1. 06 6月, 2016 1 次提交
  2. 15 3月, 2016 1 次提交
    • D
      HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report() · 3b654288
      Dmitry Torokhov 提交于
      Even though hid_hw_* checks that passed in data_len is less than
      HID_MAX_BUFFER_SIZE it is not enough, as i2c-hid does not necessarily
      allocate buffers of HID_MAX_BUFFER_SIZE but rather checks all device
      reports and select largest size. In-kernel users normally just send as much
      data as report needs, so there is no problem, but hidraw users can do
      whatever they please:
      
      BUG: KASAN: slab-out-of-bounds in memcpy+0x34/0x54 at addr ffffffc07135ea80
      Write of size 4101 by task syz-executor/8747
      CPU: 2 PID: 8747 Comm: syz-executor Tainted: G    BU         3.18.0 #37
      Hardware name: Google Tegra210 Smaug Rev 1,3+ (DT)
      Call trace:
      [<ffffffc00020ebcc>] dump_backtrace+0x0/0x258 arch/arm64/kernel/traps.c:83
      [<ffffffc00020ee40>] show_stack+0x1c/0x2c arch/arm64/kernel/traps.c:172
      [<     inline     >] __dump_stack lib/dump_stack.c:15
      [<ffffffc001958114>] dump_stack+0x90/0x140 lib/dump_stack.c:50
      [<     inline     >] print_error_description mm/kasan/report.c:97
      [<     inline     >] kasan_report_error mm/kasan/report.c:278
      [<ffffffc0004597dc>] kasan_report+0x268/0x530 mm/kasan/report.c:305
      [<ffffffc0004592e8>] __asan_storeN+0x20/0x150 mm/kasan/kasan.c:718
      [<ffffffc0004594e0>] memcpy+0x30/0x54 mm/kasan/kasan.c:299
      [<ffffffc001306354>] __i2c_hid_command+0x2b0/0x7b4 drivers/hid/i2c-hid/i2c-hid.c:178
      [<     inline     >] i2c_hid_set_or_send_report drivers/hid/i2c-hid/i2c-hid.c:321
      [<ffffffc0013079a0>] i2c_hid_output_raw_report.isra.2+0x3d4/0x4b8 drivers/hid/i2c-hid/i2c-hid.c:589
      [<ffffffc001307ad8>] i2c_hid_output_report+0x54/0x68 drivers/hid/i2c-hid/i2c-hid.c:602
      [<     inline     >] hid_hw_output_report include/linux/hid.h:1039
      [<ffffffc0012cc7a0>] hidraw_send_report+0x400/0x414 drivers/hid/hidraw.c:154
      [<ffffffc0012cc7f4>] hidraw_write+0x40/0x64 drivers/hid/hidraw.c:177
      [<ffffffc0004681dc>] vfs_write+0x1d4/0x3cc fs/read_write.c:534
      [<     inline     >] SYSC_pwrite64 fs/read_write.c:627
      [<ffffffc000468984>] SyS_pwrite64+0xec/0x144 fs/read_write.c:614
      Object at ffffffc07135ea80, in cache kmalloc-512
      Object allocated with size 268 bytes.
      
      Let's check data length against the buffer size before attempting to copy
      data over.
      
      Cc: stable@vger.kernel.org
      Reported-by: NAlexander Potapenko <glider@google.com>
      Signed-off-by: NDmitry Torokhov <dtor@chromium.org>
      Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      3b654288
  3. 10 3月, 2016 2 次提交
  4. 31 12月, 2015 1 次提交
    • M
      HID: i2c-hid: Prevent sending reports from racing with device reset · 9a327405
      Mika Westerberg 提交于
      When an i2c-hid device is resumed from system sleep the driver resets
      the device to be sure it is in known state. The device is expected to
      issue an interrupt when reset is complete.
      
      This reset might take few milliseconds to complete so if the HID driver
      on top (hid-rmi) starts to set up the device by sending feature reports
      etc. the device might not issue the reset complete interrupt anymore.
      
      Below is what happens to touchpad on Lenovo Yoga 900 during resume from
      system sleep:
      
        [   24.790951] i2c_hid i2c-SYNA2B29:00: i2c_hid_hwreset
        [   24.790973] i2c_hid i2c-SYNA2B29:00: i2c_hid_set_power
        [   24.790982] i2c_hid i2c-SYNA2B29:00: __i2c_hid_command: cmd=22 00 00 08
        [   24.793011] i2c_hid i2c-SYNA2B29:00: resetting...
        [   24.793016] i2c_hid i2c-SYNA2B29:00: __i2c_hid_command: cmd=22 00 00 01
      
      Here i2c-hid sends reset command to the touchpad.
      
