aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/hid/hid-core.c
Commit message (Collapse)AuthorAge
* Merge branch 'for-linus' of ↵Linus Torvalds2014-02-18
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID update from Jiri Kosina: - fixes for several bugs in incorrect allocations of buffers by David Herrmann and Benjamin Tissoires. - support for a few new device IDs by Archana Patni, Benjamin Tissoires, Huei-Horng Yo, Reyad Attiyat and Yufeng Shen * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: hyperv: make sure input buffer is big enough HID: Bluetooth: hidp: make sure input buffers are big enough HID: hid-sensor-hub: quirk for STM Sensor hub HID: apple: add Apple wireless keyboard 2011 JIS model support HID: fix buffer allocations HID: multitouch: add FocalTech FTxxxx support HID: microsoft: Add ID's for Surface Type/Touch Cover 2 HID: usbhid: quirk for CY-TM75 75 inch Touch Overlay
| * HID: apple: add Apple wireless keyboard 2011 JIS model supportHuei-Horng Yo2014-02-06
| | | | | | | | | | | | | | Add Apple wireless keyboard 2011 JIS model (05ac:0257). Signed-off-by: Huei-Horng Yo <hiroshi@ghostsinthelab.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * HID: microsoft: Add ID's for Surface Type/Touch Cover 2Reyad Attiyat2014-01-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Microsoft Surface Type/Touch cover 2 devices have the flag HID_DG_CONTACTID in their reports.This causes the device to bind to the hid-multitouch driver, which doesn't handle generic keyboard/mouse input events. The patch adds the hardware id's of the device to hid-microsoft and to the HID special driver array, which makes the device get handled by hid-generic/hid-input properly. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=64811 Singed-off-by: Reyad Attiyat <reyad.attiyat@gmail.com> Reviewed-by: Benjamin Tissoires<benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | Merge branch 'v4l_for_linus' of ↵Linus Torvalds2014-01-31
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - a new jpeg codec driver for Samsung Exynos (jpeg-hw-exynos4) - a new dvb frontend for ds2103 chipset (m88ds2103) - a new sensor driver for Samsung S5K5BAF UXGA (s5k5baf) - new drivers for R-Car VSP1 - a new radio driver: radio-raremono - a new tuner driver for ts2022 chipset (m88ts2022) - the analog part of em28xx is now a separate module that only load/runs if the device is not a pure digital TV device - added a staging driver for bcm2048 radio devices - the omap 2 video driver (omap24xx) was moved to staging. This driver is for an old hardware and uses a deprecated Kernel internal API. If nobody cares enough to fix it, it would be removed on a couple Kernel releases - the sn9c102 driver was moved to staging. This driver was replaced by gspca, and disabled on some distros, as almost all devices are known to work properly with gspca. It should be removed from kernel on a couple Kernel releases - lots of driver fixes, improvements and cleanups * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (421 commits) [media] media: v4l2-dev: fix video device index assignment [media] rc-core: reuse device numbers [media] em28xx-cards: properly initialize the device bitmap [media] Staging: media: Fix line length exceeding 80 characters in as102_drv.c [media] Staging: media: Fix line length exceeding 80 characters in as102_fe.c [media] Staging: media: Fix quoted string split across line in as102_fe.c [media] media: st-rc: Add reset support [media] m2m-deinterlace: fix allocated struct type [media] radio-usb-si4713: fix sparse non static symbol warnings [media] em28xx-audio: remove needless check before usb_free_coherent() [media] au0828: Fix sparse non static symbol warning Revert "[media] go7007-usb: only use go->dev after allocated" [media] em28xx-audio: provide an error code when URB submit fails [media] em28xx: fix check for audio only usb interfaces when changing the usb alternate setting [media] em28xx: fix usb alternate setting for analog and digital video endpoints > 0 [media] em28xx: make 'em28xx_ctrl_ops' static em28xx-alsa: Fix error patch for init/fini [media] em28xx-audio: flush work at .fini [media] drxk: remove the option to load firmware asynchronously [media] em28xx: adjust period size at runtime ...
| * [media] si4713: HID blacklist Si4713 USB development boardDinesh Ram2013-12-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Si4713 development board contains a Si4713 FM transmitter chip and is handled by the radio-usb-si4713 driver. The board reports itself as (10c4:8244) Cygnal Integrated Products, Inc. and misidentifies itself as a HID device in its USB interface descriptor. This patch ignores this device as an HID device and hence loads the custom driver. Signed-off-by: Dinesh Ram <dinesh.ram@cern.ch> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Acked-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Tested-by: Eduardo Valentin <edubezval@gmail.com> Acked-by: Eduardo Valentin <edubezval@gmail.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| |
| \
| \
| \
*---. \ Merge branches 'for-3.13/upstream-fixes', 'for-3.14/i2c-hid', ↵Jiri Kosina2014-01-22
|\ \ \ \ | | |_|/ | |/| | | | | | 'for-3.14/sensor-hub', 'for-3.14/sony' and 'for-3.14/upstream' into for-linus
| | | * HID: hid-holtek-mouse: add new a070 mouseKharlamov Alexey2014-01-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Added support of RITMIX ROM-316 mouse to hid-holtek-mouse workaround module Signed-off-by: Alexey Kharlamov <derlafff@ya.ru> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: remove SIS entries from hid_have_special_driver[]Jiri Kosina2013-12-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The entries are not needed, as hid-multitouch gets bound correctly automatically by contact ID. Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: add support for SiS multitouch panel in the touch monitor LG 23ET83VEmanuel Krenz2013-12-13
| | | | | | | | | | | | | | | | | | | | | | | | [jkosina@suse.cz: refresh to apply after SIS quirk merging] Signed-off-by: Emanuel Krenz <emanuelkrenz@web.de> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: usbhid: fix sis quirkWanlong Gao2013-12-02
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | Since commit 765e5fbd merged the sis quirk, then USB_VENDOR_ID_SIS2_TOUCH remains undefined. Reported-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * HID: sony: Add force-feedback support for the Dualshock 4Frank Praznik2014-01-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds the Dualshock 4 to the HID device list and enables force-feedback. Adds a Dualshock 4 specific worker function since the Dualshock 4 needs a different report than the Sixaxis. The right motor in the Dualshock 4 is variable so the full rumble value is now passed to the worker function and clamped there if necessary. Signed-off-by: Frank Praznik <frank.praznik@oh.rr.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | | HID: kye: Add report fixup for Genius Manticore KeyboardBenjamin Tissoires2013-11-21
| |/ |/| | | | | | | | | | | | | | | | | Genius Manticore Keyboard presents the same problem in its report descriptors than Genius Gila Gaming Mouse and Genius Imperator Keyboard. Use the same fixup. Reported-and-tested-by: Adam Kulagowski <fidor@fidor.org> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | Revert "HID: wiimote: add LEGO-wiimote VID"Jiri Kosina2013-11-19
|/ | | | | | | | | | | | | | This reverts commit 86b84167d4e67372376a57ea9955c5d53dae232f as it introduced a VID/PID conflict with its original owner: hid-wiimote got hid:b0005g*v0000054Cp00000306 added but hid-sony already has this id for the PS3 Remote (and the ID is oficically assigned to Sony). Revert the commit to avoid hid-sony regression. David is working on a bluez patch to force proper ID on the wiimote. Reported-by: David Herrmann <dh.herrmann@gmail.com> Reported-by: Michel Kraus <mksolpa@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
*-------. Merge branches 'for-3.12/upstream-fixes', 'for-3.13/holtek', ↵Jiri Kosina2013-11-15
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | 'for-3.13/i2c-hid', 'for-3.13/logitech', 'for-3.13/multitouch', 'for-3.13/roccat', 'for-3.13/upstream' and 'for-3.13/wiimote' into for-linus
