linux-stable.git/drivers/hid, branch v5.4.36

HID: add ALWAYS_POLL quirk to lenovo pixart mouse

2020-03-21T07:11:59+00:00

commit 819d578d51d0ce73f06e35d69395ef55cd683a74 upstream.

A lenovo pixart mouse (17ef:608d) is afflicted common the the malfunction
where it disconnects and reconnects every minute--each time incrementing
the device number. This patch adds the device id of the device and
specifies that it needs the HID_QUIRK_ALWAYS_POLL quirk in order to
work properly.

Signed-off-by: Tony Fischetti 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: google: add moonball USB id

2020-03-21T07:11:58+00:00

commit 58322a1590fc189a8e1e349d309637d4a4942840 upstream.

Add 1 additional hammer-like device.

Signed-off-by: Chen-Tsung Hsieh 
Reviewed-by: Nicolas Boichat 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: hid-bigbenff: fix race condition for scheduled work during removal

2020-03-21T07:11:49+00:00

[ Upstream commit 4eb1b01de5b9d8596d6c103efcf1a15cfc1bedf7 ]

It's possible that there is scheduled work left while the device is
already being removed, which can cause a kernel crash. Adding a flag
will avoid this.

Signed-off-by: Hanno Zulla 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Sasha Levin

HID: hid-bigbenff: call hid_hw_stop() in case of error

2020-03-21T07:11:49+00:00

[ Upstream commit 976a54d0f4202cb412a3b1fc7f117e1d97db35f3 ]

It's required to call hid_hw_stop() once hid_hw_start() was called
previously, so error cases need to handle this. Also, hid_hw_close() is
not necessary during removal.

Signed-off-by: Hanno Zulla 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Sasha Levin

HID: hid-bigbenff: fix general protection fault caused by double kfree

2020-03-21T07:11:48+00:00

[ Upstream commit 789a2c250340666220fa74bc6c8f58497e3863b3 ]

The struct *bigben was allocated via devm_kzalloc() and then used as a
parameter in input_ff_create_memless(). This caused a double kfree
during removal of the device, since both the managed resource API and
ml_ff_destroy() in drivers/input/ff-memless.c would call kfree() on it.

Signed-off-by: Hanno Zulla 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Sasha Levin

HID: i2c-hid: add Trekstor Surfbook E11B to descriptor override

2020-03-21T07:11:48+00:00

[ Upstream commit be0aba826c4a6ba5929def1962a90d6127871969 ]

The Surfbook E11B uses the SIPODEV SP1064 touchpad, which does not supply
descriptors, so it has to be added to the override list.

BugLink: https://bugs.launchpad.net/bugs/1858299
Signed-off-by: Kai-Heng Feng 
Reviewed-by: Hans de Goede 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Sasha Levin

HID: apple: Add support for recent firmware on Magic Keyboards

2020-03-21T07:11:47+00:00

[ Upstream commit e433be929e63265b7412478eb7ff271467aee2d7 ]

Magic Keyboards with more recent firmware (0x0100) report Fn key differently.
Without this patch, Fn key may not behave as expected and may not be
configurable via hid_apple fnmode module parameter.

Signed-off-by: Mansour Behabadi 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: hiddev: Fix race in in hiddev_disconnect()

2020-03-05T15:43:45+00:00

commit 5c02c447eaeda29d3da121a2e17b97ccaf579b51 upstream.

Syzbot reports that "hiddev" is used after it's free in hiddev_disconnect().
The hiddev_disconnect() function sets "hiddev->exist = 0;" so
hiddev_release() can free it as soon as we drop the "existancelock"
lock.  This patch moves the mutex_unlock(&hiddev->existancelock) until
after we have finished using it.

Reported-by: syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com
Fixes: 7f77897ef2b6 ("HID: hiddev: fix potential use-after-free")
Suggested-by: Alan Stern 
Signed-off-by: Dan Carpenter 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: alps: Fix an error handling path in 'alps_input_configured()'

2020-03-05T15:43:45+00:00

commit 8d2e77b39b8fecb794e19cd006a12f90b14dd077 upstream.

They are issues:
   - if 'input_allocate_device()' fails and return NULL, there is no need
     to free anything and 'input_free_device()' call is a no-op. It can
     be axed.
   - 'ret' is known to be 0 at this point, so we must set it to a
     meaningful value before returning

Fixes: 2562756dde55 ("HID: add Alps I2C HID Touchpad-Stick support")
Signed-off-by: Christophe JAILLET 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: core: fix off-by-one memset in hid_report_raw_event()

2020-03-05T15:43:42+00:00

commit 5ebdffd25098898aff1249ae2f7dbfddd76d8f8f upstream.

In case a report is greater than HID_MAX_BUFFER_SIZE, it is truncated,
but the report-number byte is not correctly handled. This results in a
off-by-one in the following memset, causing a kernel Oops and ensuing
system crash.

Note: With commit 8ec321e96e05 ("HID: Fix slab-out-of-bounds read in
hid_field_extract") I no longer hit the kernel Oops as we instead fail
"controlled" at probe if there is a report too long in the HID
report-descriptor. hid_report_raw_event() is an exported symbol, so
presumabely we cannot always rely on this being the case.

Fixes: 966922f26c7f ("HID: fix a crash in hid_report_raw_event()
                     function.")
Signed-off-by: Johan Korsnes 
Cc: Armando Visconti 
Cc: Jiri Kosina 
Cc: Alan Stern 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman