BMC/Intel-BMC/linux.git/drivers/hid/usbhid/hiddev.c, branch dev

HID: use hid_hw_wait() instead of direct call to usbhid

2013-02-25T12:26:41+00:00

This removes most of the dependencies between hid drivers and usbhid. The patch was constructed by replacing all occurences of usbhid_wait_io() by its hid_hw_wait() counterpart. Then, drivers not requiring USB_HID anymore have their USB_HID dependency cleaned in the Kconfig file. As of today, few drivers are still requiring an explicit USB layer dependency: * ntrig (a patch is on its way) * multitouch (one patch following and another on its way) * lenovo tpkbd * roccat * sony The last three are two deeply using direct calls to the usb subsystem to be able to be cleaned right now. Signed-off-by: Benjamin Tissoires Reviewed-by: Mika Westerberg Signed-off-by: Jiri Kosina

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25T12:26:41+00:00

This allows the hid drivers to be independent from the transport layer. The patch was constructed by replacing all occurences of usbhid_submit_report() by its hid_hw_request() counterpart. Then, drivers not requiring USB_HID anymore have their USB_HID dependency cleaned in the Kconfig file. Finally, few drivers still depends on USB_HID. Many of them are requiring the io wait callback. They are found in the next patch. Signed-off-by: Benjamin Tissoires Reviewed-by: Mika Westerberg For the sensor-hub part: Tested-by: Mika Westerberg Signed-off-by: Jiri Kosina

HID: hiddev: fix nonblocking read semantics wrt EIO/ERESTARTSYS

2012-11-27T23:10:44+00:00

When the file has been open in non-blocking mode, EIO or ERESTARTSYS would never be returned even if they should (for example when device has been unplugged, you want EIO and not EAGAIN to be returned). Move the O_NONBLOCK check after other checks have been performed. Base on similar patch done to hidraw by Founder Fang Signed-off-by: Jiri Kosina

HID: hiddev: Remove redundant check on unsigned variable

2012-11-16T09:26:23+00:00

No need to check whether unsigned variable is less than 0. CC: Jiri Kosina CC: linux-usb@vger.kernel.org CC: linux-input@vger.kernel.org Signed-off-by: Tushar Behera Signed-off-by: Jiri Kosina

HID: hiddev: Use vzalloc to allocate hiddev_list

2012-04-27T14:03:40+00:00

Everytime a HID device is opened, a new hiddev_list is allocated with kzalloc. This requires 64KB of physically contiguous memory, which could easily push a heavily loaded system over the edge. Allocating the same amount of memory with vmalloc shouldn't be nearly as demanding, so let's do that instead. The memory isn't used for DMA and doesn't look particularly performance sensitive, so this should be safe. Signed-off-by: Havard Skinnemoen Signed-off-by: Jiri Kosina

HID: usbhid: fix dead lock between open and disconect

2012-02-02T08:48:00+00:00

There is no reason to hold hiddev->existancelock before calling usb_deregister_dev, so move it out of the lock. The patch fixes the lockdep warning below. [ 5733.386271] ====================================================== [ 5733.386274] [ INFO: possible circular locking dependency detected ] [ 5733.386278] 3.2.0-custom-next-20120111+ #1 Not tainted [ 5733.386281] ------------------------------------------------------- [ 5733.386284] khubd/186 is trying to acquire lock: [ 5733.386288] (minor_rwsem){++++.+}, at: [] usb_deregister_dev+0x37/0x9e [usbcore] [ 5733.386311] [ 5733.386312] but task is already holding lock: [ 5733.386315] (&hiddev->existancelock){+.+...}, at: [] hiddev_disconnect+0x26/0x87 [usbhid] [ 5733.386328] [ 5733.386329] which lock already depends on the new lock. [ 5733.386330] [ 5733.386333] [ 5733.386334] the existing dependency chain (in reverse order) is: [ 5733.386336] [ 5733.386337] -> #1 (&hiddev->existancelock){+.+...}: [ 5733.386346] [] lock_acquire+0xcb/0x10e [ 5733.386357] [] __mutex_lock_common+0x60/0x465 [ 5733.386366] [] mutex_lock_nested+0x36/0x3b [ 5733.386371] [] hiddev_open+0x113/0x193 [usbhid] [ 5733.386378] [] usb_open+0x66/0xc2 [usbcore] [ 5733.386390] [] chrdev_open+0x12b/0x154 [ 5733.386402] [] __dentry_open.isra.16+0x20b/0x355 [ 5733.386408] [] nameidata_to_filp+0x43/0x4a [ 5733.386413] [] do_last+0x536/0x570 [ 5733.386419] [] path_openat+0xce/0x301 [ 5733.386423] [] do_filp_open+0x33/0x81 [ 5733.386427] [] do_sys_open+0x6a/0xfc [ 5733.386431] [] sys_open+0x1c/0x1e [ 5733.386434] [] system_call_fastpath+0x16/0x1b [ 5733.386441] [ 5733.386441] -> #0 (minor_rwsem){++++.+}: [ 5733.386448] [] __lock_acquire+0xa80/0xd74 [ 5733.386454] [] lock_acquire+0xcb/0x10e [ 5733.386458] [] down_write+0x44/0x77 [ 5733.386464] [] usb_deregister_dev+0x37/0x9e [usbcore] [ 5733.386475] [] hiddev_disconnect+0x3c/0x87 [usbhid] [ 5733.386483] [] hid_disconnect+0x3f/0x54 [ 5733.386491] [] hid_device_remove+0x4e/0x7a [ 5733.386496] [] __device_release_driver+0x81/0xcd [ 5733.386502] [] device_release_driver+0x20/0x2d [ 5733.386507] [] bus_remove_device+0x114/0x128 [ 5733.386512] [] device_del+0x131/0x183 [ 5733.386519] [] hid_destroy_device+0x1e/0x3d [ 5733.386525] [] usbhid_disconnect+0x36/0x42 [usbhid] [ 5733.386530] [] usb_unbind_interface+0x57/0x11f [usbcore] [ 5733.386542] [] __device_release_driver+0x81/0xcd [ 5733.386547] [] device_release_driver+0x20/0x2d [ 5733.386552] [] bus_remove_device+0x114/0x128 [ 5733.386557] [] device_del+0x131/0x183 [ 5733.386562] [] usb_disable_device+0xa8/0x1d8 [usbcore] [ 5733.386573] [] usb_disconnect+0xab/0x11f [usbcore] [ 5733.386583] [] hub_thread+0x73b/0x1157 [usbcore] [ 5733.386593] [] kthread+0x95/0x9d [ 5733.386601] [] kernel_thread_helper+0x4/0x10 [ 5733.386607] [ 5733.386608] other info that might help us debug this: [ 5733.386609] [ 5733.386612] Possible unsafe locking scenario: [ 5733.386613] [ 5733.386615] CPU0 CPU1 [ 5733.386618] ---- ---- [ 5733.386620] lock(&hiddev->existancelock); [ 5733.386625] lock(minor_rwsem); [ 5733.386630] lock(&hiddev->existancelock); [ 5733.386635] lock(minor_rwsem); [ 5733.386639] [ 5733.386640] *** DEADLOCK *** [ 5733.386641] [ 5733.386644] 6 locks held by khubd/186: [ 5733.386646] #0: (&__lockdep_no_validate__){......}, at: [] hub_thread+0x14a/0x1157 [usbcore] [ 5733.386661] #1: (&__lockdep_no_validate__){......}, at: [] usb_disconnect+0x50/0x11f [usbcore] [ 5733.386677] #2: (hcd->bandwidth_mutex){+.+.+.}, at: [] usb_disconnect+0xa1/0x11f [usbcore] [ 5733.386693] #3: (&__lockdep_no_validate__){......}, at: [] device_release_driver+0x18/0x2d [ 5733.386704] #4: (&__lockdep_no_validate__){......}, at: [] device_release_driver+0x18/0x2d [ 5733.386714] #5: (&hiddev->existancelock){+.+...}, at: [] hiddev_disconnect+0x26/0x87 [usbhid] [ 5733.386727] [ 5733.386727] stack backtrace: [ 5733.386731] Pid: 186, comm: khubd Not tainted 3.2.0-custom-next-20120111+ #1 [ 5733.386734] Call Trace: [ 5733.386741] [] ? up+0x34/0x3b [ 5733.386747] [] print_circular_bug+0x1f8/0x209 [ 5733.386752] [] __lock_acquire+0xa80/0xd74 [ 5733.386756] [] ? trace_hardirqs_on_caller+0x15d/0x1a3 [ 5733.386763] [] ? vprintk+0x3f4/0x419 [ 5733.386774] [] ? usb_deregister_dev+0x37/0x9e [usbcore] [ 5733.386779] [] lock_acquire+0xcb/0x10e [ 5733.386789] [] ? usb_deregister_dev+0x37/0x9e [usbcore] [ 5733.386797] [] down_write+0x44/0x77 [ 5733.386807] [] ? usb_deregister_dev+0x37/0x9e [usbcore] [ 5733.386818] [] usb_deregister_dev+0x37/0x9e [usbcore] [ 5733.386825] [] hiddev_disconnect+0x3c/0x87 [usbhid] [ 5733.386830] [] hid_disconnect+0x3f/0x54 [ 5733.386834] [] hid_device_remove+0x4e/0x7a [ 5733.386839] [] __device_release_driver+0x81/0xcd [ 5733.386844] [] device_release_driver+0x20/0x2d [ 5733.386848] [] bus_remove_device+0x114/0x128 [ 5733.386854] [] device_del+0x131/0x183 [ 5733.386859] [] hid_destroy_device+0x1e/0x3d [ 5733.386865] [] usbhid_disconnect+0x36/0x42 [usbhid] [ 5733.386876] [] usb_unbind_interface+0x57/0x11f [usbcore] [ 5733.386882] [] __device_release_driver+0x81/0xcd [ 5733.386886] [] device_release_driver+0x20/0x2d [ 5733.386890] [] bus_remove_device+0x114/0x128 [ 5733.386895] [] device_del+0x131/0x183 [ 5733.386905] [] usb_disable_device+0xa8/0x1d8 [usbcore] [ 5733.386916] [] usb_disconnect+0xab/0x11f [usbcore] [ 5733.386921] [] ? __mutex_unlock_slowpath+0x130/0x141 [ 5733.386929] [] hub_thread+0x73b/0x1157 [usbcore] [ 5733.386935] [] ? finish_task_switch+0x78/0x150 [ 5733.386941] [] ? __init_waitqueue_head+0x4c/0x4c [ 5733.386950] [] ? usb_remote_wakeup+0x56/0x56 [usbcore] [ 5733.386955] [] kthread+0x95/0x9d [ 5733.386961] [] kernel_thread_helper+0x4/0x10 [ 5733.386966] [] ? retint_restore_args+0x13/0x13 [ 5733.386970] [] ? __init_kthread_worker+0x55/0x55 [ 5733.386974] [] ? gs_change+0x13/0x13 Signed-off-by: Ming Lei Signed-off-by: Jiri Kosina

switch device_get_devnode() and ->devnode() to umode_t *

2012-01-04T03:54:55+00:00

both callers of device_get_devnode() are only interested in lower 16bits and nobody tries to return anything wider than 16bit anyway. Signed-off-by: Al Viro

HID: hiddev: potential info leak in hiddev_ioctl()

2011-09-26T23:33:10+00:00

Smatch has a new check for Rosenberg type information leaks where structs are copied to the user with uninitialized stack data in them. In this case, the hiddev_devinfo struct has a two byte hole. struct hiddev_devinfo { __u32 bustype; /* 0 4 */ __u32 busnum; /* 4 4 */ __u32 devnum; /* 8 4 */ __u32 ifnum; /* 12 4 */ __s16 vendor; /* 16 2 */ __s16 product; /* 18 2 */ __s16 version; /* 20 2 */ /* XXX 2 bytes hole, try to pack */ __u32 num_applications; /* 24 4 */ Signed-off-by: Dan Carpenter Signed-off-by: Jiri Kosina

HID: hiddev: fix use after free in hiddev_release

2011-05-26T12:04:40+00:00

There are a couple use after free bugs here. Signed-off-by: Dan Carpenter [jkosina@suse.cz: removed already fixed hunk] Signed-off-by: Jiri Kosina

HID: hiddev: fix potential use-after-free

2011-05-24T09:43:18+00:00

Commit 6cb4b040795 ("HID: hiddev: fix race between hiddev_disconnect and hiddev_release") made it possible to access hiddev (for unlocking the existance mutex) once hiddev has been kfreed. Change the order so that this can not happen (always unlock the mutex first, it is needed only to protect access to ->exist and ->open). Signed-off-by: Jiri Kosina