d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

psm(4): Fix panic occuring soon after PS/2 packet has been rejected by

Browse Source 
synaptics or elantech sanity checker.

After packet has been rejected contents of packet buffer is not cleared
with setting of inputbytes counter to 0. So when this packet buffer is
filled again being an element of circular queue, new data appends to old
data rather than overwrites it. This leads to packet buffer overflow
after 10 rounds.

Fix it with setting of packet's inputbytes counter to 0 after rejection.

While here add extra logging of rejected packets.

PR:		222667 (for reference)
Reported by:	Neel Chauhan <neel@neelc.org>
Tested by:	Neel Chauhan <neel@neelc.org>
MFC after:	1 week
This commit is contained in:
Vladimir Kondratyev 2018-02-04 23:01:48 +00:00
parent 68a574863d
commit 74a53bd131
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=328864
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sys/dev/atkbdc/psm.c
View File

@ -4935,13 +4935,19 @@ psmsoftintr(void *arg)
break;
case MOUSE_MODEL_SYNAPTICS:
if (proc_synaptics(sc, pb, &ms, &x, &y, &z) != 0)
if (proc_synaptics(sc, pb, &ms, &x, &y, &z) != 0) {
VLOG(3, (LOG_DEBUG, "synaptics: "
"packet rejected\n"));
goto next;
}
break;
case MOUSE_MODEL_ELANTECH:
if (proc_elantech(sc, pb, &ms, &x, &y, &z) != 0)
if (proc_elantech(sc, pb, &ms, &x, &y, &z) != 0) {
VLOG(3, (LOG_DEBUG, "elantech: "
"packet rejected\n"));
goto next;
}
break;
case MOUSE_MODEL_TRACKPOINT:
@ -5037,9 +5043,9 @@ psmsoftintr(void *arg)
sizeof(sc->queue.buf);
sc->queue.count += pb->inputbytes;
}
pb->inputbytes = 0;
next:
pb->inputbytes = 0;
if (++sc->pqueue_start >= PSM_PACKETQUEUE)
sc->pqueue_start = 0;
} while (sc->pqueue_start != sc->pqueue_end);