Commit Graph

11 Commits

Author SHA1 Message Date
Kees Cook 1e87a2456b HID: picolcd_core: validate output report details
A HID device could send a malicious output report that would cause the
picolcd HID driver to trigger a NULL dereference during attr file writing.

[jkosina@suse.cz: changed

	report->maxfield < 1

to

	report->maxfield != 1

as suggested by Bruno].

CVE-2013-2899

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@kernel.org
Reviewed-by: Bruno Prémont <bonbons@linux-vserver.org>
Acked-by: Bruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-09-04 12:03:27 +02:00
Benjamin Tissoires d881427253 HID: use hid_hw_request() instead of direct call to usbhid
This allows the hid drivers to be independent from the transport layer.

The patch was constructed by replacing all occurences of
usbhid_submit_report() by its hid_hw_request() counterpart.
Then, drivers not requiring USB_HID anymore have their USB_HID
dependency cleaned in the Kconfig file.

Finally, few drivers still depends on USB_HID. Many of them
are requiring the io wait callback. They are found in the next patch.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>

For the sensor-hub part:
Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-02-25 13:26:41 +01:00
H Hartley Sweeten f425458eaf HID: Use module_hid_driver macro
Use the new module_hid_driver macro in all HID drivers that have
a simple register/unregister init/exit.

This also converts the hid drivers that test for a failure of
hid_register_driver() and report the failure. Using module_hid_driver
in those drivers removes the failure message.

Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-01-03 10:27:31 +01:00
Axel Lin 206e3f1cda HID: picolcd_core: Remove setting hdev->claimed before calling hid_hw_start()
Current implementation of hid_hw_start() allows connect_mask to be 0.
Setting hdev->claimed = HID_CLAIMED_INPUT before calling hid_hw_start() is not
necessary. Remove it.

Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-By: Bruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2012-09-19 13:57:03 +02:00
Bruno Prémont bb5c32d998 HID: picoLCD: drop version check during probe
Commit 4ea5454203
[HID: Fix race condition between driver core and ll-driver] introduced
new locking around probe/remove functions that prevents any report/reply
from hardware to reach driver until it returned from probe.

As such, the ask-reply way to checking picoLCD firmware version during
probe is bound to timeout and let probe fail.

Drop the check to let driver successfully probe again (until locking issues
are resolved allowing to reinstate the check).

Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2012-09-19 13:43:51 +02:00
Bruno Prémont eb9001cd8f HID: picoLCD: use proper device as input_dev parent
Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2012-09-05 11:48:08 +02:00
Bruno Prémont ae08e32414 HID: picoLCD: Add support for CIR
Implement support for picoLCD's CIR header using RC_CORE for decoding
the IR event stream.

Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2012-09-05 11:48:07 +02:00
Bruno Prémont a5785cc010 HID: picoLCD: prevent NULL pointer dereferences
Driver code expects to get access to struct picolcd_data from hiddev
and is not prepared to find a NULL pointer there. Most prominent
candidate to trip on it is picolcd_fb_deferred_io().
Delay removing struct picolcd_data from hiddev until all sub-devices
have been unregistered.

Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2012-09-05 11:48:06 +02:00
Bruno Prémont a93ab84948 HID: picoLCD: Improve unplug handling
Stop earlier attempting to submit new reports/URBs (though locking and
usbhid still prevents to bail out early enough to not produce multiple
  hid-picolcd 0003:04D8:C002.0003: usb_submit_urb(out) failed: -19
messages in kernel log.

Strengthen framebuffer removal to be less racy.

Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2012-08-15 10:13:26 +02:00
Bruno Prémont 9966c37c46 HID: picoLCD: Replace own refcounting with fbdev's
Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2012-08-15 10:10:49 +02:00
Bruno Prémont fabdbf2fd2 HID: picoLCD: split driver code
In order to make code maintenance easier, split the vairous
functions into individial files (this removes a bunch of #ifdefs).

Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2012-08-15 10:08:57 +02:00