d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

psm(4): Add extra sanity checks to Elantech trackpoint packet parser.

Browse Source 
Add strict checks for unused bit states in Elantech trackpoint packet
parser to filter out spurious events produces by some hardware which
are detected as trackpoint packets. See comment on r328191 for example.

Tested by:	Andrey Kosachenko <andrey.kosachenko@gmail.com>
This commit is contained in:
Vladimir Kondratyev 2019-06-08 21:36:22 +00:00
parent 8fa4620039
commit 6c53fea7d6
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=348818
1 changed files with 23 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
sys/dev/atkbdc/psm.c
View File

@ -4687,22 +4687,32 @@ proc_elantech(struct psm_softc *sc, packetbuf_t *pb, mousestatus_t *ms,
* over 9 bits with SX/SY the relative top bit and
* X7..X0 and Y7..Y0 the lower bits.
*/
*x = (pb->ipacket[0] & MOUSE_PS2_XNEG) ?
pb->ipacket[4] - 256 : pb->ipacket[4];
*y = (pb->ipacket[0] & MOUSE_PS2_YNEG) ?
pb->ipacket[5] - 256 : pb->ipacket[5];
if (!(pb->ipacket[0] & 0xC8) && !(pb->ipacket[1] & 0x7F) &&
!(pb->ipacket[2] & 0x7F) && !(pb->ipacket[3] & 0xC9) &&
!(pb->ipacket[0] & 0x10) != !(pb->ipacket[1] & 0x80) &&
!(pb->ipacket[0] & 0x10) != !(pb->ipacket[3] & 0x10) &&
!(pb->ipacket[0] & 0x20) != !(pb->ipacket[2] & 0x80) &&
!(pb->ipacket[0] & 0x20) != !(pb->ipacket[3] & 0x20)) {
trackpoint_button =
((pb->ipacket[0] & 0x01) ? MOUSE_BUTTON1DOWN : 0) |
((pb->ipacket[0] & 0x02) ? MOUSE_BUTTON3DOWN : 0) |
((pb->ipacket[0] & 0x04) ? MOUSE_BUTTON2DOWN : 0);
*x = (pb->ipacket[0] & MOUSE_PS2_XNEG) ?
pb->ipacket[4] - 256 : pb->ipacket[4];
*y = (pb->ipacket[0] & MOUSE_PS2_YNEG) ?
pb->ipacket[5] - 256 : pb->ipacket[5];
trackpoint_button =
((pb->ipacket[0] & 0x01) ? MOUSE_BUTTON1DOWN : 0) |
((pb->ipacket[0] & 0x02) ? MOUSE_BUTTON3DOWN : 0) |
((pb->ipacket[0] & 0x04) ? MOUSE_BUTTON2DOWN : 0);
#ifdef EVDEV_SUPPORT
evdev_push_rel(sc->evdev_r, REL_X, *x);
evdev_push_rel(sc->evdev_r, REL_Y, -*y);
evdev_push_mouse_btn(sc->evdev_r, trackpoint_button);
evdev_sync(sc->evdev_r);
evdev_push_rel(sc->evdev_r, REL_X, *x);
evdev_push_rel(sc->evdev_r, REL_Y, -*y);
evdev_push_mouse_btn(sc->evdev_r, trackpoint_button);
evdev_sync(sc->evdev_r);
#endif
ms->button = touchpad_button | trackpoint_button;
ms->button = touchpad_button | trackpoint_button;
} else
VLOG(3, (LOG_DEBUG, "elantech: "
"unexpected trackpoint packet skipped\n"));
return (0);
case ELANTECH_PKT_NOP: