linux-stable.git/drivers/hid, branch v4.9.331

HID: roccat: Fix use-after-free in roccat_read()

2022-10-26T11:15:47+00:00

[ Upstream commit cacdb14b1c8d3804a3a7d31773bc7569837b71a4 ]

roccat_report_event() is responsible for registering
roccat-related reports in struct roccat_device.

int roccat_report_event(int minor, u8 const *data)
{
	struct roccat_device *device;
	struct roccat_reader *reader;
	struct roccat_report *report;
	uint8_t *new_value;

	device = devices[minor];

	new_value = kmemdup(data, device->report_size, GFP_ATOMIC);
	if (!new_value)
		return -ENOMEM;

	report = &device->cbuf[device->cbuf_end];

	/* passing NULL is safe */
	kfree(report->value);
	...

The registered report is stored in the struct roccat_device member
"struct roccat_report cbuf[ROCCAT_CBUF_SIZE];".
If more reports are received than the "ROCCAT_CBUF_SIZE" value,
kfree() the saved report from cbuf[0] and allocates a new reprot.
Since there is no lock when this kfree() is performed,
kfree() can be performed even while reading the saved report.

static ssize_t roccat_read(struct file *file, char __user *buffer,
		size_t count, loff_t *ppos)
{
	struct roccat_reader *reader = file->private_data;
	struct roccat_device *device = reader->device;
	struct roccat_report *report;
	ssize_t retval = 0, len;
	DECLARE_WAITQUEUE(wait, current);

	mutex_lock(&device->cbuf_lock);

	...

	report = &device->cbuf[reader->cbuf_start];
	/*
	 * If report is larger than requested amount of data, rest of report
	 * is lost!
	 */
	len = device->report_size > count ? count : device->report_size;

	if (copy_to_user(buffer, report->value, len)) {
		retval = -EFAULT;
		goto exit_unlock;
	}
	...

The roccat_read() function receives the device->cbuf report and
delivers it to the user through copy_to_user().
If the N+ROCCAT_CBUF_SIZE th report is received while copying of
the Nth report->value is in progress, the pointer that copy_to_user()
is working on is kfree()ed and UAF read may occur. (race condition)

Since the device node of this driver does not set separate permissions,
this is not a security vulnerability, but because it is used for
requesting screen display of profile or dpi settings,
a user using the roccat device can apply udev to this device node or
There is a possibility to use it by giving.

Signed-off-by: Hyunwoo Kim 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo

2022-09-20T09:50:15+00:00

[ Upstream commit 94553f8a218540d676efbf3f7827ed493d1057cf ]

The double `like' is duplicated in the comment, remove one.

Signed-off-by: Jason Wang 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: hidraw: fix memory leak in hidraw_release()

2022-09-05T08:23:57+00:00

commit a5623a203cffe2d2b84d2f6c989d9017db1856af upstream.

Free the buffered reports before deleting the list entry.

BUG: memory leak
unreferenced object 0xffff88810e72f180 (size 32):
  comm "softirq", pid 0, jiffies 4294945143 (age 16.080s)
  hex dump (first 32 bytes):
    64 f3 c6 6a d1 88 07 04 00 00 00 00 00 00 00 00  d..j............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kmemdup+0x23/0x50 mm/util.c:128
    [] kmemdup include/linux/fortify-string.h:440 [inline]
    [] hidraw_report_event+0xa2/0x150 drivers/hid/hidraw.c:521
    [] hid_report_raw_event+0x27d/0x740 drivers/hid/hid-core.c:1992
    [] hid_input_report+0x1ae/0x270 drivers/hid/hid-core.c:2065
    [] hid_irq_in+0x1ff/0x250 drivers/hid/usbhid/hid-core.c:284
    [] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1670
    [] usb_hcd_giveback_urb+0x1b6/0x1d0 drivers/usb/core/hcd.c:1747
    [] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988
    [] call_timer_fn+0x38/0x200 kernel/time/timer.c:1474
    [] expire_timers kernel/time/timer.c:1519 [inline]
    [] __run_timers.part.0+0x316/0x430 kernel/time/timer.c:1790
    [] __run_timers kernel/time/timer.c:1768 [inline]
    [] run_timer_softirq+0x44/0x90 kernel/time/timer.c:1803
    [] __do_softirq+0xe6/0x2ea kernel/softirq.c:571
    [] invoke_softirq kernel/softirq.c:445 [inline]
    [] __irq_exit_rcu kernel/softirq.c:650 [inline]
    [] irq_exit_rcu+0xc0/0x110 kernel/softirq.c:662
    [] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1106
    [] asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649
    [] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
    [] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
    [] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]
    [] acpi_idle_do_entry+0xc0/0xd0 drivers/acpi/processor_idle.c:554

