linux-stable.git/drivers/hid, branch v3.16.2

HID: fix a couple of off-by-ones

2014-09-05T23:36:24+00:00

commit 4ab25786c87eb20857bbb715c3ae34ec8fd6a214 upstream.

There are a few very theoretical off-by-one bugs in report descriptor size
checking when performing a pre-parsing fixup. Fix those.

Reported-by: Ben Hawkes 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: logitech: perform bounds checking on device_id early enough

2014-09-05T23:36:23+00:00

commit ad3e14d7c5268c2e24477c6ef54bbdf88add5d36 upstream.

device_index is a char type and the size of paired_dj_deivces is 7
elements, therefore proper bounds checking has to be applied to
device_index before it is used.

We are currently performing the bounds checking in
logi_dj_recv_add_djhid_device(), which is too late, as malicious device
could send REPORT_TYPE_NOTIF_DEVICE_UNPAIRED early enough and trigger the
problem in one of the report forwarding functions called from
logi_dj_raw_event().

Fix this by performing the check at the earliest possible ocasion in
logi_dj_raw_event().

Reported-by: Ben Hawkes 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: logitech: fix bounds checking on LED report size

2014-09-05T23:36:23+00:00

commit 51217e69697fba92a06e07e16f55c9a52d8e8945 upstream.

The check on report size for REPORT_TYPE_LEDS in logi_dj_ll_raw_request()
is wrong; the current check doesn't make any sense -- the report allocated
by HID core in hid_hw_raw_request() can be much larger than
DJREPORT_SHORT_LENGTH, and currently logi_dj_ll_raw_request() doesn't
handle this properly at all.

Fix the check by actually trimming down the report size properly if it is
too large.

Reported-by: Ben Hawkes 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

2014-07-07T20:13:03+00:00

Pull HID fixes from Jiri Kosina:
 "A few tiny HID subsystem fixes for 3.16"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: use multi input quirk for 22b9:2968
  HID: sensor-hub: fix potential memory leak
  HID: usbhid: quirk for PM1610 and PM1640 Touchscreen.
  HID: rmi: Protect PM-only functions by #ifdef CONFIG_PM
  HID: sensor-hub: introduce Kconfig dependency on IOMEM
  HID: sensor-hub: make dyn_callback_lock IRQ-safe

HID: use multi input quirk for 22b9:2968

2014-07-07T13:40:18+00:00

This device generates ABS_Z and ABS_RX events instead of ABS_X and
ABS_Y.

Signed-off-by: Wen-chien Jesse Sung 
Signed-off-by: Jiri Kosina

HID: sensor-hub: fix potential memory leak

2014-06-30T11:21:50+00:00

hsdev is not freed in sensor_hub_probe when kasprintf inside the for
loop fails. This is because hsdev is not set to platform_data yet (to
be freed by the code in the err_no_mem label). So free the memory
explicitly in the 'if' branch, as this is the only place where this is
(and will) be needed.

Reported-by: coverity
Signed-off-by: Jiri Slaby 
Cc: srinivas pandruvada 
Signed-off-by: Jiri Kosina

HID: usbhid: quirk for PM1610 and PM1640 Touchscreen.

2014-06-27T14:02:39+00:00

These device needs to be added to the quirks list with HID_QUIRK_NOGET,
otherwise they will reset upon receiving the get input report requests.

Signed-off-by: John Sung 
Signed-off-by: Jiri Kosina

HID: rmi: Protect PM-only functions by #ifdef CONFIG_PM

2014-06-12T08:23:27+00:00

If CONFIG_PM=n:

drivers/hid/hid-rmi.c:432: warning: ‘rmi_post_reset’ defined but not used
drivers/hid/hid-rmi.c:437: warning: ‘rmi_post_resume’ defined but not used

Signed-off-by: Geert Uytterhoeven 
Signed-off-by: Jiri Kosina

Merge tag 'modules-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux

2014-06-11T23:09:14+00:00

Pull module updates from Rusty Russell:
 "Most of this is cleaning up various driver sysfs permissions so we can
  re-add the perm check (we unified the module param and sysfs checks,
  but the module ones were stronger so we weakened them temporarily).

  Param parsing gets documented, and also "--" now forces args to be
  handed to init (and ignored by the kernel).

  Module NX/RO protections get tightened: we now set them before calling
  parse_args()"

* tag 'modules-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
  module: set nx before marking module MODULE_STATE_COMING.
  samples/kobject/: avoid world-writable sysfs files.
  drivers/hid/hid-picolcd_fb: avoid world-writable sysfs files.
  drivers/staging/speakup/: avoid world-writable sysfs files.
  drivers/regulator/virtual: avoid world-writable sysfs files.
  drivers/scsi/pm8001/pm8001_ctl.c: avoid world-writable sysfs files.
  drivers/hid/hid-lg4ff.c: avoid world-writable sysfs files.
  drivers/video/fbdev/sm501fb.c: avoid world-writable sysfs files.
  drivers/mtd/devices/docg3.c: avoid world-writable sysfs files.
  speakup: fix incorrect perms on speakup_acntsa.c
  cpumask.h: silence warning with -Wsign-compare
  Documentation: Update kernel-parameters.tx
  param: hand arguments after -- straight to init
  modpost: Fix resource leak in read_dump()

HID: sensor-hub: introduce Kconfig dependency on IOMEM

2014-06-11T08:52:35+00:00

When NO_IOMEM is enabled (e.g. score architecture), some drivers which
need HAS_IOMEM need notice about it, or it will report related warning:

  warning: (GPIO_SCH && GPIO_ICH && GPIO_VX855 && GPIO_RDC321X && IE6XX_WDT && RADIO_WL1273 && HID_SENSOR_HUB && MFD_NVEC) selects MFD_CORE which has unmet direct dependencies (HAS_IOMEM)

Signed-off-by: Chen Gang 
Signed-off-by: Jiri Kosina