168-1-98lawweijie@gmail.com/ Please do not apply this version. It bails out of the read loop on a zero-length reply without clearing RMI_READ_DATA_PENDING, and that flag is what the wait at the top of the loop tests. Leaving it set makes every later wait_event_timeout() return immediately on the stale reply, so the four remaining retries of that call -- and every subsequent rmi_hid_read_block() -- fail instantly with -EIO without ever waiting for the device again. One zero-length reply from an otherwise honest device is enough to kill the read path for the rest of the device's life. v3 clears the flag on that path. Please mark this one superseded. Thanks, Wei Jie