kernel/linux.git/drivers/hid/hid-thrustmaster.c, branch v6.12.80

HID: thrustmaster: fix memory leak in thrustmaster_interrupts()

2025-05-22T12:29:38+00:00

[ Upstream commit 09d546303b370113323bfff456c4e8cff8756005 ] In thrustmaster_interrupts(), the allocated send_buf is not freed if the usb_check_int_endpoints() check fails, leading to a memory leak. Fix this by ensuring send_buf is freed before returning in the error path. Fixes: 50420d7c79c3 ("HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check") Signed-off-by: Qasim Ijaz Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints()

2025-02-21T13:01:15+00:00

[ Upstream commit 0b43d98ff29be3144e86294486b1373b5df74c0e ] Syzbot[1] has detected a stack-out-of-bounds read of the ep_addr array from hid-thrustmaster driver. This array is passed to usb_check_int_endpoints function from usb.c core driver, which executes a for loop that iterates over the elements of the passed array. Not finding a null element at the end of the array, it tries to read the next, non-existent element, crashing the kernel. To fix this, a 0 element was added at the end of the array to break the for loop. [1] https://syzkaller.appspot.com/bug?extid=9c9179ac46169c56c1ad Reported-by: syzbot+9c9179ac46169c56c1ad@syzkaller.appspotmail.com Fixes: 50420d7c79c3 ("HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check") Signed-off-by: Túlio Fernandes Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check

2025-02-08T08:57:11+00:00

[ Upstream commit 50420d7c79c37a3efe4010ff9b1bb14bc61ebccf ] syzbot has found a type mismatch between a USB pipe and the transfer endpoint, which is triggered by the hid-thrustmaster driver[1]. There is a number of similar, already fixed issues [2]. In this case as in others, implementing check for endpoint type fixes the issue. [1] https://syzkaller.appspot.com/bug?extid=040e8b3db6a96908d470 [2] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622 Fixes: c49c33637802 ("HID: support for initialization of some Thrustmaster wheels") Reported-by: syzbot+040e8b3db6a96908d470@syzkaller.appspotmail.com Tested-by: syzbot+040e8b3db6a96908d470@syzkaller.appspotmail.com Signed-off-by: Karol Przybylski Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: thrustmaster: Add sparco wheel and fix array length

2022-08-25T09:38:55+00:00

Add device id for the Sparco R383 Mod wheel. Fix wheel info array length to match actual wheel count present in the array. Signed-off-by: Michael Hübner Signed-off-by: Jiri Kosina

HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts

2022-02-21T08:15:10+00:00

Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe() bug. The root case is in missing validation check of actual number of endpoints. Code should not blindly access usb_host_interface::endpoint array, since it may contain less endpoints than code expects. Fix it by adding missing validaion check and print an error if number of endpoints do not match expected number Fixes: c49c33637802 ("HID: support for initialization of some Thrustmaster wheels") Reported-and-tested-by: syzbot+35eebd505e97d315d01c@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin Signed-off-by: Jiri Kosina

HID: Add support for open wheel and no attachment to T300

2022-02-16T16:09:33+00:00

Different add ons to the wheel base report different models. Having no wheel mounted to the base and using the open wheel attachment is added here. Signed-off-by: Michael Hübner Signed-off-by: Jiri Kosina

HID: check for valid USB device for many HID drivers

2021-12-02T14:36:18+00:00

Many HID drivers assume that the HID device assigned to them is a USB device as that was the only way HID devices used to be able to be created in Linux. However, with the additional ways that HID devices can be created for many different bus types, that is no longer true, so properly check that we have a USB device associated with the HID device before allowing a driver that makes this assumption to claim it. Cc: Jiri Kosina Cc: Benjamin Tissoires Cc: Michael Zaidman Cc: Stefan Achatz Cc: Maxime Coquelin Cc: Alexandre Torgue Cc: linux-input@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Benjamin Tissoires [bentiss: amended for thrustmater.c hunk to apply] Signed-off-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20211201183503.2373082-3-gregkh@linuxfoundation.org

HID: thrustmaster: fix sparse warnings

2021-11-19T14:53:31+00:00

Changed 0 to NULL to fix following sparse warnings: drivers/hid/hid-thrustmaster.c:208:43: warning: Using plain integer as NULL pointer drivers/hid/hid-thrustmaster.c:241:17: warning: Using plain integer as NULL pointer drivers/hid/hid-thrustmaster.c:275:37: warning: Using plain integer as NULL pointer Signed-off-by: Vihas Mak Signed-off-by: Jiri Kosina

HID: thrustmaster: Fix memory leak in thrustmaster_interrupts()

2021-08-20T12:24:57+00:00

thrustmaster_interrupts() does not free memory for send_buf when usb_interrupt_msg() fails. This is fixed by the given patch. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Evgeny Novikov Signed-off-by: Jiri Kosina

HID: thrustmaster: Fix memory leak in remove

2021-08-20T12:24:57+00:00

thrustmaster_remove() does not release memory for tm_wheel->change_request. This is fixed by the patch. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Evgeny Novikov Signed-off-by: Jiri Kosina