- 08 11月, 2013 1 次提交
-
-
由 Stefan Achatz 提交于
Forgot two special driver declarations and sorted the list. Signed-off-by: NStefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
- 04 11月, 2013 1 次提交
-
-
由 Stefan Achatz 提交于
Add missing switch breaks. Signed-off-by: NStefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
- 30 10月, 2013 3 次提交
-
-
由 Stefan Achatz 提交于
Added support for 3 keyboards with increasing illumination capabilities Signed-off-by: NStefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Stefan Achatz 提交于
Reduced some duplicate code by moving it to hid-roccat-common. Signed-off-by: NStefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Stefan Achatz 提交于
Ryos uses a new return value for critical errors, others have been confirmed. Signed-off-by: NStefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
- 21 10月, 2013 1 次提交
-
-
由 David Herrmann 提交于
The LEGO-wiimote uses a different VID than the Nintendo ID. The device is technically the same so add the ID. Cc: <stable@vger.kernel.org> # 3.11+ Signed-off-by: NDavid Herrmann <dh.herrmann@gmail.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
- 18 10月, 2013 1 次提交
-
-
由 Nikolai Kondrashov 提交于
Revert some changes done in 77463838. Revert all changes done in hidinput_calc_abs_res as it mistakingly used "Unit" item exponent nibbles to affect resolution value. This wasn't breaking resolution calculation of relevant axes of any existing devices, though, as they have only one dimension to their units and thus 1 in the corresponding nible. Revert to reading "Unit Exponent" item value as a signed integer in hid_parser_global to fix reading specification-complying values. This fixes resolution calculation of devices complying to the HID standard, including Huion, KYE, Waltop and UC-Logic graphics tablets which have their report descriptors fixed by the drivers. Explanations follow. There are two "unit exponents" in HID specification and it is important not to mix them. One is the global "Unit Exponent" item and another is nibble values in the global "Unit" item. See 6.2.2.7 Global Items. The "Unit Exponent" value is just a signed integer and is used to scale the integer resolution unit values, so fractions can be expressed. The nibbles of "Unit" value are used to select the unit system (nibble 0), and presence of a particular basic unit type in the unit formula and its *exponent* (or power, nibbles 1-6). And yes, the latter is in two complement and zero means absence of the unit type. Taking the representation example of (integer) joules from the specification: [mass(grams)][length(centimeters)^2][time(seconds)^-2] * 10^-7 the "Unit Exponent" would be -7 (or 0xF9, if stored as a byte) and the "Unit" value would be 0xE121, signifying: Nibble Part Value Meaning ----- ---- ----- ------- 0 System 1 SI Linear 1 Length 2 Centimeters^2 2 Mass 1 Grams 3 Time -2 Seconds^-2 To give the resolution in e.g. hundredth of joules the "Unit Exponent" item value should have been -9. See also the examples of "Unit" values for some common units in the same chapter. However, there is a common misunderstanding about the "Unit Exponent" value encoding, where it is assumed to be stored the same as nibbles in "Unit" item. This is most likely due to the specification being a bit vague and overloading the term "unit exponent". This also was and still is proliferated by the official "HID Descriptor Tool", which makes this mistake and stores "Unit Exponent" as such. This format is also mentioned in books such as "USB Complete" and in Microsoft's hardware design guides. As a result many devices currently on the market use this encoding and so the driver should support them. Signed-off-by: NNikolai Kondrashov <spbnick@gmail.com> Acked-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
- 09 10月, 2013 2 次提交
-
-
由 AceLan Kao 提交于
BugLink: http://bugs.launchpad.net/bugs/1180881 This device needs to be added to the quirks list with HID_QUIRK_NO_INIT_REPORTS, otherwise it causes 10 seconds timeout during report initialization. [12431.828467] hid-multitouch 0003:0457:1013.0475: usb_submit_urb(ctrl) failed: -1 [12431.828507] hid-multitouch 0003:0457:1013.0475: timeout initializing reports Signed-off-by: NAceLan Kao <acelan.kao@canonical.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 AceLan Kao 提交于
BugLink: http://bugs.launchpad.net/bugs/1180881 Synaptics large touchscreen doesn't support some of the report request while initializing. The unspoorted request will make the device unreachable, and will lead to the following usb_submit_urb() function call timeout. So, add the IDs into HID_QUIRK_NO_INIT_REPORTS quirk. Signed-off-by: NAceLan Kao <acelan.kao@canonical.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
- 07 10月, 2013 1 次提交
-
-
由 David Herrmann 提交于
The input core has an internal spinlock that is acquired during event injection via input_event() and friends but also held during FF callbacks. That means, there is no way to share a lock between event-injection and FF handling. Unfortunately, this is what is required for wiimote state tracking and what we do with state.lock and input->lock. This deadlock can be triggered when using continuous data reporting and FF on a wiimote device at the same time. I takes me at least 30m of stress-testing to trigger it but users reported considerably shorter times (http://bpaste.net/show/132504/) when using some gaming-console emulators. The real problem is that we have two copies of internal state, one in the wiimote objects and the other in the input device. As the input-lock is not supposed to be accessed from outside of input-core, we have no other chance than offloading FF handling into a worker. This actually works pretty nice and also allows to implictly merge fast rumble changes into a single request. Due to the 3-layered workers (rumble+queue+l2cap) this might reduce FF responsiveness. Initial tests were fine so lets fix the race first and if it turns out to be too slow we can always handle FF out-of-band and skip the queue-worker. Cc: <stable@vger.kernel.org> # 3.11+ Reported-by: Thomas Schneider Signed-off-by: NDavid Herrmann <dh.herrmann@gmail.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
- 02 10月, 2013 2 次提交
-
-
由 Anders F. U. Kiær 提交于
Added id, bindings and comments for Holtek USB ID 04d9:a081 SHARKOON DarkGlider Gaming mouse to use the same corrections of the report descriptor as Holtek 04d9:a04a. As the mouse exceed HID_MAX_USAGES at the same offsets in the reported descriptor. Tested on the hardware. Signed-off-by: NAnders F. U. Kiær <ablacksheep@gmail.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Manoj Chourasia 提交于
Even though device exist bit is set the underlying HW device should be closed when the last reader of the device is closed i.e. open count drops to zero. Signed-off-by: NManoj Chourasia <mchourasia@nvidia.com> Reported-by: mika.westerberg@linux.intel.com Tested-by: mika.westerberg@linux.intel.com Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
- 30 9月, 2013 1 次提交
-
-
由 Stefan Achatz 提交于
Fixing some wrong macro stringification/concatenation. Acked-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: NStefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
- 26 9月, 2013 1 次提交
-
-
由 David Herrmann 提交于
udev has this nice feature of creating "dead" /dev/<node> device-nodes if it finds a devnode:<node> modalias. Once the node is accessed, the kernel automatically loads the module that provides the node. However, this requires udev to know the major:minor code to use for the node. This feature was introduced by: commit 578454ff Author: Kay Sievers <kay.sievers@vrfy.org> Date: Thu May 20 18:07:20 2010 +0200 driver core: add devname module aliases to allow module on-demand auto-loading However, uhid uses dynamic minor numbers so this doesn't actually work. We need to load uhid to know which minor it's going to use. Hence, allocate a static minor (just like uinput does) and we're good to go. Reported-by: NTom Gundersen <teg@jklm.no> Signed-off-by: NDavid Herrmann <dh.herrmann@gmail.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
- 13 9月, 2013 11 次提交
-
-
由 Benjamin Tissoires 提交于
If tpkbd_probe_tp() bails out, the probe() function return an error, but hid_hw_stop() is never called. fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1003998 Cc: stable@vger.kernel.org Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Benjamin Tissoires 提交于
When working on report indexes, always validate that they are in bounds. Without this, a HID device could report a malicious feature report that could trick the driver into a heap overflow: [ 634.885003] usb 1-1: New USB device found, idVendor=0596, idProduct=0500 ... [ 676.469629] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten Note that we need to change the indexes from s8 to s16 as they can be between -1 and 255. CVE-2013-2897 Cc: stable@vger.kernel.org Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com> Acked-by: NKees Cook <keescook@chromium.org> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Kees Cook 提交于
A HID device could send a malicious output report that would cause the logitech-dj HID driver to leak kernel memory contents to the device, or trigger a NULL dereference during initialization: [ 304.424553] usb 1-1: New USB device found, idVendor=046d, idProduct=c52b ... [ 304.780467] BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 [ 304.781409] IP: [<ffffffff815d50aa>] logi_dj_recv_send_report.isra.11+0x1a/0x90 CVE-2013-2895 Signed-off-by: NKees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@gmail.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Benjamin Tissoires 提交于
