linux-stable.git/drivers/hid/hidraw.c, branch linux-3.2.y

HID: hidraw: correctly deallocate memory on device disconnect

2013-10-26T20:05:57+00:00

commit 212a871a3934beccf43431608c27ed2e05a476ec upstream.

This changes puts the commit 4fe9f8e203f back in place
with the fixes for slab corruption because of the commit.

When a device is unplugged, wait for all processes that
have opened the device to close before deallocating the device.

This commit was solving kernel crash because of the corruption in
rb tree of vmalloc. The rootcause was the device data pointer was
geting excessed after the memory associated with hidraw was freed.

The commit 4fe9f8e203f was buggy as it was also freeing the hidraw
first and then calling delete operation on the list associated with
that hidraw leading to slab corruption.

Signed-off-by: Manoj Chourasia 
Tested-by: Peter Wu 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

HID: hidraw: put old deallocation mechanism in place

2013-10-26T20:05:57+00:00

commit df0cfd6990347c20ae031f3f34137cba274f1972 upstream.

This basically reverts commit 4fe9f8e203fda. It causes multiple problems,
namely:

- after rmmod/modprobe cycle of bus driver, the input is not claimed any
  more. This is likely because of misplaced hid_hw_close()
- it causes memory corruption on hidraw_list

As original patch author is not responding to requests to fix his patch,
and the original deallocation mechanism is not exposing any problems, I
am reverting back to it.

Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

HID: hidraw: don't deallocate memory when it is in use

2012-10-10T02:31:18+00:00

commit 4fe9f8e203fdad1524c04beb390f3c6099781ed9 upstream.

When a device is unplugged, wait for all processes that have opened the device
to close before deallocating the device.

Signed-off-by: Ratan Nalumasu 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

HID: hidraw: improve error handling in hidraw_init()

2012-10-10T02:31:17+00:00

commit bcb4a75bde3821cecb17a71d287abfd6ef9bd68d upstream.

Several improvements in error handling:
- do not report success if alloc_chrdev_region() failed
- check for error code of cdev_add()
- use unregister_chrdev_region() instead of unregister_chrdev()
  if class_create() failed

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

HID: hidraw: fix list->buffer memleak

2012-10-10T02:31:17+00:00

commit 4c7b417ecb756e85dfc955b0e7a04fd45585533e upstream.

If we don't read fast enough hidraw device, hidraw_report_event
will cycle and we will leak list->buffer.
Also list->buffer are not free on release.
After this patch, kmemleak report nothing.

Signed-off-by: Matthieu CASTET 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

HID: hidraw: add proper error handling to raw event reporting

2012-10-10T02:31:16+00:00

commit b6787242f32700377d3da3b8d788ab3928bab849 upstream.

If kmemdup() in hidraw_report_event() fails, we are not propagating
this fact properly.

Let hidraw_report_event() and hid_report_raw_event() return an error
value to the caller.

Reported-by: Oliver Neukum 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

Merge branch 'upstream' into for-linus

2011-10-25T07:59:04+00:00

Conflicts:
	drivers/hid/hid-core.c
	drivers/hid/hid-ids.h

HID: hidraw: open count should not increase if error

2011-09-27T16:42:22+00:00

In hidraw_open, if hid_hw_power returns with error, hidraw device open count
should not increase.

Signed-off-by: Amit Nagal 
Signed-off-by: Jiri Kosina

HID: hidraw: protect hidraw_disconnect() better

2011-09-20T13:23:46+00:00

The function hidraw_disconnect() only acquires the hidraw minors_lock
when clearing the entry in hidraw_table. However the device_destroy()
call can cause a userland read/write to return with an error. It may
cause the program to release the file descripter before the disconnect
is finished. hidraw_disconnect() has already set hidraw->exist to 0,
which makes hidraw_release() kfree the hidraw structure, which
hidraw_disconnect() continues to access and even tries to kfree again.
Similarly if a hidraw_release() occurs after setting hidraw->exist to 0,
the same thing can happen.

This is fixed by expanding the mutex critical section to cover the whole
function from setting hidraw->exist to 0 to freeing the hidraw
structure, preventing a hidraw_release() from interfering.

Signed-off-by: James Hogan 
Tested-by: David Herrmann 
Signed-off-by: Jiri Kosina

HID: hidraw: free list for all error in hidraw_open

2011-09-07T11:48:47+00:00

In function hidraw_open struct hidraw_list *list should be freed for
all error conditions.

Signed-off-by: Amit Nagal 
Signed-off-by: Jiri Kosina