mirror of
https://github.com/torvalds/linux.git
synced 2026-07-27 17:47:41 +02:00
b6eb022890
Add a regression test for the out-of-bounds bit operations on struct mt_device.mt_io_flags. A HID multitouch device can advertise a ContactCountMaximum far larger than the number of contacts a single report describes, up to 255. The driver used to keep the per-slot active state in the bits of a single unsigned long and index set_bit()/clear_bit() by the slot number, so such a device drove those operations out of bounds. The sticky-fingers release timer made it fatal: mt_release_contacts() cleared one bit per slot and overwrote the adjacent members of struct mt_device. The new device advertises a ContactCountMaximum of 250 while exposing only a few finger collections (a large contact count cannot be expressed with one finger collection per contact within the HID descriptor size limit). The test sends a single contact and lets the 100ms sticky-fingers timer release it. A kernel without the fix panics in mt_release_contacts(); a fixed kernel reports the release cleanly. Signed-off-by: Trung Nguyen <trungnh@cystack.net> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> |
||
|---|---|---|
| .. | ||
| progs | ||
| tests | ||
| .gitignore | ||
| config | ||
| config.common | ||
| config.x86_64 | ||
| hid_bpf.c | ||
| hid_common.h | ||
| hid-apple.sh | ||
| hid-core.sh | ||
| hid-gamepad.sh | ||
| hid-ite.sh | ||
| hid-keyboard.sh | ||
| hid-mouse.sh | ||
| hid-multitouch.sh | ||
| hid-sony.sh | ||
| hid-tablet.sh | ||
| hid-usb_crash.sh | ||
| hid-wacom.sh | ||
| hidraw.c | ||
| Makefile | ||
| run-hid-tools-tests.sh | ||
| settings | ||
| vmtest.sh | ||