        [   24.794012] i2c_hid i2c-SYNA2B29:00: input: 06 00 01 00 00 00
        [   24.794051] i2c_hid i2c-SYNA2B29:00: i2c_hid_set_or_send_report
        [   24.794059] i2c_hid i2c-SYNA2B29:00: __i2c_hid_command:
                       cmd=22 00 3f 03 0f 23 00 04 00 0f 01
      
      Now hid-rmi puts the touchpad to correct mode by sending it a feature
      report. This makes the touchpad not to issue reset complete interrupt.
      
        [   24.796092] i2c_hid i2c-SYNA2B29:00: __i2c_hid_command: waiting...
      
      i2c-hid starts to wait for the reset interrupt to trigger which never
      happens.
      
        [   24.798304] i2c_hid i2c-SYNA2B29:00: i2c_hid_set_or_send_report
        [   24.798313] i2c_hid i2c-SYNA2B29:00: __i2c_hid_command:
                       cmd=25 00 17 00 09 01 42 00 2e 00 19 19 00 10 cc 06 74 04 0f
                           19 00 00 00 00 00
      
      Yet another output report from hid-rmi driver.
      
        [   29.795630] i2c_hid i2c-SYNA2B29:00: __i2c_hid_command: finished.
        [   29.795637] i2c_hid i2c-SYNA2B29:00: failed to reset device.
      
      After 5 seconds i2c-hid driver times out.
      
        [   29.795642] i2c_hid i2c-SYNA2B29:00: i2c_hid_set_power
        [   29.795649] i2c_hid i2c-SYNA2B29:00: __i2c_hid_command: cmd=22 00 01 08
        [   29.797576] dpm_run_callback(): i2c_hid_resume+0x0/0xb0 returns -61
        [   29.797584] PM: Device i2c-SYNA2B29:00 failed to resume: error -61
      
      After this the touchpad does not work anymore (and also resume itself
      gets slowed down because of the timeout).
      
      Prevent sending of feature/output reports while the device is being
      reset by adding a mutex which is held during that time.
      Reported-and-tested-by: NLinus Torvalds <torvalds@linux-foundation.org>
      Reported-by: NNish Aravamudan <nish.aravamudan@gmail.com>
      Suggested-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      9a327405
  5. 19 11月, 2015 1 次提交
  6. 29 9月, 2015 1 次提交
  7. 18 8月, 2015 1 次提交
  8. 08 7月, 2015 1 次提交
  9. 03 6月, 2015 1 次提交
  10. 18 5月, 2015 1 次提交
  11. 23 4月, 2015 1 次提交
  12. 25 2月, 2015 1 次提交
  13. 23 2月, 2015 1 次提交
  14. 17 2月, 2015 1 次提交
  15. 17 12月, 2014 1 次提交
    • M
      HID: i2c-hid: Do not free buffers in i2c_hid_stop() · 5b44c53a
      Mika Westerberg 提交于
      When a hid driver that uses i2c-hid as transport is unloaded, the hid core
      will call i2c_hid_stop() which releases all the buffers associated with the
      device. This includes also the command buffer.
      
      Now, when the i2c-hid driver itself is unloaded it tries to power down the
      device by sending it PWR_SLEEP command. Since the command buffer is already
      released we get following crash:
      
       [   79.691459] BUG: unable to handle kernel NULL pointer dereference at           (null)
       [   79.691532] IP: [<ffffffffa05bc049>] __i2c_hid_command+0x49/0x310 [i2c_hid]
       ...
       [   79.693467] Call Trace:
       [   79.693494]  [<ffffffff810424e1>] ? __unmask_ioapic+0x21/0x30
       [   79.693537]  [<ffffffff81042855>] ? unmask_ioapic+0x25/0x40
       [   79.693581]  [<ffffffffa05bc35b>] ? i2c_hid_set_power+0x4b/0xa0 [i2c_hid]
       [   79.693632]  [<ffffffffa05bc3cf>] ? i2c_hid_runtime_resume+0x1f/0x30 [i2c_hid]
       [   79.693689]  [<ffffffff814c08fb>] ? __rpm_callback+0x2b/0x70
       [   79.693733]  [<ffffffff814c0961>] ? rpm_callback+0x21/0x90
       [   79.693776]  [<ffffffff814c0dec>] ? rpm_resume+0x41c/0x600
       [   79.693820]  [<ffffffff814c1e1c>] ? __pm_runtime_resume+0x4c/0x80
       [   79.693868]  [<ffffffff814b8588>] ? __device_release_driver+0x28/0x100
       [   79.693917]  [<ffffffff814b8d90>] ? driver_detach+0xa0/0xb0
       [   79.693959]  [<ffffffff814b82cc>] ? bus_remove_driver+0x4c/0xb0
       [   79.694006]  [<ffffffff810d1cfd>] ? SyS_delete_module+0x11d/0x1d0
       [   79.694054]  [<ffffffff8165f107>] ? int_signal+0x12/0x17
       [   79.694095]  [<ffffffff8165ee69>] ? system_call_fastpath+0x12/0x17
      
