mirror of
https://github.com/torvalds/linux.git
synced 2026-07-28 01:55:51 +02:00
b6eb022890
Add a regression test for the out-of-bounds bit operations on struct mt_device.mt_io_flags. A HID multitouch device can advertise a ContactCountMaximum far larger than the number of contacts a single report describes, up to 255. The driver used to keep the per-slot active state in the bits of a single unsigned long and index set_bit()/clear_bit() by the slot number, so such a device drove those operations out of bounds. The sticky-fingers release timer made it fatal: mt_release_contacts() cleared one bit per slot and overwrote the adjacent members of struct mt_device. The new device advertises a ContactCountMaximum of 250 while exposing only a few finger collections (a large contact count cannot be expressed with one finger collection per contact within the HID descriptor size limit). The test sends a single contact and lets the 100ms sticky-fingers timer release it. A kernel without the fix panics in mt_release_contacts(); a fixed kernel reports the release cleanly. Signed-off-by: Trung Nguyen <trungnh@cystack.net> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| base_device.py | ||
| base_gamepad.py | ||
| base.py | ||
| conftest.py | ||
| descriptors_wacom.py | ||
| test_apple_keyboard.py | ||
| test_gamepad.py | ||
| test_hid_core.py | ||
| test_ite_keyboard.py | ||
| test_keyboard.py | ||
| test_mouse.py | ||
| test_multitouch.py | ||
| test_sony.py | ||
| test_tablet.py | ||
| test_usb_crash.py | ||
| test_wacom_generic.py | ||