| | | | | * HID: enable Mayflash USB Gamecube AdapterTristan Rice2013-11-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a patch that adds the new Mayflash Gamecube Controller to USB adapter (ID 1a34:f705 ACRUX) to the ACRUX driver (drivers/hid/hid-axff.c) with full force feedback support. Signed-off-by: Tristan Rice <rice@outerearth.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | | * HID: don't ignore eGalax/D-Wav/EETI HIDsForest Bond2013-11-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Certain devices with class HID, protocol None did not work with the HID driver at one point, and as a result were bound to usbtouchscreen instead as of commit 139ebe8 ("Input: usbtouchscreen - fix eGalax HID ignoring"). This change was prompted by the following report: https://lkml.org/lkml/2009/1/25/127 Unfortunately, the device mentioned in this report is no longer available for testing. We've recently discovered that some devices with class HID, protocol None do not work with usbtouchscreen, but do work with usbhid. Here is the report that made this evident: http://comments.gmane.org/gmane.linux.kernel.input/31710 Driver binding for these devices has flip-flopped a few times, so both of the above reports were regressions. This situation would appear to leave us with no easy way to bind every device to the right driver. However, in my own testing with several devices I have not found a device with class HID that does not work with the current HID driver. It is my belief that changes to the HID driver since the original report have likely fixed the issue(s) that made it unsuitable at the time, and that we should prefer it over usbtouchscreen for these devices. In particular, HID quirks affecting these devices were added/removed in the following commits since then: fe6065d HID: add multi-input quirk for eGalax Touchcontroller 77933c3 Merge branch 'egalax' into for-linus ebd11fe HID: Add quirk for eGalax touch controler. d34c4aa HID: add no-get quirk for eGalax touch controller This patch makes the HID driver no longer ignore eGalax/D-Wav/EETI devices with class HID. If there are in fact devices with class HID that still do not work with the HID driver, we will see another round of regressions. In that case I propose we investigate why the device is not working with the HID driver rather than re-introduce regressions for functioning HID devices by again binding them to usbtouchscreen. The corresponding change to usbtouchscreen will be made separately. Signed-off-by: Forest Bond <forest.bond@rapidrollout.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | | * HID: remove self-assignment from hid_input_reportFelix Rueegg2013-10-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ternary expression will always result in a self-assignment, which is pointless. Signed-off-by: Felix Rueegg <felix.rueegg@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * | HID: roccat: add missing special driver declarationsStefan Achatz2013-11-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Forgot two special driver declarations and sorted the list. Signed-off-by: Stefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * | HID: roccat: add support for Ryos MK keyboardsStefan Achatz2013-10-30
| | |_|/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | Added support for 3 keyboards with increasing illumination capabilities Signed-off-by: Stefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * | HID: hid-multitouch: add support for SiS panelsForest Bond2013-10-25
| | | |/ | | | | | | | | | | | | | | | | | | | | | | | | Add support for SiS multitouch panels. Signed-off-by: Forest Bond <forest.bond@rapidrollout.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | HID: logitech - lg2ff: Add IDs for Formula Vibration Feedback WheelElias Vanderstuyft2013-10-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add USB IDs for Logitech Formula Vibration Feedback Wheel (046d:ca04). The lg2ff force feedback subdriver is used for vibration and HID_GD_MULTIAXIS is set to avoid deadzone like other Logitech wheels. Kconfig description etc are also updated accordingly. Signed-off-by: Elias Vanderstuyft <Elias.vds@gmail.com> [anssi.hannula@iki.fi: added description and CCs] Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi> Signed-off-by: Simon Wood <simon@mungewell.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | | | HID: add support for LEETGION Hellion Gaming MouseAnders F. U. Kiær2013-10-25
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added id, bindings and comments for Holtek USB ID 04d9:a072 LEETGION Hellion Gaming mouse to use the same corrections of the report descriptor as Holtek 04d9:a067. As the mouse exceed HID_MAX_USAGES at the same offsets in the reported descriptor. Tested on the hardware. Signed-off-by: Anders F. U. Kiær <ablacksheep@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | | HID: wiimote: add LEGO-wiimote VIDDavid Herrmann2013-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | The LEGO-wiimote uses a different VID than the Nintendo ID. The device is technically the same so add the ID. Cc: <stable@vger.kernel.org> # 3.11+ Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | | HID: Fix unit exponent parsing againNikolai Kondrashov2013-10-18
