kernel/linux.git/drivers/hid/hidraw.c, branch v6.1.168

HID: hidraw: fix a problem of memory leak in hidraw_release()

2024-02-05T20:13:00+00:00

[ Upstream commit a3bdcdd022c68942a774e8e63424cc11c85aab78 ] 'struct hidraw_list' is a circular queue whose head can be smaller than tail. Using 'list->tail != list->head' to release all memory that should be released. Fixes: a5623a203cff ("HID: hidraw: fix memory leak in hidraw_release()") Signed-off-by: Su Hui Reviewed-by: Dan Carpenter Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: hidraw: fix data race on device refcount

2023-07-01T11:16:26+00:00

commit 944ee77dc6ec7b0afd8ec70ffc418b238c92f12b upstream. The hidraw_open() function increments the hidraw device reference counter. The counter has no dedicated synchronization mechanism, resulting in a potential data race when concurrently opening a device. The race is a regression introduced by commit 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem"). While minors_rwsem is intended to protect the hidraw_table itself, by instead acquiring the lock for writing, the reference counter is also protected. This is symmetrical to hidraw_release(). Link: https://github.com/systemd/systemd/issues/27947 Fixes: 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem") Cc: stable@vger.kernel.org Signed-off-by: Ludvig Michaelsson Link: https://lore.kernel.org/r/20230621-hidraw-race-v1-1-a58e6ac69bab@yubico.com Signed-off-by: Benjamin Tissoires Signed-off-by: Greg Kroah-Hartman

HID: hidraw: fix memory leak in hidraw_release()

2022-08-25T09:30:50+00:00

Free the buffered reports before deleting the list entry. BUG: memory leak unreferenced object 0xffff88810e72f180 (size 32): comm "softirq", pid 0, jiffies 4294945143 (age 16.080s) hex dump (first 32 bytes): 64 f3 c6 6a d1 88 07 04 00 00 00 00 00 00 00 00 d..j............ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmemdup+0x23/0x50 mm/util.c:128 [] kmemdup include/linux/fortify-string.h:440 [inline] [] hidraw_report_event+0xa2/0x150 drivers/hid/hidraw.c:521 [] hid_report_raw_event+0x27d/0x740 drivers/hid/hid-core.c:1992 [] hid_input_report+0x1ae/0x270 drivers/hid/hid-core.c:2065 [] hid_irq_in+0x1ff/0x250 drivers/hid/usbhid/hid-core.c:284 [] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1670 [] usb_hcd_giveback_urb+0x1b6/0x1d0 drivers/usb/core/hcd.c:1747 [] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988 [] call_timer_fn+0x38/0x200 kernel/time/timer.c:1474 [] expire_timers kernel/time/timer.c:1519 [inline] [] __run_timers.part.0+0x316/0x430 kernel/time/timer.c:1790 [] __run_timers kernel/time/timer.c:1768 [inline] [] run_timer_softirq+0x44/0x90 kernel/time/timer.c:1803 [] __do_softirq+0xe6/0x2ea kernel/softirq.c:571 [] invoke_softirq kernel/softirq.c:445 [inline] [] __irq_exit_rcu kernel/softirq.c:650 [inline] [] irq_exit_rcu+0xc0/0x110 kernel/softirq.c:662 [] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1106 [] asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649 [] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] [] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] [] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline] [] acpi_idle_do_entry+0xc0/0xd0 drivers/acpi/processor_idle.c:554 Link: https://syzkaller.appspot.com/bug?id=19a04b43c75ed1092021010419b5e560a8172c4f Reported-by: syzbot+f59100a0428e6ded9443@syzkaller.appspotmail.com Signed-off-by: Karthik Alapati Signed-off-by: Jiri Kosina

HID: hidraw: Replace hidraw device table mutex with a rwsem

2021-12-14T09:52:18+00:00

Currently, the table that stores information about the connected hidraw devices has a mutex to prevent concurrent hidraw users to manipulate the hidraw table (e.g. delete an entry) while someone is trying to use the table (e.g. issuing an ioctl to the device), preventing the kernel to referencing a NULL pointer. However, since that every user that wants to access the table for both manipulating it and reading it content, this prevents concurrent access to the table for read-only operations for different or the same device (e.g. two hidraw ioctls can't happen at the same time, even if they are completely unrelated). This proves to be a bottleneck and gives performance issues when using multiple HID devices at same time, like VR kits where one can have two controllers, the headset and some tracking sensors. To improve the performance, replace the table mutex with a read-write semaphore, enabling multiple threads to issue parallel syscalls to multiple devices at the same time while protecting the table for concurrent modifications. Signed-off-by: André Almeida Signed-off-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20211130132957.8480-2-andrealmeid@collabora.com

HID: hidraw: Add additional hidraw input/output report ioctls.

2020-11-27T14:48:31+00:00

Currently the hidraw module can only read and write feature HID reports on demand, via dedicated ioctls. Input reports are read from the device through the read() interface, while output reports are written through the write interface(). This is insufficient; it is desirable in many situations to be able to read and write input and output reports through the control interface to cover additional scenarios: - Reading an input report by its report ID, to get initial state - Writing an input report, to set initial input state in the device - Reading an output report by its report ID, to obtain current state - Writing an output report by its report ID, out of band This patch adds these missing ioctl requests to read and write the remaining HID report types. Note that not all HID backends will neccesarily support this (e.g. while the USB link layer supports setting Input reports, others may not). Also included are documentation and example updates. The current hidraw documentation states that feature reports read from the device does *not* include the report ID, however this is not the case and the returned report will have its report ID prepended by conforming HID devices, as the report data sent from the device over the control endpoint must be indentical in format to those sent over the regular transport. Signed-off-by: Dean Camera Signed-off-by: Jiri Kosina

Merge branch 'for-5.6/hidraw' into for-linus

2020-01-27T14:49:30+00:00

- support for uniq ioctl()

HID: hidraw, uhid: Always report EPOLLOUT

2020-01-10T14:34:28+00:00

hidraw and uhid device nodes are always available for writing so we should always report EPOLLOUT and EPOLLWRNORM bits, not only in the cases when there is nothing to read. Reported-by: Linus Torvalds Fixes: be54e7461ffdc ("HID: uhid: Fix returning EPOLLOUT from uhid_char_poll") Fixes: 9f3b61dc1dd7b ("HID: hidraw: Fix returning EPOLLOUT from hidraw_poll") Signed-off-by: Jiri Kosina

HID: hidraw: add support uniq ioctl

2019-12-11T14:31:52+00:00

Add support for reading out the uniq information from the underlying HID device. This might be the iSerialNumber in case of USB or the BD_ADDR in case of Bluetooth. Signed-off-by: Marcel Holtmann Signed-off-by: Jiri Kosina

HID: hidraw: Fix returning EPOLLOUT from hidraw_poll

2019-12-09T12:52:29+00:00

When polling a connected /dev/hidrawX device, it is useful to get the EPOLLOUT when writing is possible. Since writing is possible as soon as the device is connected, always return it. Right now EPOLLOUT is only returned when there are also input reports are available. This works if devices start sending reports when connected, but some HID devices might need an output report first before sending any input reports. This change will allow using EPOLLOUT here as well. Fixes: 378b80370aa1 ("hidraw: Return EPOLLOUT from hidraw_poll") Signed-off-by: Marcel Holtmann Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

2019-12-02T02:20:54+00:00

Pull HID updates from Jiri Kosina: - Support for Logitech G15 (Hans de Goede) - HID parser improvements, improving support for some devices; e.g. Windows Precision Touchpad, products from Primax, etc. (Blaž Hrastnik, Candle Sun) - robustification of tablet mode support in google-whiskers driver (Dmitry Torokhov) - assorted small fixes, device-specific quirks and device ID additions * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (23 commits) HID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI transport device HID: quirks: remove hid-led devices from hid_have_special_driver HID: Improve Windows Precision Touchpad detection. HID: i2c-hid: Reset ALPS touchpads on resume HID: i2c-hid: fix no irq after reset on raydium 3118 HID: logitech-hidpp: Silence intermittent get_battery_capacity errors HID: i2c-hid: remove orphaned member sleep_delay HID: quirks: Add quirk for HP MSU1465 PIXART OEM mouse HID: core: check whether Usage Page item is after Usage ID items HID: intel-ish-hid: Spelling s/diconnect/disconnect/ HID: google: Detect base folded usage instead of hard-coding whiskers HID: logitech: Add depends on LEDS_CLASS to Logitech Kconfig entry HID: lg-g15: Add support for the G510's M1-M3 and MR LEDs HID: lg-g15: Add support for controlling the G510's RGB backlight HID: lg-g15: Add support for the G510 keyboards' gaming keys HID: lg-g15: Add support for the M1-M3 and MR LEDs HID: lg-g15: Add keyboard and LCD backlight control HID: Add driver for Logitech gaming keyboards (G15, G15 v2) Input: Add event-codes for macro keys found on various keyboards HID: hidraw: replace printk() with corresponding pr_xx() variant ...