Bug 282790 - hidraw(4) - Regression in documented behavior of HIDRAW_GET_REPORT.
Summary: hidraw(4) - Regression in documented behavior of HIDRAW_GET_REPORT.
Status: In Progress
Alias: None
Product: Base System
Classification: Unclassified
Component: usb (show other bugs)
Version: 14.1-RELEASE
Hardware: amd64 Any
: --- Affects Some People
Assignee: Vladimir Kondratyev
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-11-15 23:01 UTC by Matthew.Nygard.Dodd
Modified: 2024-11-26 00:31 UTC (History)
2 users (show)

See Also:
linimon: mfc-stable14?
linimon: mfc-stable13?


Attachments
Patch to hidraw.c correcting the defect. (2.41 KB, patch)
2024-11-15 23:01 UTC, Matthew.Nygard.Dodd
no flags Details | Diff
Patch to uhid.c correcting the defect. (1.53 KB, patch)
2024-11-16 19:36 UTC, Matthew.Nygard.Dodd
no flags Details | Diff
Patch to hidraw.c, uhid.c correcting the defect. (7.33 KB, patch)
2024-11-17 16:32 UTC, Matthew.Nygard.Dodd
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Matthew.Nygard.Dodd 2024-11-15 23:01:07 UTC
Created attachment 255207 [details]
Patch to hidraw.c correcting the defect.

hidraw(4) HIDRAW_GET_REPORT is documented to update hgd_actlen on return with the number of bytes copied.  It does not do this.
Comment 1 Matthew.Nygard.Dodd 2024-11-16 19:36:55 UTC
Created attachment 255223 [details]
Patch to uhid.c correcting the defect.

uhid(4) also appears to have the same issue.
Comment 2 Vladimir Kondratyev freebsd_committer freebsd_triage 2024-11-17 11:31:55 UTC
That is certainly a bug. Thank you for the report.

These patches require some changes:

In uhid.c ugd->ugd_actlen should be equal to imin(ugd->ugd_maxlen, size) rather than size

In hidraw.c  ugd->ugd_actlen should be taken from 4th parameter of preceding hid_get_report() call.
Comment 3 Matthew.Nygard.Dodd 2024-11-17 16:32:08 UTC
Created attachment 255239 [details]
Patch to hidraw.c, uhid.c correcting the defect.

Update with required changes, per feedback.
Comment 4 commit-hook freebsd_committer freebsd_triage 2024-11-18 04:32:53 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=0b5d86b38ae9aec92ef96b9227a404a2df3c9234

commit 0b5d86b38ae9aec92ef96b9227a404a2df3c9234
Author:     Matthew Nygard Dodd <Matthew.Nygard.Dodd@gmail.com>
AuthorDate: 2024-11-18 04:15:01 +0000
Commit:     Vladimir Kondratyev <wulf@FreeBSD.org>
CommitDate: 2024-11-18 04:31:24 +0000

    uhid(4): update ugd_actlen in USB_GET_REPORT ioctl

    USB_GET_REPORT ioctl is documented to update ugd_actlen on return with
    the number of bytes copied.  It does not do this.

    Reviewed by:    wulf
    PR:             282790
    MFC after:      1 week

 sys/dev/usb/input/uhid.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
Comment 5 commit-hook freebsd_committer freebsd_triage 2024-11-18 04:32:54 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=f4f46a2eef3be6d19c65a4ca4ee70f365dd5be4f

commit f4f46a2eef3be6d19c65a4ca4ee70f365dd5be4f
Author:     Matthew Nygard Dodd <Matthew.Nygard.Dodd@gmail.com>
AuthorDate: 2024-11-18 04:25:10 +0000
Commit:     Vladimir Kondratyev <wulf@FreeBSD.org>
CommitDate: 2024-11-18 04:31:39 +0000

    hidraw(4): update hgd_actlen in HIDRAW_GET_REPORT ioctl

    HIDRAW_GET_REPORT ioctl is documented to update hgd_actlen on return
    with the number of bytes copied.  It does not do this.

    Reviewed by:    wulf
    PR:             282790
    MFC after:      1 week

 sys/dev/hid/hidraw.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)