1. 17 3月, 2016 1 次提交
  2. 16 3月, 2016 1 次提交
  3. 15 3月, 2016 2 次提交
    • H
      hid: thingm: reorder calls in thingm_probe · 1d1b564f
      Heiner Kallweit 提交于
      When reviewing another thingm patch Benjamin Tissoires pointed out
      the following: "The problem here is that hid_hw_start() is called
      before thingm_version() which allows user space to briefly introduce
      races between thingm_version() and any hidraw requests.
      The mutex will not help here as it is initialized after hid_hw_start()
      and only used for protecting the concurrent access of the rgb."
      
      Avoid this possible issue by calling hid_hw_start() later in the
      probe function.
      Signed-off-by: NHeiner Kallweit <hkallweit1@gmail.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      1d1b564f
    • D
      HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report() · 3b654288
      Dmitry Torokhov 提交于
      Even though hid_hw_* checks that passed in data_len is less than
      HID_MAX_BUFFER_SIZE it is not enough, as i2c-hid does not necessarily
      allocate buffers of HID_MAX_BUFFER_SIZE but rather checks all device
      reports and select largest size. In-kernel users normally just send as much
      data as report needs, so there is no problem, but hidraw users can do
      whatever they please:
      
      BUG: KASAN: slab-out-of-bounds in memcpy+0x34/0x54 at addr ffffffc07135ea80
      Write of size 4101 by task syz-executor/8747
      CPU: 2 PID: 8747 Comm: syz-executor Tainted: G    BU         3.18.0 #37
      Hardware name: Google Tegra210 Smaug Rev 1,3+ (DT)
      Call trace:
      [<ffffffc00020ebcc>] dump_backtrace+0x0/0x258 arch/arm64/kernel/traps.c:83
      [<ffffffc00020ee40>] show_stack+0x1c/0x2c arch/arm64/kernel/traps.c:172
      [<     inline     >] __dump_stack lib/dump_stack.c:15
      [<ffffffc001958114>] dump_stack+0x90/0x140 lib/dump_stack.c:50
      [<     inline     >] print_error_description mm/kasan/report.c:97
      [<     inline     >] kasan_report_error mm/kasan/report.c:278
      [<ffffffc0004597dc>] kasan_report+0x268/0x530 mm/kasan/report.c:305
      [<ffffffc0004592e8>] __asan_storeN+0x20/0x150 mm/kasan/kasan.c:718
      [<ffffffc0004594e0>] memcpy+0x30/0x54 mm/kasan/kasan.c:299
      [<ffffffc001306354>] __i2c_hid_command+0x2b0/0x7b4 drivers/hid/i2c-hid/i2c-hid.c:178
      [<     inline     >] i2c_hid_set_or_send_report drivers/hid/i2c-hid/i2c-hid.c:321
      [<ffffffc0013079a0>] i2c_hid_output_raw_report.isra.2+0x3d4/0x4b8 drivers/hid/i2c-hid/i2c-hid.c:589
      [<ffffffc001307ad8>] i2c_hid_output_report+0x54/0x68 drivers/hid/i2c-hid/i2c-hid.c:602
      [<     inline     >] hid_hw_output_report include/linux/hid.h:1039
      [<ffffffc0012cc7a0>] hidraw_send_report+0x400/0x414 drivers/hid/hidraw.c:154
      [<ffffffc0012cc7f4>] hidraw_write+0x40/0x64 drivers/hid/hidraw.c:177
      [<ffffffc0004681dc>] vfs_write+0x1d4/0x3cc fs/read_write.c:534
      [<     inline     >] SYSC_pwrite64 fs/read_write.c:627
      [<ffffffc000468984>] SyS_pwrite64+0xec/0x144 fs/read_write.c:614
      Object at ffffffc07135ea80, in cache kmalloc-512
      Object allocated with size 268 bytes.
      
      Let's check data length against the buffer size before attempting to copy
      data over.
      
      Cc: stable@vger.kernel.org
      Reported-by: NAlexander Potapenko <glider@google.com>
      Signed-off-by: NDmitry Torokhov <dtor@chromium.org>
      Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      3b654288
  4. 14 3月, 2016 1 次提交
  5. 11 3月, 2016 2 次提交
  6. 10 3月, 2016 2 次提交
  7. 08 3月, 2016 1 次提交
  8. 02 3月, 2016 4 次提交
  9. 23 2月, 2016 1 次提交
  10. 17 2月, 2016 6 次提交
  11. 16 2月, 2016 2 次提交
  12. 10 2月, 2016 4 次提交
    • P
      HID: sony: underscores are unnecessary for u8, u16, s32 · 1adf904e
      Pavel Machek 提交于
      Double-underscore prefixed types are unnecessary in pure kernel code,
      replace them with the non prefixed equivalents.
      Signed-off-by: NPavel Machek <pavel@ucw.cz>
      Signed-off-by: NAntonio Ospite <ao2@ao2.it>
      Acked-by: NFrank Praznik <frank.praznik@gmail.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      1adf904e
    • A
      HID: sony: fix some warnings from scripts/checkpatch.pl · ef916ef5
      Antonio Ospite 提交于
        WARNING: Block comments use a trailing */ on a separate line
        #822: FILE: drivers/hid/hid-sony.c:822:
        +	   * number but it's not needed for correct operation */
      
        WARNING: Block comments use a trailing */ on a separate line
        #828: FILE: drivers/hid/hid-sony.c:828:
        +	   * buttons multiple keypresses are allowed */
      
        WARNING: Block comments use a trailing */ on a separate line
        #854: FILE: drivers/hid/hid-sony.c:854:
        +	   * 0xff and 11th is for press indication */
      
        WARNING: Missing a blank line after declarations
        #1930: FILE: drivers/hid/hid-sony.c:1930:
        +	struct sony_sc *sc = container_of(work, struct sony_sc, state_worker);
        +	sc->send_output_report(sc);
      
        WARNING: Block comments use a trailing */ on a separate line
        #2510: FILE: drivers/hid/hid-sony.c:2510:
        +	 * Logitech joystick from the device descriptor. */
      Signed-off-by: NAntonio Ospite <ao2@ao2.it>
      Acked-by: NFrank Praznik <frank.praznik@gmail.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      ef916ef5
    • A
      HID: sony: fix errors from scripts/checkpatch.pl · 09593e38
      Antonio Ospite 提交于
        ./scripts/checkpatch.pl \
          --types "SPACING,TRAILING_WHITESPACE,POINTER_LOCATION,CODE_INDENT" \
          -f drivers/hid/hid-sony.c
      
        ERROR: trailing whitespace
        #933: FILE: drivers/hid/hid-sony.c:933:
        +^I * $
      
        ERROR: space prohibited after that open square bracket '['
        #947: FILE: drivers/hid/hid-sony.c:947:
        +	[ 1] = BTN_TRIGGER_HAPPY1,
      
        ERROR: space prohibited after that open square bracket '['
        #948: FILE: drivers/hid/hid-sony.c:948:
        +	[ 2] = BTN_TRIGGER_HAPPY2,
      
        ERROR: space prohibited after that open square bracket '['
        #949: FILE: drivers/hid/hid-sony.c:949:
        +	[ 3] = BTN_TRIGGER_HAPPY3,
      
        ERROR: space prohibited after that open square bracket '['
        #950: FILE: drivers/hid/hid-sony.c:950:
        +	[ 4] = BTN_TRIGGER_HAPPY4,
      
        ERROR: space prohibited after that open square bracket '['
        #951: FILE: drivers/hid/hid-sony.c:951:
        +	[ 5] = BTN_TRIGGER_HAPPY5,
      
        ERROR: space prohibited after that open square bracket '['
        #952: FILE: drivers/hid/hid-sony.c:952:
        +	[ 6] = BTN_TRIGGER_HAPPY6,
      
        ERROR: space prohibited after that open square bracket '['
        #953: FILE: drivers/hid/hid-sony.c:953:
        +	[ 7] = BTN_TRIGGER_HAPPY7,
      
        ERROR: space prohibited after that open square bracket '['
        #954: FILE: drivers/hid/hid-sony.c:954:
        +	[ 8] = BTN_TRIGGER_HAPPY8,
      
        ERROR: space prohibited after that open square bracket '['
        #955: FILE: drivers/hid/hid-sony.c:955:
        +	[ 9] = BTN_TRIGGER_HAPPY9,
      
        ERROR: "(foo*)" should be "(foo *)"
        #1032: FILE: drivers/hid/hid-sony.c:1032:
        +	void(*send_output_report)(struct sony_sc*);
      
        WARNING: missing space after return type
        #1032: FILE: drivers/hid/hid-sony.c:1032:
        +	void(*send_output_report)(struct sony_sc*);
      
        ERROR: "(foo*)" should be "(foo *)"
        #2261: FILE: drivers/hid/hid-sony.c:2261:
        +				void(*send_output_report)(struct sony_sc*))
      
        WARNING: missing space after return type
        #2261: FILE: drivers/hid/hid-sony.c:2261:
        +				void(*send_output_report)(struct sony_sc*))
      
        ERROR: code indent should use tabs where possible
        #2449: FILE: drivers/hid/hid-sony.c:2449:
        +         */$
      
        total: 13 errors, 2 warnings, 2570 lines checked
      Signed-off-by: NAntonio Ospite <ao2@ao2.it>
      Acked-by: NFrank Praznik <frank.praznik@gmail.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      09593e38
    • A
      bfb61abf
  13. 05 2月, 2016 1 次提交
  14. 30 1月, 2016 2 次提交
  15. 29 1月, 2016 1 次提交
  16. 28 1月, 2016 3 次提交
    • J
      HID: logitech-hidpp: limit visibility of init/deinit functions · af2e628d
      Jiri Kosina 提交于
      hidpp_ff_init() and hidpp_ff_deinit() are not used outside of
      hid-logitech-hidpp.c, so let's make them static.
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      af2e628d
    • E
      HID: logitech-hidpp: Force feedback support for the Logitech G920 · ff21a635
      Edwin Velds 提交于
      This patch implements force feedback support for the Logitech
      G920 Driving Force Racing Wheel. It is a generic implementation
      of feature 0x8123 of the Logitech HID++ protocol and should be
      usable for any future devices that implement this feature.
      
      This patch should be applied after the basic G920 support patch
      by Simon Wood:
      http://www.spinics.net/lists/linux-input/msg42174.html
      
      The driving supports everything that is supported by the G920
      firmware:
          FF_CONSTANT
          FF_PERIODIC
          FF_SINE
          FF_SQUARE
          FF_SAW_UP
          FF_SAW_DOWN
          FF_TRIANGLE
          FF_SPRING
          FF_DAMPER
          FF_AUTOCENTER
          FF_GAIN
      and for version 2 firmware also:
          FF_FRICTION
          FF_INERTIA
          FF_RAMP
      
      Both envelopes and replay values are supported as well, but some
      problems may occur when using firmware release 1. There is also a
      small residual clockwise damper in the wheel when using the first
      firmware release. All problems are fixed in the soon te be released
      firmware version 2.
      
      The default spring is disabled by permanently placing a spring
      force in the wheel. This spring is also used as the autocenter
      spring.
      
      Note: The wheel _DOES_NOT_ auto switch to Logitech/HID mode (it is stuck
      in XBox since the xpad changes where not included). Michal has an
      alternative approach documented here (and the changes should be submitted
      upstream to usb_modeswitch project):
      
      ===
      Create a file named "046d:c261" in "/etc/usb_modeswitch.d" with the
      following content:
      
      DefaultVendor=046d
      DefaultProduct=c261
      MessageEndpoint=01
      ResponseEndpoint=01
      TargetClass=0x03
      MessageContent="0f00010142"
      
      Then run "usb_modeswitch -c /etc/modeswitch.d/046d:c291" as root and
      watch the magic happen:)
      ===
      
      [jkosina@suse.cz: added information about mode switching from Simon]
      [jkosina@suse.cz: fixed a few stylistic issues pointed out by Simon]
      [jkosina@suse.cz: fix merge conflict due to to_hid_device() changes]
      Signed-off-by: NEdwin Velds <e.velds@gmail.com>
      Tested-by: NElias Vanderstuyft <elias.vds@gmail.com>
      Tested-by: NSimon Wood <simon@mungewell.org>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      ff21a635
    • A
      HID: rmi: Check that the device is a RMI device in suspend and resume callbacks · b786ae8e
      Andrew Duggan 提交于
      Commit 09256360 ("HID: rmi: Disable scanning if the device is not a wake
      source") introduced a regression for devices which use hid-rmi to handle
      composite USB devices. The suspend or resume callbacks are not checking
      that the device is a RMI device before calling rmi_read or rmi_write.
      This results in dereferencing uninitialized variables on non RMI devices. This
      patch checks that the RMI_DEVICE flag is set before sending RMI commands to the
      device.
      Reported-by: NRodrigo Gomes <rodrigo.toste.gomes@gmail.com>
      Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      b786ae8e
  17. 25 1月, 2016 1 次提交
  18. 21 1月, 2016 1 次提交
  19. 19 1月, 2016 4 次提交