Skip to contentSkip to conversation

thinkpad_acpi: off by one in adaptive_keyboard_hotkey_notify_hotkey()

PATCH Applied Dan Carpenter 4 participants 5 messages Mar 11, 2015 – Mar 22, 2015

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 2/2 thinkpad_acpi: off by one in adaptive_keyboard_hotkey_notify_hotkey()

This should be >= instead of > because otherwise we read one element past the end of the hotkey_keycode_map[] array.

The hotkey_keycode_map[] array has TPACPI_HOTKEY_MAP_LEN elements.

Fixes 6a68d8557084 ('thinkpad_acpi: Add support for more adaptive kbd buttons')
drivers/platform/x86/thinkpad_acpi.c +3 -2
index 024861d..7769575 100644
@@ -3656,8 +3656,9 @@ static bool adaptive_keyboard_hotkey_notify_hotkey(unsigned int scancode)
 		return true;
 
 	default:
-		if (scancode < FIRST_ADAPTIVE_KEY || scancode > FIRST_ADAPTIVE_KEY +
-				TPACPI_HOTKEY_MAP_LEN - ADAPTIVE_KEY_OFFSET) {
+		if (scancode < FIRST_ADAPTIVE_KEY ||
+		    scancode >= FIRST_ADAPTIVE_KEY + TPACPI_HOTKEY_MAP_LEN -
+				ADAPTIVE_KEY_OFFSET) {
 			pr_info("Unhandled adaptive keyboard key: 0x%x\n",
 					scancode);
 			return false;
Acked-by on v1 2/2
#1 lore raw
Quoted 8 lines · Dan Carpenter

This should be >= instead of > because otherwise we read one element past the end of the hotkey_keycode_map[] array.

The hotkey_keycode_map[] array has TPACPI_HOTKEY_MAP_LEN elements.

Fixes 6a68d8557084 ('thinkpad_acpi: Add support for more adaptive

kbd buttons')

Quoted 22 lines
drivers/platform/x86/thinkpad_acpi.c +0 -1
index 024861d..7769575 100644
@@ -3656,8 +3656,9 @@ static bool 
 adaptive_keyboard_hotkey_notify_hotkey(unsigned int scancode)
                return true;
 
        default:
-               if (scancode < FIRST_ADAPTIVE_KEY || scancode > 

FIRST_ADAPTIVE_KEY +
- TPACPI_HOTKEY_MAP_LEN -
ADAPTIVE_KEY_OFFSET) {

drivers/platform/x86/thinkpad_acpi.c +2 -0
+               if (scancode < FIRST_ADAPTIVE_KEY ||
+                                               scancode >= 

FIRST_ADAPTIVE_KEY + TPACPI_HOTKEY_MAP_LEN -
+ ADAPTIVE_KEY_OFFSET) {
pr_info("Unhandled adaptive keyboard key:
0x%x\n",

                                        scancode);
                        return false;
Acked-by on v1 2/2
#2 lore raw
In reply to Dan Carpenter
Quoted 4 lines · Dan Carpenter
(quoted diff) +2 -0
+               if (scancode < FIRST_ADAPTIVE_KEY ||
+                   scancode >= FIRST_ADAPTIVE_KEY +

TPACPI_HOTKEY_MAP_LEN -
+ ADAPTIVE_KEY_OFFSET) {

Meh, I'd prefer that last linebreak to not be there, the 80-char rule is meant to be ignored when it causes the code to be less readable.

That said,

Thanks for the fix!

Signature · 4 lines
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh
Applied
#3 lore raw
In reply to Dan Carpenter
Quoted 7 lines · Dan Carpenter

This should be >= instead of > because otherwise we read one element past the end of the hotkey_keycode_map[] array.

The hotkey_keycode_map[] array has TPACPI_HOTKEY_MAP_LEN elements.

Fixes 6a68d8557084 ('thinkpad_acpi: Add support for more adaptive kbd buttons')

Queued, thanks.

Signature · 2 lines
Darren Hart
Intel Open Source Technology Center
Acked-by on v1 2/2
#4 lore raw

Re: [ibm-acpi-devel] [patch 2/2] thinkpad_acpi: off by one in adaptive_keyboard_hotkey_notify_hotkey

In reply to Dan Carpenter
Quoted 8 lines · Dan Carpenter

This should be >= instead of > because otherwise we read one element past the end of the hotkey_keycode_map[] array.

The hotkey_keycode_map[] array has TPACPI_HOTKEY_MAP_LEN elements.

Fixes 6a68d8557084 ('thinkpad_acpi: Add support for more adaptive kbd

buttons')

Signature · 4 lines
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh