Commit Graph

7 Commits

Author SHA1 Message Date
Kees Cook 41df7f6d43 HID: steelseries: validate output report details
A HID device could send a malicious output report that would cause the
steelseries HID driver to write beyond the output report allocation
during initialization, causing a heap overflow:

[  167.981534] usb 1-1: New USB device found, idVendor=1038, idProduct=1410
...
[  182.050547] BUG kmalloc-256 (Tainted: G        W   ): Redzone overwritten

CVE-2013-2891

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-09-13 15:12:28 +02:00
Simon Wood b52b506161 HID: hid-steelseries fix led class build issue
Fixes 'undefined reference' issue when hid-steelseries is built in,
but led-class is a module.
--
drivers/built-in.o: In function `steelseries_srws1_remove':
hid-steelseries.c:(.text+0x3b97a1): undefined reference to `led_classdev_unregister'
drivers/built-in.o: In function `steelseries_srws1_probe':
hid-steelseries.c:(.text+0x3b9c51): undefined reference to `led_classdev_register'
hid-steelseries.c:(.text+0x3b9ce5): undefined reference to `led_classdev_register'
hid-steelseries.c:(.text+0x3b9d4b): undefined reference to `led_classdev_unregister'
--

Patch allows LED control when led-class is built in, or both hid-steelseries
_and_ led-class are both modules.

Reported-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Simon Wood <simon@mungewell.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-05-03 10:26:52 +02:00
Jiri Kosina 047dff63f9 Merge branches 'for-3.10/multitouch', 'for-3.10/roccat' and 'for-3.10/upstream' into for-linus
Conflicts:
	drivers/hid/Kconfig
2013-04-30 10:19:07 +02:00
Wei Yongjun bb64469af5 HID: steelseries: use module_hid_driver() to simplify the code
module_hid_driver() makes the code simpler by eliminating
boilerplate code..

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-03-18 10:51:49 +01:00
Benjamin Tissoires d881427253 HID: use hid_hw_request() instead of direct call to usbhid
This allows the hid drivers to be independent from the transport layer.

The patch was constructed by replacing all occurences of
usbhid_submit_report() by its hid_hw_request() counterpart.
Then, drivers not requiring USB_HID anymore have their USB_HID
dependency cleaned in the Kconfig file.

Finally, few drivers still depends on USB_HID. Many of them
are requiring the io wait callback. They are found in the next patch.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>

For the sensor-hub part:
Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-02-25 13:26:41 +01:00
Jiri Kosina 7e41576247 HID: steelseries: fix out of bound array access
The last field of the driver_data->leds[] array is used to store the
special toggle for setting all leds simultaneously, so we need to allocate
appropriate number of led_classdev pointers.

Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-01-31 16:51:47 +01:00
Jiri Kosina 090800c2a3 HID: steelseries: rename driver to be compliant with other drivers
We usually group drivers on a per-vendor basis, implementing device-specific
deviations from the standard in vendor-specific driver.

Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-01-31 16:50:24 +01:00