Link: https://syzkaller.appspot.com/bug?id=19a04b43c75ed1092021010419b5e560a8172c4f
Reported-by: syzbot+f59100a0428e6ded9443@syzkaller.appspotmail.com
Signed-off-by: Karthik Alapati 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: hid-led: fix maximum brightness for Dream Cheeky

2022-06-14T14:52:31+00:00

[ Upstream commit 116c3f4a78ebe478d5ad5a038baf931e93e7d748 ]

Increase maximum brightness for Dream Cheeky to 63. Emperically
determined based on testing in kernel 4.4 on this device:

Bus 003 Device 002: ID 1d34:0004 Dream Cheeky Webmail Notifier

Fixes: 6c7ad07e9e05 ("HID: migrate USB LED driver from usb misc to hid")
Signed-off-by: Jonathan Teh 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports

2022-04-20T07:06:34+00:00

[ Upstream commit a5e5e03e94764148a01757b2fa4737d3445c13a6 ]

Internally kernel prepends all report buffers, for both numbered and
unnumbered reports, with report ID, therefore to properly handle unnumbered
reports we should prepend it ourselves.

For the same reason we should skip the first byte of the buffer when
calling i2c_hid_set_or_send_report() which then will take care of properly
formatting the transfer buffer based on its separate report ID argument
along with report payload.

[jkosina@suse.cz: finalize trimmed sentence in changelog as spotted by Benjamin]
Fixes: 9b5a9ae88573 ("HID: i2c-hid: implement ll_driver transport-layer callbacks")
Signed-off-by: Dmitry Torokhov 
Tested-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: add mapping for KEY_ALL_APPLICATIONS

2022-03-08T18:00:59+00:00

commit 327b89f0acc4c20a06ed59e4d9af7f6d804dc2e2 upstream.

This patch adds a new key definition for KEY_ALL_APPLICATIONS
and aliases KEY_DASHBOARD to it.

It also maps the 0x0c/0x2a2 usage code to KEY_ALL_APPLICATIONS.

Signed-off-by: William Mahon 
Acked-by: Benjamin Tissoires 
Link: https://lore.kernel.org/r/20220303035618.1.I3a7746ad05d270161a18334ae06e3b6db1a1d339@changeid
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

HID: wacom: add USB_HID dependency

2022-02-16T11:43:55+00:00

commit 9d14201c7444bbdf89413e88d91b73150c3de38b upstream.

The driver has gained a compile-time dependency that we should
express in Kconfig to avoid this link error:

drivers/hid/wacom_sys.o: In function `wacom_parse_and_register':
wacom_sys.c:(.text+0x2eec): undefined reference to `usb_hid_driver'

Fixes: 09dc28acaec7 ("HID: wacom: Improve generic name generation")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Jiri Kosina 
Cc: Jason Self 
Signed-off-by: Greg Kroah-Hartman

HID: apple: Do not reset quirks when the Fn key is not found

2022-01-27T07:47:36+00:00

[ Upstream commit a5fe7864d8ada170f19cc47d176bf8260ffb4263 ]

When a keyboard without a function key is detected, instead of removing
all quirks, remove only the APPLE_HAS_FN quirk.

Signed-off-by: José Expósito 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: wacom: Avoid using stale array indicies to read contact count

2022-01-27T07:47:31+00:00

commit 20f3cf5f860f9f267a6a6e5642d3d0525edb1814 upstream.

If we ever see a touch report with contact count data we initialize
several variables used to read the contact count in the pre-report
phase. These variables are never reset if we process a report which
doesn't contain a contact count, however. This can cause the pre-
report function to trigger a read of arbitrary memory (e.g. NULL
if we're lucky) and potentially crash the driver.

This commit restores resetting of the variables back to default
"none" values that were used prior to the commit mentioned
below.

Link: https://github.com/linuxwacom/input-wacom/issues/276
Fixes: 003f50ab673c (HID: wacom: Update last_slot_field during pre_report phase)
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke 
Reviewed-by: Ping Cheng 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: uhid: Fix worker destroying device without any protection

2022-01-27T07:47:31+00:00

commit 4ea5763fb79ed89b3bdad455ebf3f33416a81624 upstream.

uhid has to run hid_add_device() from workqueue context while allowing
parallel use of the userspace API (which is protected with ->devlock).
But hid_add_device() can fail. Currently, that is handled by immediately
destroying the associated HID device, without using ->devlock - but if
there are concurrent requests from userspace, that's wrong and leads to
NULL dereferences and/or memory corruption (via use-after-free).

Fix it by leaving the HID device as-is in the worker. We can clean it up
later, either in the UHID_DESTROY command handler or in the ->release()
handler.

Cc: stable@vger.kernel.org
Fixes: 67f8ecc550b5 ("HID: uhid: fix timeout when probe races with IO")
Signed-off-by: Jann Horn 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman