kernel/linux.git/drivers/input/misc/powermate.c, branch v6.6.132

Input: powermate - fix use-after-free in powermate_config_complete

2023-10-14T03:17:02+00:00

syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug. Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection. [1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e Signed-off-by: Javier Carrasco Reported-by: syzbot+0434ac83f907a1dbdd1e@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20230916-topic-powermate_use_after_free-v3-1-64412b81a7a2@gmail.com Signed-off-by: Dmitry Torokhov

Input: remove third argument of usb_maxpacket()

2022-04-23T08:33:53+00:00

The third argument of usb_maxpacket(): in_out has been deprecated because it could be derived from the second argument (e.g. using usb_pipeout(pipe)). N.B. function usb_maxpacket() was made variadic to accommodate the transition from the old prototype with three arguments to the new one with only two arguments (so that no renaming is needed). The variadic argument is to be removed once all users of usb_maxpacket() get migrated. CC: Ville Syrjala CC: Dmitry Torokhov CC: Henk Vergonet Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/r/20220317035514.6378-4-mailhol.vincent@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

treewide: Add SPDX license identifier for more missed files

2019-05-21T08:50:45+00:00

Add SPDX license identifiers to all files which: - Have no license information of any form - Have MODULE_LICENCE("GPL*") inside which was used in the initial scan/conversion to ignore the file These files fall under the project license, GPL v2 only. The resulting SPDX license identifier is: GPL-2.0-only Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman

Input: powermate - replace GFP_ATOMIC with GFP_KERNEL in powermate_alloc_buffers()

2018-07-27T18:59:07+00:00

powermate_alloc_buffers() is never called in atomic context. It calls usb_alloc_coherent() with GFP_ATOMIC, which is not necessary. GFP_ATOMIC can be replaced with GFP_KERNEL. This is found by a static analysis tool named DCNS written by myself. Signed-off-by: Jia-Ju Bai Signed-off-by: Dmitry Torokhov

Input: powermate - constify usb_device_id and fix space before '[' error

2017-08-08T03:10:18+00:00

usb_device_id are not supposed to change at runtime. All functions working with usb_device_id provided by work with const usb_device_id. So mark the non-const structs as const. Fix checkpatch.pl error: ERROR: space prohibited before open square bracket '['. Signed-off-by: Arvind Yadav Signed-off-by: Dmitry Torokhov

Input: powermate - fix oops with malicious USB descriptors

2016-03-14T16:36:49+00:00

The powermate driver expects at least one valid USB endpoint in its probe function. If given malicious descriptors that specify 0 for the number of endpoints, it will crash. Validate the number of endpoints on the interface before using them. The full report for this issue can be found here: http://seclists.org/bugtraq/2016/Mar/85 Reported-by: Ralf Spenneberg Cc: stable Signed-off-by: Josh Boyer Signed-off-by: Dmitry Torokhov

Input: delete non-required instances of include

2014-01-07T07:23:57+00:00

None of these files are actually using any __init type directives and hence don't need to include . Most are just a left over from __devinit and __cpuinit removal, or simply due to code getting copied from one driver to the next. Signed-off-by: Paul Gortmaker Signed-off-by: Dmitry Torokhov

USB: input: powermate.c: fix up dev_* messages

2012-05-04T22:33:00+00:00

Previously I had made the struct device point to the input device, but after talking with Dmitry, he said that the USB device would make more sense for this driver to point to. So converted it to use that instead. CC: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

USB: powermate.c: remove dbg() usage

2012-05-02T04:33:03+00:00

dbg() was a very old USB-specific macro that should no longer be used. This patch removes it from being used in the driver and uses dev_dbg() instead. CC: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

USB: input: powermate.c: fix up dev_err() usage

2012-05-02T00:56:45+00:00

We should always reference the input device for dev_err(), not the USB device. Fix up the places where I got this wrong. Reported-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman