mfd: cros-ec: copy the whole event in get_next_event_xfer

Emil Karlson · bleungatchromium · commit d4d2313a3c17 · 2018-10-09T20:57:30.000-07:00
Commit 57e94c8 caused cros-ec keyboard events be truncated on many chromebooks so that Left and Right keys on Column 12 were always 0. Use ret as memcpy len to fix this. The old code was using ec_dev->event_size, which is the event payload/data size excluding event_type header, for the length of the memcpy operation. Use ret as memcpy length to avoid the off by one and copy the whole msg->data. Fixes: 57e94c8 ("mfd: cros-ec: Increase maximum mkbp event size") Acked-by: Enric Balletbo i Serra <enric.balletbo@collabora.com> Tested-by: Emil Renner Berthing <kernel@esmil.dk> Signed-off-by: Emil Karlson <jekarlson@gmail.com> Signed-off-by: Benson Leung <bleung@chromium.org>
diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
@@ -520,7 +520,7 @@ static int get_next_event_xfer(struct cros_ec_device *ec_dev,
 	ret = cros_ec_cmd_xfer(ec_dev, msg);
 	if (ret > 0) {
 		ec_dev->event_size = ret - 1;
-		memcpy(&ec_dev->event_data, msg->data, ec_dev->event_size);
+		memcpy(&ec_dev->event_data, msg->data, ret);
 	}
 
 	return ret;

Original file line number	Diff line number	Diff line change
`@@ -520,7 +520,7 @@ static int get_next_event_xfer(struct cros_ec_device *ec_dev,`
`520`	`520`	`ret = cros_ec_cmd_xfer(ec_dev, msg);`
`521`	`521`	`if (ret > 0) {`
`522`	`522`	`ec_dev->event_size = ret - 1;`
`523`		`- memcpy(&ec_dev->event_data, msg->data, ec_dev->event_size);`
	`523`	`+ memcpy(&ec_dev->event_data, msg->data, ret);`
`524`	`524`	`}`
`525`	`525`
`526`	`526`	`return ret;`