linux-stable.git/drivers/hid/hid-hyperv.c, branch linux-5.4.y

HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()

2025-06-27T10:02:56+00:00

commit fe7f7ac8e0c708446ff017453add769ffc15deed upstream.

Update struct hid_descriptor to better reflect the mandatory and
optional parts of the HID Descriptor as per USB HID 1.11 specification.
Note: the kernel currently does not parse any optional HID class
descriptors, only the mandatory report descriptor.

Update all references to member element desc[0] to rpt_desc.

Add test to verify bLength and bNumDescriptors values are valid.

Replace the for loop with direct access to the mandatory HID class
descriptor member for the report descriptor. This eliminates the
possibility of getting an out-of-bounds fault.

Add a warning message if the HID descriptor contains any unsupported
optional HID class descriptors.

Reported-by: syzbot+c52569baf0c843f35495@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c52569baf0c843f35495
Fixes: f043bfc98c19 ("HID: usbhid: fix out-of-bounds bug")
Cc: stable@vger.kernel.org
Signed-off-by: Terry Junge 
Reviewed-by: Michael Kelley 
Signed-off-by: Jiri Kosina 
Signed-off-by: Terry Junge 
Signed-off-by: Greg Kroah-Hartman

HID: hyperv: fix possible memory leak in mousevsc_probe()

2022-11-25T16:42:04+00:00

[ Upstream commit b5bcb94b0954a026bbd671741fdb00e7141f9c91 ]

If hid_add_device() returns error, it should call hid_destroy_device()
to free hid_dev which is allocated in hid_allocate_device().

Fixes: 74c4fb058083 ("HID: hv_mouse: Properly add the hid device")
Signed-off-by: Yang Yingliang 
Reviewed-by: Wei Liu 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: hyperv: Use in-place iterator API in the channel callback

2019-10-01T18:49:41+00:00

Simplify the ring buffer handling with the in-place API.

Also avoid the dynamic allocation and the memory leak in the channel
callback function.

Signed-off-by: Dexuan Cui 
Acked-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: hv: Remove dependencies on PAGE_SIZE for ring buffer

2019-09-03T00:26:25+00:00

Define the ring buffer size as a constant expression because it should
not depend on the guest page size.

Signed-off-by: Maya Nakamura 
Reviewed-by: Michael Kelley 
Acked-by: Jiri Kosina 
Signed-off-by: Sasha Levin

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

2019-06-13T15:59:05+00:00

Pull HID fixes from Jiri Kosina:

 - regression fixes (reverts) for module loading changes that turned out
   to be incompatible with some userspace, from Benjamin Tissoires

 - regression fix for special Logitech unifiying receiver 0xc52f, from
   Hans de Goede

 - a few device ID additions to logitech driver, from Hans de Goede

 - fix for Bluetooth support on 2nd-gen Wacom Intuos Pro, from Jason
   Gerecke

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: logitech-dj: Fix 064d:c52f receiver support
  Revert "HID: core: Call request_module before doing device_add"
  Revert "HID: core: Do not call request_module() in async context"
  Revert "HID: Increase maximum report size allowed by hid_field_extract()"
  HID: a4tech: fix horizontal scrolling
  HID: hyperv: Add a module description line
  HID: logitech-hidpp: Add support for the S510 remote control
  HID: multitouch: handle faulty Elo touch device
  HID: wacom: Sync INTUOSP2_BT touch state after each frame if necessary
  HID: wacom: Correct button numbering 2nd-gen Intuos Pro over Bluetooth
  HID: wacom: Send BTN_TOUCH in response to INTUOSP2_BT eraser contact
  HID: wacom: Don't report anything prior to the tool entering range
  HID: wacom: Don't set tool type until we're in range
  HID: rmi: Use SET_REPORT request on control endpoint for Acer Switch 3 and 5
  HID: logitech-hidpp: add support for the MX5500 keyboard
  HID: logitech-dj: add support for the Logitech MX5500's Bluetooth Mini-Receiver
  HID: i2c-hid: add iBall Aer3 to descriptor override

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288

2019-06-05T15:36:37+00:00

Based on 1 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms and conditions of the gnu general public license
  version 2 as published by the free software foundation this program
  is distributed in the hope it will be useful but without any
  warranty without even the implied warranty of merchantability or
  fitness for a particular purpose see the gnu general public license
  for more details

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-only

has been chosen to replace the boilerplate/reference in 263 file(s).

Signed-off-by: Thomas Gleixner 
Reviewed-by: Allison Randal 
Reviewed-by: Alexios Zavras 
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190529141901.208660670@linutronix.de
Signed-off-by: Greg Kroah-Hartman

HID: hyperv: Add a module description line

2019-05-31T22:18:04+00:00

This patch only adds a MODULE_DESCRIPTION statement to the driver.
This change is only cosmetic, so there should be no runtime impact.

Signed-off-by: Joseph Salisbury 
Reviewed-by: Michael Kelley 
Signed-off-by: Sasha Levin 
Signed-off-by: Jiri Kosina

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2018-12-04T16:47:04+00:00

Pull input updates from Dmitry Torokhov:
 "Mostly new IDs for Elan/Synaptics touchpads, plus a few small fixups"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: omap-keypad - fix keyboard debounce configuration
  Input: xpad - quirk all PDP Xbox One gamepads
  Input: synaptics - enable SMBus for HP 15-ay000
  Input: synaptics - add PNP ID for ThinkPad P50 to SMBus
  Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15ARR
  Input: elan_i2c - add support for ELAN0621 touchpad
  Input: hyper-v - fix wakeup from suspend-to-idle
  Input: atkbd - clean up indentation issue
  Input: st1232 - convert to SPDX identifiers
  Input: migor_ts - convert to SPDX identifiers
  Input: dt-bindings - fix a typo in file input-reset.txt
  Input: cros_ec_keyb - fix button/switch capability reports
  Input: elan_i2c - add ELAN0620 to the ACPI table
  Input: matrix_keypad - check for errors from of_get_named_gpio()

Input: hyper-v - fix wakeup from suspend-to-idle

2018-11-15T19:05:53+00:00

It makes little sense but still possible to put Hyper-V guests into
suspend-to-idle state. To wake them up two wakeup sources were registered
in the past: hyperv-keyboard and hid-hyperv. However, since
commit eed4d47efe95 ("ACPI / sleep: Ignore spurious SCI wakeups from
suspend-to-idle") pm_wakeup_event() from these devices is ignored. Switch
to pm_wakeup_hard_event() API as these devices are actually the only
possible way to wakeup Hyper-V guests.

Fixes: eed4d47efe95 (ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle)
Reviewed-by: Rafael J. Wysocki 
Acked-by: K. Y. Srinivasan 
Acked-by: Jiri Kosina 
Signed-off-by: Vitaly Kuznetsov 
Signed-off-by: Dmitry Torokhov

use the new async probing feature for the hyperv drivers

2018-07-03T11:02:28+00:00

Recent kernels support asynchronous probing; most hyperv drivers
can be probed async easily so set the required flag for this.

Signed-off-by: Arjan van de Ven 
Signed-off-by: Stephen Hemminger 
Signed-off-by: K. Y. Srinivasan 
Signed-off-by: Greg Kroah-Hartman