kernel/linux.git/include/linux/hid.h, branch v4.4.275

HID: usbhid: fix info leak in hid_submit_ctrl

2021-06-30T12:49:30+00:00

[ Upstream commit 6be388f4a35d2ce5ef7dbf635a8964a5da7f799f ] In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes. To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl(). Reported-by: syzbot+7c2bb71996f95a82524c@syzkaller.appspotmail.com Signed-off-by: Anirudh Rayabharam Acked-by: Benjamin Tissoires Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: plantronics: Workaround for double volume key presses

2021-05-22T08:38:24+00:00

[ Upstream commit f567d6ef8606fb427636e824c867229ecb5aefab ] Plantronics Blackwire 3220 Series (047f:c056) sends HID reports twice for each volume key press. This patch adds a quirk to hid-plantronics for this product ID, which will ignore the second volume key press if it happens within 5 ms from the last one that was handled. The patch was tested on the mentioned model only, it shouldn't affect other models, however, this quirk might be needed for them too. Auto-repeat (when a key is held pressed) is not affected, because the rate is about 3 times per second, which is far less frequent than once in 5 ms. Fixes: 81bb773faed7 ("HID: plantronics: Update to map volume up/down controls") Signed-off-by: Maxim Mikityanskiy Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: core: Sanitize event code and type when mapping input

2020-09-12T09:45:26+00:00

commit 35556bed836f8dc07ac55f69c8d17dce3e7f0e25 upstream. When calling into hid_map_usage(), the passed event code is blindly stored as is, even if it doesn't fit in the associated bitmap. This event code can come from a variety of sources, including devices masquerading as input devices, only a bit more "programmable". Instead of taking the event code at face value, check that it actually fits the corresponding bitmap, and if it doesn't: - spit out a warning so that we know which device is acting up - NULLify the bitmap pointer so that we catch unexpected uses Code paths that can make use of untrusted inputs can now check that the mapping was indeed correct and bail out if not. Cc: stable@vger.kernel.org Signed-off-by: Marc Zyngier Signed-off-by: Benjamin Tissoires Signed-off-by: Greg Kroah-Hartman

HID: core: increase HID report buffer size to 8KiB

2020-03-11T06:51:14+00:00

commit 84a4062632462c4320704fcdf8e99e89e94c0aba upstream. We have a HID touch device that reports its opens and shorts test results in HID buffers of size 8184 bytes. The maximum size of the HID buffer is currently set to 4096 bytes, causing probe of this device to fail. With this patch we increase the maximum size of the HID buffer to 8192 bytes, making device probe and acquisition of said buffers succeed. Signed-off-by: Johan Korsnes Cc: Alan Stern Cc: Armando Visconti Cc: Jiri Kosina Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman

HID: core: move Usage Page concatenation to Main item

2019-06-11T10:24:03+00:00

[ Upstream commit 58e75155009cc800005629955d3482f36a1e0eec ] As seen on some USB wireless keyboards manufactured by Primax, the HID parser was using some assumptions that are not always true. In this case it's s the fact that, inside the scope of a main item, an Usage Page will always precede an Usage. The spec is not pretty clear as 6.2.2.7 states "Any usage that follows is interpreted as a Usage ID and concatenated with the Usage Page". While 6.2.2.8 states "When the parser encounters a main item it concatenates the last declared Usage Page with a Usage to form a complete usage value." Being somewhat contradictory it was decided to match Window's implementation, which follows 6.2.2.8. In summary, the patch moves the Usage Page concatenation from the local item parsing function to the main item parsing function. Signed-off-by: Nicolas Saenz Julienne Reviewed-by: Terry Junge Signed-off-by: Benjamin Tissoires Signed-off-by: Sasha Levin

HID: core: Fix size as type u32

2018-04-24T07:32:07+00:00

commit 6de0b13cc0b4ba10e98a9263d7a83b940720b77a upstream. When size is negative, calling memset will make segment fault. Declare the size as type u32 to keep memset safe. size in struct hid_report is unsigned, fix return type of hid_report_len to u32. Cc: stable@vger.kernel.org Signed-off-by: Aaron Ma Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman

HID: hid-input: allow input_configured callback return errors

2015-11-05T17:51:50+00:00

When configuring input device via input_configured callback we may encounter errors (for example input_mt_init_slots() may fail). Instead of continuing with half-initialized input device let's allow driver indicate failures. Signed-off-by: Jaikumar Ganesh Signed-off-by: Arve Hjønnevåg Reviewed-by: Benjamin Tissoires Reviewed-by: David Herrmann Acked-by: Nikolai Kondrashov Acked-by: Andrew Duggan Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Kosina

HID: Export hid_field_extract()

2015-06-01T12:33:35+00:00

Rename the function extract() to hid_field_extract(), make it external linkage to allow the use from other modules. Suggested-by: Jiri Kosina Signed-off-by: Goffredo Baroncelli Reviewed-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

2015-04-14T16:25:26+00:00

Pull HID updates from Jiri Kosina: - quite a few firmware fixes for RMI driver by Andrew Duggan - huion and uclogic drivers have been substantially overlaping in functionality laterly. This redundancy is fixed by hid-huion driver being merged into hid-uclogic; work done by Benjamin Tissoires and Nikolai Kondrashov - i2c-hid now supports ACPI GPIO interrupts; patch from Mika Westerberg - Some of the quirks, that got separated into individual drivers, have historically had EXPERT dependency. As HID subsystem matured (as well as the individual drivers), this made less and less sense. This dependency is now being removed by patch from Jean Delvare - Logitech lg4ff driver received a couple of improvements for mode switching, by Michal Malý - multitouch driver now supports clickpads, patches by Benjamin Tissoires and Seth Forshee - hid-sensor framework received a substantial update; namely support for Custom and Generic pages is being added; work done by Srinivas Pandruvada - wacom driver received substantial update; it now supports i2c-conntected devices (Mika Westerberg), Bamboo PADs are now properly supported (Benjamin Tissoires), much improved battery reporting (Jason Gerecke) and pen proximity cleanups (Ping Cheng) - small assorted fixes and device ID additions * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (68 commits) HID: sensor: Update document for custom sensor HID: sensor: Custom and Generic sensor support HID: debug: fix error handling in hid_debug_events_read() Input - mt: Fix input_mt_get_slot_by_key HID: logitech-hidpp: fix error return code HID: wacom: Add support for Cintiq 13HD Touch HID: logitech-hidpp: add a module parameter to keep firmware gestures HID: usbhid: yet another mouse with ALWAYS_POLL HID: usbhid: more mice with ALWAYS_POLL HID: wacom: set stylus_in_proximity before checking touch_down HID: wacom: use wacom_wac_finger_count_touches to set touch_down HID: wacom: remove hardcoded WACOM_QUIRK_MULTI_INPUT HID: pidff: effect can't be NULL HID: add quirk for PIXART OEM mouse used by HP HID: add HP OEM mouse to quirk ALWAYS_POLL HID: wacom: ask for a in-prox report when it was missed HID: hid-sensor-hub: Fix sparse warning HID: hid-sensor-hub: fix attribute read for logical usage id HID: plantronics: fix Kconfig default HID: pidff: support more than one concurrent effect ...

Merge branches 'for-4.0/upstream-fixes', 'for-4.1/genius', 'for-4.1/huion-uclogic-merge', 'for-4.1/i2c-hid', 'for-4.1/kconfig-drop-expert-dependency', 'for-4.1/logitech', 'for-4.1/multitouch', 'for-4.1/rmi', 'for-4.1/sony', 'for-4.1/upstream' and 'for-4.1/wacom' into for-linus

2015-04-13T21:41:15+00:00