linux-stable.git/drivers/hid/hid-input.c, branch linux-3.11.y

HID: validate feature and input report details

2013-10-01T16:40:58+00:00

commit cc6b54aa54bf40b762cab45a9fc8aa81653146eb upstream.

When dealing with usage_index, be sure to properly use unsigned instead of
int to avoid overflows.

When working on report fields, always validate that their report_counts are
in bounds.
Without this, a HID device could report a malicious feature report that
could trick the driver into a heap overflow:

[  634.885003] usb 1-1: New USB device found, idVendor=0596, idProduct=0500
...
[  676.469629] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten

CVE-2013-2897

Signed-off-by: Benjamin Tissoires 
Acked-by: Kees Cook 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: battery: don't do DMA from stack

2013-09-27T00:21:46+00:00

commit 6c2794a2984f4c17a58117a68703cc7640f01c5a upstream.

Instead of using data from stack for DMA in hidinput_get_battery_property(),
allocate the buffer dynamically.

Reported-by: Richard Ryniker 
Reported-by: Alan Stern 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

Merge branches 'for-3.11/multitouch', 'for-3.11/sony' and 'for-3.11/upstream' into for-linus

2013-07-04T13:02:26+00:00

Conflicts:
	drivers/hid/hid-core.c

HID: explain out-of-range check better

2013-06-19T21:54:10+00:00

Extend the comment explaining the condition for discarding
out-of-range values to clarify the cases in which devices don't
provide any logical min/max.

Signed-off-by: Jiri Kosina

HID: fix false positive out of range values

2013-06-19T21:53:52+00:00

Commit 6da7066906e977d42104a859c490f5f9a300488c introduced in 3.3
"HID: ignore absolute values which don't fit between logical min and max"
prevents some Posiflex touch screen to work because they do not provide
logical min and max for their buttons.
Thus, logical min and max are at 0, discarding the buttons events, and
preventing the device to report appropriate X Y.

Adding a check on "min < max" solves the problem.

Reported-by: Jan Kandziora 
Tested-by: Jan Kandziora 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

HID: input: return ENODATA if reading battery attrs fails

2013-05-29T13:19:47+00:00

power_supply core has the bad habit of calling our battery callbacks
from within power_supply_register(). Furthermore, if the callbacks
fail with an unhandled error code, it will skip any uevent that it
might currently process.
So if HID-core registers battery devices, an "add" uevent is generated
and the battery callbacks are called. These will gracefully fail due
to timeouts as they might still hold locks on event processing. One
could argue that this should be fixed in power_supply core, but the
least we can do is to signal ENODATA so power_supply core will just
skip the property and continue with the uevent.

This fixes a bug where "add" and "remove" uevents are skipped for
battery devices. upower is unable to track these devices and currently
needs to ignore them.

This patch also overwrites any other error code. I cannot see any reason
why we should forward protocol- or I/O-errors to the power_supply core.
We handle these errors in hid_ll_driver later, anyway, so just skip
them. power_supply core cannot do anything useful with them, anyway,
and we avoid skipping important uevents and confusing user-space.

Thanks a lot to Daniel Nicoletti for pushing and investigating
on this.

Cc: Jiri Kosina 
Cc: Anton Vorontsov 
Cc: David Woodhouse 
Reported-by: Daniel Nicoletti 
Signed-off-by: David Herrmann 
Signed-off-by: Jiri Kosina

HID: input: don't register unmapped input devices

2013-03-27T13:02:45+00:00

There is no need to register an input device containing no events.
This allows drivers using the quirk MULTI_INPUT to register one input
per report effectively used.

For backward compatibility, we need to add a quirk to request
this behavior.

Signed-off-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

Merge branches 'for-3.7/upstream-fixes', 'for-3.8/hidraw', 'for-3.8/i2c-hid', 'for-3.8/multitouch', 'for-3.8/roccat', 'for-3.8/sensors' and 'for-3.8/upstream' into for-linus

2012-12-12T20:41:55+00:00

Conflicts:
	drivers/hid/hid-core.c

HID: hid-input: factorize hid_input allocation

2012-11-29T13:59:40+00:00

This just refactors the allocation of hid_input.
No semantic changes.

Signed-off-by: Benjamin Tissoires 
Reviewed-by: Henrik Rydberg 
Signed-off-by: Jiri Kosina

HID: add battery quirk for Apple 2009_ISO keyboard

2012-11-26T13:25:24+00:00

Support battery capacity on another Apple wireless keyboard.

Signed-off-by: Ortwin Glück 
Signed-off-by: Jiri Kosina