      Fix this so that we only free buffers when the i2c-hid driver itself is
      removed.
      
      Fixes: 34f439e4 ("HID: i2c-hid: add runtime PM support")
      Reported-by: NGabriele Mazzotta <gabriele.mzt@gmail.com>
      Signed-off-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      5b44c53a
  16. 12 12月, 2014 1 次提交
  17. 04 12月, 2014 1 次提交
  18. 25 11月, 2014 1 次提交
  19. 19 11月, 2014 1 次提交
  20. 29 7月, 2014 1 次提交
  21. 13 5月, 2014 1 次提交
  22. 14 3月, 2014 1 次提交
  23. 17 2月, 2014 4 次提交
  24. 03 2月, 2014 1 次提交
  25. 30 1月, 2014 1 次提交
    • M
      HID: i2c-hid: add runtime PM support · 34f439e4
      Mika Westerberg 提交于
      This patch adds runtime PM support for the HID over I2C driver. When the
      i2c-hid device is first opened we power it on and on the last close we
      power it off. This is actually what the driver is already doing but in
      addition it allows subsystems, like ACPI power domain to power off the
      device during runtime PM suspend, which should save even more power.
      
      The implementation is not the most power efficient because it needs some
      interaction from the userspace (e.g close the device node whenever we are
      no more interested in getting events), nevertheless it allows us to save
      some power and works with devices that are not wake capable.
      Signed-off-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      34f439e4
  26. 05 1月, 2014 1 次提交
  27. 26 11月, 2013 1 次提交
  28. 15 11月, 2013 1 次提交
    • R
      ACPI / driver core: Store an ACPI device pointer in struct acpi_dev_node · 7b199811
      Rafael J. Wysocki 提交于
      Modify struct acpi_dev_node to contain a pointer to struct acpi_device
      associated with the given device object (that is, its ACPI companion
      device) instead of an ACPI handle corresponding to it.  Introduce two
      new macros for manipulating that pointer in a CONFIG_ACPI-safe way,
      ACPI_COMPANION() and ACPI_COMPANION_SET(), and rework the
      ACPI_HANDLE() macro to take the above changes into account.
      Drop the ACPI_HANDLE_SET() macro entirely and rework its users to
      use ACPI_COMPANION_SET() instead.  For some of them who used to
      pass the result of acpi_get_child() directly to ACPI_HANDLE_SET()
      introduce a helper routine acpi_preset_companion() doing an
      equivalent thing.
      
      The main motivation for doing this is that there are things
      represented by struct acpi_device objects that don't have valid
      ACPI handles (so called fixed ACPI hardware features, such as
      power and sleep buttons) and we would like to create platform
      device objects for them and "glue" them to their ACPI companions
      in the usual way (which currently is impossible due to the
      lack of valid ACPI handles).  However, there are more reasons
      why it may be useful.
      
      First, struct acpi_device pointers allow of much better type checking
      than void pointers which are ACPI handles, so it should be more
      difficult to write buggy code using modified struct acpi_dev_node
      and the new macros.  Second, the change should help to reduce (over
      time) the number of places in which the result of ACPI_HANDLE() is
      passed to acpi_bus_get_device() in order to obtain a pointer to the
      struct acpi_device associated with the given "physical" device,
      because now that pointer is returned by ACPI_COMPANION() directly.
      Finally, the change should make it easier to write generic code that
      will build both for CONFIG_ACPI set and unset without adding explicit
      compiler directives to it.
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Acked-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com> # on Haswell
      Reviewed-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      Reviewed-by: Aaron Lu <aaron.lu@intel.com> # for ATA and SDIO part
      7b199811
  29. 30 10月, 2013 1 次提交
  30. 24 9月, 2013 1 次提交
  31. 20 8月, 2013 1 次提交
  32. 05 8月, 2013 1 次提交
  33. 31 7月, 2013 2 次提交
  34. 04 7月, 2013 1 次提交
  35. 04 4月, 2013 1 次提交