linux.git/drivers/hid/hid-core.c, branch v5.13

HID: core: Remove extraneous empty line before EXPORT_SYMBOL_GPL(hid_check_keys_pressed)

2021-05-27T13:40:34+00:00

Normally the EXPORT_SYMBOL of a function immediately follows the
declaration of the function and all the other functions in hid-core.c
follow this pattern, drop the extraneous empty line before the
EXPORT_SYMBOL_GPL(hid_check_keys_pressed); line.

Signed-off-by: Hans de Goede 
Signed-off-by: Jiri Kosina

HID: Add BUS_VIRTUAL to hid_connect logging

2021-05-05T13:09:09+00:00

Add BUS_VIRTUAL to hid_connect logging since it's a valid hid bus type and it
should not print 

Signed-off-by: Mark Bolhuis 
Signed-off-by: Jiri Kosina

HID: hid-core: Fix incorrect function name in header

2021-04-07T16:46:20+00:00

Fixes the following W=1 kernel build warning(s):

 drivers/hid/hid-core.c:2142: warning: expecting prototype for store_new_id(). Prototype was for new_id_store() instead

Cc: Jiri Kosina 
Cc: Benjamin Tissoires 
Cc: Vojtech Pavlik 
Cc: Michael Haboustak 
Cc: linux-input@vger.kernel.org
Signed-off-by: Lee Jones 
Signed-off-by: Benjamin Tissoires

HID: make arrays usage and value to be the same

2021-01-18T08:09:57+00:00

The HID subsystem allows an "HID report field" to have a different
number of "values" and "usages" when it is allocated. When a field
struct is created, the size of the usage array is guaranteed to be at
least as large as the values array, but it may be larger. This leads to
a potential out-of-bounds write in
__hidinput_change_resolution_multipliers() and an out-of-bounds read in
hidinput_count_leds().

To fix this, let's make sure that both the usage and value arrays are
the same size.

Cc: stable@vger.kernel.org
Signed-off-by: Will McVicker 
Signed-off-by: Jiri Kosina

HID: core: detect and skip invalid inputs to snto32()

2021-01-08T13:50:40+00:00

Prevent invalid (0, 0) inputs to hid-core's snto32() function.

Maybe it is just the dummy device here that is causing this, but
there are hundreds of calls to snto32(0, 0). Having n (bits count)
of 0 is causing the current UBSAN trap with a shift value of
0xffffffff (-1, or n - 1 in this function).

Either of the value to shift being 0 or the bits count being 0 can be
handled by just returning 0 to the caller, avoiding the following
complex shift + OR operations:

	return value & (1 << (n - 1)) ? value | (~0U << n) : value;

Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split")
Signed-off-by: Randy Dunlap 
Reported-by: syzbot+1e911ad71dd4ea72e04a@syzkaller.appspotmail.com
Cc: Jiri Kosina 
Cc: Benjamin Tissoires 
Cc: linux-input@vger.kernel.org
Signed-off-by: Jiri Kosina

Merge branch 'for-5.9/upstream-fixes' into for-linus

2020-10-15T18:41:43+00:00

- "heartbeat" report fix for several Wacom devices
- Lenovo X1 Tablet support improvements
- new device IDs
- bounds checking fix in hid-roccat
- stylus battery reporting fix

HID: add vivaldi HID driver

2020-09-30T20:44:26+00:00

Add vivaldi HID driver. This driver allows us to read and report the top
row layout of keyboards which provide a vendor-defined (Google) HID
usage.

Signed-off-by: Sean O'Brien 
Signed-off-by: Jiri Kosina

HID: core: fix kerneldoc warnings in hid-core.c

2020-09-23T11:10:45+00:00

Fix following warnings caused by mismatch bewteen function parameters
and comments.
drivers/hid/hid-core.c:931: warning: Function parameter or member 'hid' not described in 'hid_parse_report'
drivers/hid/hid-core.c:931: warning: Excess function parameter 'device' description in 'hid_parse_report'
drivers/hid/hid-core.c:961: warning: Function parameter or member 'hid' not described in 'hid_validate_values'
drivers/hid/hid-core.c:961: warning: Excess function parameter 'device' description in 'hid_validate_values'
drivers/hid/hid-core.c:1452: warning: Function parameter or member 'report' not described in 'hid_match_report'
drivers/hid/hid-core.c:1452: warning: Excess function parameter 'report_type' description in 'hid_match_report'
drivers/hid/hid-core.c:2132: warning: Function parameter or member 'drv' not described in 'new_id_store'
drivers/hid/hid-core.c:2132: warning: Excess function parameter 'driver' description in 'new_id_store'

Signed-off-by: Xiaofei Tan 
Signed-off-by: Jiri Kosina

HID: core: Correctly handle ReportSize being zero

2020-09-01T08:25:49+00:00

It appears that a ReportSize value of zero is legal, even if a bit
non-sensical. Most of the HID code seems to handle that gracefully,
except when computing the total size in bytes. When fed as input to
memset, this leads to some funky outcomes.

Detect the corner case and correctly compute the size.

Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier 
Signed-off-by: Benjamin Tissoires

HID: core: fix off-by-one memset in hid_report_raw_event()

2020-02-12T13:18:33+00:00

In case a report is greater than HID_MAX_BUFFER_SIZE, it is truncated,
but the report-number byte is not correctly handled. This results in a
off-by-one in the following memset, causing a kernel Oops and ensuing
system crash.

Note: With commit 8ec321e96e05 ("HID: Fix slab-out-of-bounds read in
hid_field_extract") I no longer hit the kernel Oops as we instead fail
"controlled" at probe if there is a report too long in the HID
report-descriptor. hid_report_raw_event() is an exported symbol, so
presumabely we cannot always rely on this being the case.

Fixes: 966922f26c7f ("HID: fix a crash in hid_report_raw_event()
                     function.")
Signed-off-by: Johan Korsnes 
Cc: Armando Visconti 
Cc: Jiri Kosina 
Cc: Alan Stern 
Signed-off-by: Jiri Kosina