When dealing with usage_index, be sure to properly use unsigned instead of int to avoid overflows. When working on report fields, always validate that their report_counts are in bounds. Without this, a HID device could report a malicious feature report that could trick the driver into a heap overflow: [ 634.885003] usb 1-1: New USB device found, idVendor=0596, idProduct=0500 ... [ 676.469629] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten CVE-2013-2897 Cc: stable@vger.kernel.org Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com> Acked-by: NKees Cook <keescook@chromium.org> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Kees Cook 提交于
A HID device could send a malicious output report that would cause the lenovo-tpkbd HID driver to write just beyond the output report allocation during initialization, causing a heap overflow: [ 76.109807] usb 1-1: New USB device found, idVendor=17ef, idProduct=6009 ... [ 80.462540] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten CVE-2013-2894 Signed-off-by: NKees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Kees Cook 提交于
A HID device could send a malicious output report that would cause the lg, lg3, and lg4 HID drivers to write beyond the output report allocation during an event, causing a heap overflow: [ 325.245240] usb 1-1: New USB device found, idVendor=046d, idProduct=c287 ... [ 414.518960] BUG kmalloc-4096 (Not tainted): Redzone overwritten Additionally, while lg2 did correctly validate the report details, it was cleaned up and shortened. CVE-2013-2893 Signed-off-by: NKees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Kees Cook 提交于
A HID device could send a malicious output report that would cause the steelseries HID driver to write beyond the output report allocation during initialization, causing a heap overflow: [ 167.981534] usb 1-1: New USB device found, idVendor=1038, idProduct=1410 ... [ 182.050547] BUG kmalloc-256 (Tainted: G W ): Redzone overwritten CVE-2013-2891 Signed-off-by: NKees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Kees Cook 提交于
This driver must validate the availability of the HID output report and its size before it can write LED states via buzz_set_leds(). This stops a heap overflow that is possible if a device provides a malicious HID output report: [ 108.171280] usb 1-1: New USB device found, idVendor=054c, idProduct=0002 ... [ 117.507877] BUG kmalloc-192 (Not tainted): Redzone overwritten CVE-2013-2890 Signed-off-by: NKees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org #3.11 Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Kees Cook 提交于
The zeroplus HID driver was not checking the size of allocated values in fields it used. A HID device could send a malicious output report that would cause the driver to write beyond the output report allocation during initialization, causing a heap overflow: [ 1442.728680] usb 1-1: New USB device found, idVendor=0c12, idProduct=0005 ... [ 1466.243173] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten CVE-2013-2889 Signed-off-by: NKees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Kees Cook 提交于
Many drivers need to validate the characteristics of their HID report during initialization to avoid misusing the reports. This adds a common helper to perform validation of the report exisitng, the field existing, and the expected number of values within the field. Signed-off-by: NKees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Martin Schwidefsky 提交于
After the last architecture switched to generic hard irqs the config options HAVE_GENERIC_HARDIRQS & GENERIC_HARDIRQS and the related code for !CONFIG_GENERIC_HARDIRQS can be removed. Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>
-
- 08 9月, 2013 1 次提交
-
-
由 Linus Torvalds 提交于
This reverts commits 61e00655, 73f8645d and 8e22ecb6: "Input: introduce BTN/ABS bits for drums and guitars" "HID: wiimote: add support for Guitar-Hero drums" "HID: wiimote: add support for Guitar-Hero guitars" The extra new ABS_xx values resulted in ABS_MAX no longer being a power-of-two, which broke the comparison logic. It also caused the ioctl numbers to overflow into the next byte, causing problems for that. We'll try again for 3.13. Reported-by: NMarkus Trippelsdorf <markus@trippelsdorf.de> Reported-by: NLinus Torvalds <torvalds@linux-foundation.org> Acked-by: NDavid Herrmann <dh.herrmann@gmail.com> Acked-by: NDmitry Torokhov <dmitry.torokhov@gmail.com> Cc: Benjamin Tissoires <benjamin.tissoires@gmail.com> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
- 04 9月, 2013 12 次提交
-
-
由 Andy Shevchenko 提交于
The patch substitutes kmemdup for kmalloc followed by memcpy. Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Andy Shevchenko 提交于
devm_kzalloc() will manage resources freeing and allows to make error path smaller and nicer. Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Andy Shevchenko 提交于
Patch just rearranges lines to be more compact and/or readable. Additionally it converts double space to one in several places. There is no functional change. Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Kees Cook 提交于
Defensively check that the field to be worked on is not NULL. Signed-off-by: NKees Cook <keescook@chromium.org> Cc: stable@kernel.org Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Kees Cook 提交于
A HID device could send a malicious output report that would cause the picolcd HID driver to trigger a NULL dereference during attr file writing. [jkosina@suse.cz: changed report->maxfield < 1 to report->maxfield != 1 as suggested by Bruno]. CVE-2013-2899 Signed-off-by: NKees Cook <keescook@chromium.org> Cc: stable@kernel.org Reviewed-by: NBruno Prémont <bonbons@linux-vserver.org> Acked-by: NBruno Prémont <bonbons@linux-vserver.org> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Kees Cook 提交于
A HID device could send a malicious feature report that would cause the sensor-hub HID driver to read past the end of heap allocation, leaking kernel memory contents to the caller. CVE-2013-2898 Signed-off-by: NKees Cook <keescook@chromium.org> Cc: stable@kernel.org Reviewed-by: NMika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Kees Cook 提交于
A HID device could send a malicious feature report that would cause the ntrig HID driver to trigger a NULL dereference during initialization: [57383.031190] usb 3-1: New USB device found, idVendor=1b96, idProduct=0001 ... [57383.315193] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 [57383.315308] IP: [<ffffffffa08102de>] ntrig_probe+0x25e/0x420 [hid_ntrig] CVE-2013-2896 Signed-off-by: NKees Cook <keescook@chromium.org> Cc: stable@kernel.org Signed-off-by: NRafi Rubin <rafi@seas.upenn.edu> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Kees Cook 提交于
A HID device could send a malicious output report that would cause the pantherlord HID driver to write beyond the output report allocation during initialization, causing a heap overflow: [ 310.939483] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0003 ... [ 315.980774] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten CVE-2013-2892 Signed-off-by: NKees Cook <keescook@chromium.org> Cc: stable@kernel.org Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Andy Shevchenko 提交于
Instead of passing each byte through stack let's use %*phC specifier to dump buffer as a hex string. Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: NDavid Herrmann <dh.herrmann@gmail.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Henrik Rydberg 提交于
A recent patch (9d9a04ee) added support for the new machine, but got the sequence of USB ids wrong. Reports from both Ian and Linus T show that the 0x0291 id is for ISO, not ANSI, which should have the missing number 0x0290. This patchs moves the three numbers accordingly, fixing the problem. Reported-and-tested-by: NIan Munsie <darkstarsword@gmail.com> Tested-by: NLinus G Thiel <linus@hanssonlarsson.se> Signed-off-by: NHenrik Rydberg <rydberg@euromail.se> Acked-by: NDmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Nicolas Adenis-Lamarre 提交于
Apart from drums, Guitar-Hero also ships with guitars. Use the recently introduced input ABS/BTN-bits to report this to user-space. Devices are reported as "Nintendo Wii Remote Guitar". If I ever get my hands on "RockBand" guitars, I will try to report them via the same interface so user-space does not have to bother which device it deals with. Signed-off-by: NNicolas.Adenis-Lamarre <nicolas.adenis.lamarre@gmail.com> (add commit-msg and adjust to new BTN_* IDs) Signed-off-by: NDavid Herrmann <dh.herrmann@gmail.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 David Herrmann 提交于
Guitar-Hero comes with a drums extension. Use the newly introduced input drums-bits to report this back to user-space. This is a usual extension like any other device. Nothing special to take care of. We report this to user-space as "Nintendo Wii Remote Drums". There are other drums (like "RockBand" drums) which we currently do not support and maybe will at some point. However, it is quite likely that we can report these via the same interface. This allows user-space to work with them without knowing the exact branding. I couldn't find anyone who owns a "RockBand" device, though. Initial-work-by: NNicolas Adenis-Lamarre <nicolas.adenis.lamarre@gmail.com> Signed-off-by: NDavid Herrmann <dh.herrmann@gmail.com> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
- 02 9月, 2013 2 次提交
-
-
由 Jiri Kosina 提交于
Instead of using data from stack for DMA in hidinput_get_battery_property(), allocate the buffer dynamically. Cc: stable@kernel.org Reported-by: NRichard Ryniker <ryniker@alum.mit.edu> Reported-by: NAlan Stern <stern@rowland.harvard.edu> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-
由 Stefan Achatz 提交于
KonePureOptical is a KonePure with different sensor. Signed-off-by: NStefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: NJiri Kosina <jkosina@suse.cz>
-