linux-stable.git/drivers/hid/hid-debug.c, branch v3.16.78

HID: debug: fix the ring buffer implementation

2019-03-25T17:32:34+00:00

commit 13054abbaa4f1fd4e6f3b4b63439ec033b4c8035 upstream.

Ring buffer implementation in hid_debug_event() and hid_debug_events_read()
is strange allowing lost or corrupted data. After commit 717adfdaf147
("HID: debug: check length before copy_to_user()") it is possible to enter
an infinite loop in hid_debug_events_read() by providing 0 as count, this
locks up a system. Fix this by rewriting the ring buffer implementation
with kfifo and simplify the code.

This fixes CVE-2019-3819.

v2: fix an execution logic and add a comment
v3: use __set_current_state() instead of set_current_state()

Link: https://bugzilla.redhat.com/show_bug.cgi?id=1669187
Fixes: cd667ce24796 ("HID: use debugfs for events/reports dumping")
Fixes: 717adfdaf147 ("HID: debug: check length before copy_to_user()")
Signed-off-by: Vladis Dronov 
Reviewed-by: Oleg Nesterov 
Signed-off-by: Benjamin Tissoires 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

HID: debug: improve hid_debug_event()

2019-03-25T17:32:34+00:00

commit 92529623d242cea4440958d7bcebdf291f4ab15e upstream.

The code in hid_debug_event() causes horrible code generation. First,
we do a strlen() call for every byte we copy (we're doing a store to
global memory, so gcc has no way of proving that strlen(buf) doesn't
change). Second, since both i, list->tail and HID_DEBUG_BUFSIZE have
signed type, the modulo computation has to take into account the
possibility that list->tail+i is negative, so it's not just a simple
and.

Fix the former by simply not doing strlen() at all (we have to load
buf[i] anyway, so testing it is almost free) and the latter by
changing i to unsigned. This cuts 29% (69 bytes) of the size of the
function.

Signed-off-by: Rasmus Villemoes 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

HID: debug: fix error handling in hid_debug_events_read()

2019-03-25T17:32:33+00:00

commit 8fec02a73e31407e14986fca67dab48d4f777f0e upstream.

In the unlikely case of hdev vanishing while hid_debug_events_read() was
sleeping, we can't really break out of the case switch as with other cases,
as on the way out we'll try to remove ourselves from the hdev waitqueue.

Fix this by taking a shortcut exit path and avoiding cleanup that doesn't
make sense in case hdev doesn't exist any more anyway.

Reported-by: Jiri Slaby 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

HID: debug: check length before copy_to_user()

2018-10-03T03:10:08+00:00

commit 717adfdaf14704fd3ec7fa2c04520c0723247eac upstream.

If our length is greater than the size of the buffer, we
overflow the buffer

Signed-off-by: Daniel Rosenberg 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

HID: add keyboard input assist hid usages

2014-11-17T14:11:57+00:00

commit f974008f07a62171a9dede08250c9a35c2b2b986 upstream.

Add keyboard input assist controls usages from approved
hid usage table request HUTTR42:
http://www.usb.org/developers/hidpage/HUTRR42c.pdf

Signed-off-by: Olivier Gay 
Acked-by: Dmitry Torokhov 
Signed-off-by: Jiri Kosina 
Signed-off-by: Luis Henriques

HID: core: add two new usages for digitizer

2014-06-03T11:27:24+00:00

On Feb 17, 2014, two new usages are approved to HID usage Table 18 -
Digitizer Page:

5A	Secondary Barrel Switch		MC	16.4
5B	Transducer Serial Number	SV	16.3.1

This patch adds relevant definitions to hid/input. It also removes
outdated comments in hid.h.

Signed-off-by: Ping Cheng 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

HID: debug: add labels for HID Sensor Usages

2014-05-28T13:45:15+00:00

Add in debugfs report descriptor labels for HID Sensor Usages.

Signed-off-by: Reyad Attiyat 
Signed-off-by: Jiri Kosina

HID: add missing hid usages

2014-04-28T14:57:58+00:00

Add some missing hid usages from consumer page, add
some display brightness control usages from approved hid usage
table request HUTTR41:
http://www.usb.org/developers/hidpage/HUTRR41.pdf
and add voice command usage from approved request HUTTR45:
http://www.usb.org/developers/hidpage/Voice_Command_Usage.pdf

[jkosina@suse.cz: removed KEY_BRIGHTNESS_TOGGLE / KEY_DISPLAYTOGGLE
 conflict from hid-debug.c]

Signed-off-by: Olivier Gay 
Signed-off-by: Mathieu Meisser 
Acked-by: Dmitry Torokhov 
Signed-off-by: Jiri Kosina

HID: debug: add labels for some new buttons

2013-12-17T12:54:40+00:00

Add labels for BTN_DPAD_UP, BTN_DPAD_DOWN, BTN_DPAD_LEFT, BTN_DPAD_RIGHT and
BTN_TOOL_QUADTAP.

