svn commit: r329532 - stable/11/sys/dev/atkbdc

[Vladimir Kondratyev]

Author: wulf
Date: Sun Feb 18 22:04:42 2018
New Revision: 329532
URL: https://svnweb.freebsd.org/changeset/base/329532

Log:
  MFC r328864:
  
  psm(4): Fix panic occuring soon after PS/2 packet has been rejected by
  synaptics or elantech sanity checker.
  
  After packet has been rejected contents of packet buffer is not cleared
  with setting of inputbytes counter to 0. So when this packet buffer is
  filled again being an element of circular queue, new data appends to old
  data rather than overwrites it. This leads to packet buffer overflow
  after 10 rounds.
  
  Fix it with setting of packet's inputbytes counter to 0 after rejection.
  
  While here add extra logging of rejected packets.
  
  PR:		222667 (for reference)
  Reported by:	Neel Chauhan <neel at neelc.org>
  Tested by:	Neel Chauhan <neel at neelc.org>

Modified:
  stable/11/sys/dev/atkbdc/psm.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/dev/atkbdc/psm.c
==============================================================================
--- stable/11/sys/dev/atkbdc/psm.c	Sun Feb 18 21:07:15 2018	(r329531)
+++ stable/11/sys/dev/atkbdc/psm.c	Sun Feb 18 22:04:42 2018	(r329532)
@@ -4891,13 +4891,19 @@ psmsoftintr(void *arg)
 			break;
 
 		case MOUSE_MODEL_SYNAPTICS:
-			if (proc_synaptics(sc, pb, &ms, &x, &y, &z) != 0)
+			if (proc_synaptics(sc, pb, &ms, &x, &y, &z) != 0) {
+				VLOG(3, (LOG_DEBUG, "synaptics: "
+				    "packet rejected\n"));
 				goto next;
+			}
 			break;
 
 		case MOUSE_MODEL_ELANTECH:
-			if (proc_elantech(sc, pb, &ms, &x, &y, &z) != 0)
+			if (proc_elantech(sc, pb, &ms, &x, &y, &z) != 0) {
+				VLOG(3, (LOG_DEBUG, "elantech: "
+				    "packet rejected\n"));
 				goto next;
+			}
 			break;
 
 		case MOUSE_MODEL_TRACKPOINT:
@@ -4993,9 +4999,9 @@ next_native:
 		    sizeof(sc->queue.buf);
 		sc->queue.count += pb->inputbytes;
 	}
-	pb->inputbytes = 0;
 
 next:
+	pb->inputbytes = 0;
 	if (++sc->pqueue_start >= PSM_PACKETQUEUE)
 		sc->pqueue_start = 0;
 	} while (sc->pqueue_start != sc->pqueue_end);