linux-stable.git/drivers/input/misc, branch linux-3.12.y

Input: cm109 - validate number of endpoints before using them

2017-04-07T08:38:24+00:00

commit ac2ee9ba953afe88f7a673e1c0c839227b1d7891 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.

Fixes: c04148f915e5 ("Input: add driver for USB VoIP phones with CM109...")
Signed-off-by: Johan Hovold 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Jiri Slaby

Input: yealink - validate number of endpoints before using them

2017-04-07T08:38:24+00:00

commit 5cc4a1a9f5c179795c8a1f2b0f4361829d6a070e upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.

Fixes: aca951a22a1d ("[PATCH] input-driver-yealink-P1K-usb-phone")
Signed-off-by: Johan Hovold 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Jiri Slaby

Input: ims-pcu - validate number of endpoints before using them

2017-04-07T08:38:24+00:00

commit 1916d319271664241b7aa0cd2b05e32bdb310ce9 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack control-interface endpoints.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Signed-off-by: Johan Hovold 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Jiri Slaby

Input: uinput - handle compat ioctl for UI_SET_PHYS

2016-06-15T07:32:10+00:00

commit affa80bd97f7ca282d1faa91667b3ee9e4c590e6 upstream.

When running a 32-bit userspace on a 64-bit kernel, the UI_SET_PHYS
ioctl needs to be treated with special care, as it has the pointer
size encoded in the command.

Signed-off-by: Ricky Liang 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Jiri Slaby

Input: max8997-haptic - fix NULL pointer dereference

2016-05-16T14:29:24+00:00

commit 6ae645d5fa385f3787bf1723639cd907fe5865e7 upstream.

NULL pointer derefence happens when booting with DTB because the
platform data for haptic device is not set in supplied data from parent
MFD device.

The MFD device creates only platform data (from Device Tree) for itself,
not for haptic child.

Unable to handle kernel NULL pointer dereference at virtual address 0000009c
pgd = c0004000
	[0000009c] *pgd=00000000
	Internal error: Oops: 5 [#1] PREEMPT SMP ARM
	(max8997_haptic_probe) from [] (platform_drv_probe+0x4c/0xb0)
	(platform_drv_probe) from [] (driver_probe_device+0x214/0x2c0)
	(driver_probe_device) from [] (__driver_attach+0xac/0xb0)
	(__driver_attach) from [] (bus_for_each_dev+0x68/0x9c)
	(bus_for_each_dev) from [] (bus_add_driver+0x1a0/0x218)
	(bus_add_driver) from [] (driver_register+0x78/0xf8)
	(driver_register) from [] (do_one_initcall+0x90/0x1d8)
	(do_one_initcall) from [] (kernel_init_freeable+0x15c/0x1fc)
	(kernel_init_freeable) from [] (kernel_init+0x8/0x114)
	(kernel_init) from [] (ret_from_fork+0x14/0x3c)

Signed-off-by: Marek Szyprowski 
Fixes: 104594b01ce7 ("Input: add driver support for MAX8997-haptic")
[k.kozlowski: Write commit message, add CC-stable]
Signed-off-by: Krzysztof Kozlowski 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Jiri Slaby

Input: ati_remote2 - fix crashes on detecting device with invalid descriptor

2016-04-11T14:44:25+00:00

commit 950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d upstream.

The ati_remote2 driver expects at least two interfaces with one
endpoint each. If given malicious descriptor that specify one
interface or no endpoints, it will crash in the probe function.
Ensure there is at least two interfaces and one endpoint for each
interface before using it.

The full disclosure: http://seclists.org/bugtraq/2016/Mar/90

Reported-by: Ralf Spenneberg 
Signed-off-by: Vladis Dronov 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Jiri Slaby

Input: ims-pcu - sanity check against missing interfaces

2016-04-11T14:44:25+00:00

commit a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff upstream.

A malicious device missing interface can make the driver oops.
Add sanity checking.

Signed-off-by: Oliver Neukum 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Jiri Slaby

Input: powermate - fix oops with malicious USB descriptors

2016-04-11T14:44:09+00:00

commit 9c6ba456711687b794dcf285856fc14e2c76074f upstream.

The powermate driver expects at least one valid USB endpoint in its
probe function.  If given malicious descriptors that specify 0 for
the number of endpoints, it will crash.  Validate the number of
endpoints on the interface before using them.

The full report for this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/85

Reported-by: Ralf Spenneberg 
Signed-off-by: Josh Boyer 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Jiri Slaby

Input: twl4030-pwrbutton - ensure a wakeup event is recorded.

2015-04-27T17:59:56+00:00

commit c42bfd7f6cd26e8f712fc184460e32845d928d17 upstream.

This button is treated as a wakeup source, so we need to initialise it
correctly.

Without the device_init_wakeup() call, dev->power.wakeup will
be NULL, and pm_wakeup_event() will do nothing.

Signed-off-by: NeilBrown 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Jiri Slaby

Input: sirfsoc-onkey - fix GPL v2 license string typo

2015-04-27T17:59:56+00:00

commit 67f4aef20055afec73e37e7752bc6cc74fa01dea upstream.

Per license_is_gpl_compatible(), the MODULE_LICENSE() string for GPL v2 is
"GPL v2", not "GPLv2".  Use "GPL v2" so this module doesn't taint the
kernel.

Signed-off-by: Bjorn Helgaas 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Jiri Slaby