[jkosina@suse.cz: make changelog more verbose]
Signed-off-by: Antonio Ospite 
Signed-off-by: Jiri Kosina

HID: debug: fix RCU preemption issue

2013-05-06T11:07:33+00:00

Commit 2353f2bea ("HID: protect hid_debug_list") introduced mutex
locking around debug_list access to prevent SMP races when debugfs
nodes are being operated upon by multiple userspace processess.

mutex is not a proper synchronization primitive though, as the hid-debug
callbacks are being called from atomic contexts.

We also have to be careful about disabling IRQs when taking the lock
to prevent deadlock against IRQ handlers.

Benjamin reports this has also been reported in RH bugzilla as bug #958935.

 ===============================
 [ INFO: suspicious RCU usage. ]
 3.9.0+ #94 Not tainted
 -------------------------------
 include/linux/rcupdate.h:476 Illegal context switch in RCU read-side critical section!

 other info that might help us debug this:

 rcu_scheduler_active = 1, debug_locks = 0
 4 locks held by Xorg/5502:
  #0:  (&evdev->mutex){+.+...}, at: [] evdev_write+0x6d/0x160
  #1:  (&(&dev->event_lock)->rlock#2){-.-...}, at: [] input_inject_event+0x5b/0x230
  #2:  (rcu_read_lock){.+.+..}, at: [] input_inject_event+0x42/0x230
  #3:  (&(&usbhid->lock)->rlock){-.....}, at: [] usb_hidinput_input_event+0x89/0x120

 stack backtrace:
 CPU: 0 PID: 5502 Comm: Xorg Not tainted 3.9.0+ #94
 Hardware name: Dell Inc. OptiPlex 390/0M5DCD, BIOS A09 07/24/2012
  0000000000000001 ffff8800689c7c38 ffffffff816f249f ffff8800689c7c68
  ffffffff810acb1d 0000000000000000 ffffffff81a03ac7 000000000000019d
  0000000000000000 ffff8800689c7c90 ffffffff8107cda7 0000000000000000
 Call Trace:
  [] dump_stack+0x19/0x1b
  [] lockdep_rcu_suspicious+0xfd/0x130
  [] __might_sleep+0xc7/0x230
  [] mutex_lock_nested+0x40/0x3a0
  [] ? vsnprintf+0x354/0x640
  [] hid_debug_event+0x34/0x100
  [] hid_dump_input+0x67/0xa0
  [] hid_set_field+0x50/0x120
  [] usb_hidinput_input_event+0x9a/0x120
  [] input_handle_event+0x8e/0x530
  [] input_inject_event+0x1d0/0x230
  [] ? input_inject_event+0x42/0x230
  [] evdev_write+0xde/0x160
  [] vfs_write+0xc8/0x1f0
  [] SyS_write+0x55/0xa0
  [] system_call_fastpath+0x16/0x1b
 BUG: sleeping function called from invalid context at kernel/mutex.c:413
 in_atomic(): 1, irqs_disabled(): 1, pid: 5502, name: Xorg
 INFO: lockdep is turned off.
 irq event stamp: 1098574
 hardirqs last  enabled at (1098573): [] _raw_spin_unlock_irqrestore+0x3f/0x70
 hardirqs last disabled at (1098574): [] _raw_spin_lock_irqsave+0x25/0xa0
 softirqs last  enabled at (1098306): [] __do_softirq+0x18f/0x3c0
 softirqs last disabled at (1097867): [] irq_exit+0xa5/0xb0
 CPU: 0 PID: 5502 Comm: Xorg Not tainted 3.9.0+ #94
 Hardware name: Dell Inc. OptiPlex 390/0M5DCD, BIOS A09 07/24/2012
  ffffffff81a03ac7 ffff8800689c7c68 ffffffff816f249f ffff8800689c7c90
  ffffffff8107ce60 0000000000000000 ffff8800689c7fd8 ffff88006a62c800
  ffff8800689c7d10 ffffffff816f7770 ffff8800689c7d00 ffffffff81312ac4
 Call Trace:
  [] dump_stack+0x19/0x1b
  [] __might_sleep+0x180/0x230
  [] mutex_lock_nested+0x40/0x3a0
  [] ? vsnprintf+0x354/0x640
  [] hid_debug_event+0x34/0x100
  [] hid_dump_input+0x67/0xa0
  [] hid_set_field+0x50/0x120
  [] usb_hidinput_input_event+0x9a/0x120
  [] input_handle_event+0x8e/0x530
  [] input_inject_event+0x1d0/0x230
  [] ? input_inject_event+0x42/0x230
  [] evdev_write+0xde/0x160
  [] vfs_write+0xc8/0x1f0
  [] SyS_write+0x55/0xa0
  [] system_call_fastpath+0x16/0x1b

Reported-by: majianpeng 
Reported-by: Benjamin Tissoires 
Reviewed-by: Dmitry Torokhov 
Signed-off-by: Jiri Kosina