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Revert some changes done in 774638386826621c984ab6994439f474709cac5e. Revert all changes done in hidinput_calc_abs_res as it mistakingly used "Unit" item exponent nibbles to affect resolution value. This wasn't breaking resolution calculation of relevant axes of any existing devices, though, as they have only one dimension to their units and thus 1 in the corresponding nible. Revert to reading "Unit Exponent" item value as a signed integer in hid_parser_global to fix reading specification-complying values. This fixes resolution calculation of devices complying to the HID standard, including Huion, KYE, Waltop and UC-Logic graphics tablets which have their report descriptors fixed by the drivers. Explanations follow. There are two "unit exponents" in HID specification and it is important not to mix them. One is the global "Unit Exponent" item and another is nibble values in the global "Unit" item. See 6.2.2.7 Global Items. The "Unit Exponent" value is just a signed integer and is used to scale the integer resolution unit values, so fractions can be expressed. The nibbles of "Unit" value are used to select the unit system (nibble 0), and presence of a particular basic unit type in the unit formula and its *exponent* (or power, nibbles 1-6). And yes, the latter is in two complement and zero means absence of the unit type. Taking the representation example of (integer) joules from the specification: [mass(grams)][length(centimeters)^2][time(seconds)^-2] * 10^-7 the "Unit Exponent" would be -7 (or 0xF9, if stored as a byte) and the "Unit" value would be 0xE121, signifying: Nibble Part Value Meaning ----- ---- ----- ------- 0 System 1 SI Linear 1 Length 2 Centimeters^2 2 Mass 1 Grams 3 Time -2 Seconds^-2 To give the resolution in e.g. hundredth of joules the "Unit Exponent" item value should have been -9. See also the examples of "Unit" values for some common units in the same chapter. However, there is a common misunderstanding about the "Unit Exponent" value encoding, where it is assumed to be stored the same as nibbles in "Unit" item. This is most likely due to the specification being a bit vague and overloading the term "unit exponent". This also was and still is proliferated by the official "HID Descriptor Tool", which makes this mistake and stores "Unit Exponent" as such. This format is also mentioned in books such as "USB Complete" and in Microsoft's hardware design guides. As a result many devices currently on the market use this encoding and so the driver should support them. Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* / HID: add Holtek USB ID 04d9:a081 SHARKOON DarkGliderAnders F. U. Kiær2013-10-02
|/ | | | | | | | | | | Added id, bindings and comments for Holtek USB ID 04d9:a081 SHARKOON DarkGlider Gaming mouse to use the same corrections of the report descriptor as Holtek 04d9:a04a. As the mouse exceed HID_MAX_USAGES at the same offsets in the reported descriptor. Tested on the hardware. Signed-off-by: Anders F. U. Kiær <ablacksheep@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* HID: validate feature and input report detailsBenjamin Tissoires2013-09-13
| | | | | | | | | | | | | | | | | | | | | When dealing with usage_index, be sure to properly use unsigned instead of int to avoid overflows. When working on report fields, always validate that their report_counts are in bounds. Without this, a HID device could report a malicious feature report that could trick the driver into a heap overflow: [ 634.885003] usb 1-1: New USB device found, idVendor=0596, idProduct=0500 ... [ 676.469629] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten CVE-2013-2897 Cc: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* HID: provide a helper for validating hid reportsKees Cook2013-09-13
| | | | | | | | | | | | Many drivers need to validate the characteristics of their HID report during initialization to avoid misusing the reports. This adds a common helper to perform validation of the report exisitng, the field existing, and the expected number of values within the field. Signed-off-by: Kees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* Merge branch 'for-linus' of ↵Linus Torvalds2013-09-06
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID updates from Jiri Kosina: "Highlights: - conversion of HID subsystem to use devm-based resource management, from Benjamin Tissoires - i2c-hid support for DT bindings, from Benjamin Tissoires - much improved support for Win8-multitouch devices, from Benjamin Tissoires - cleanup of core code using common hidinput_input_event(), from David Herrmann - fix for bug in implement() access to the bit stream (causing oops) that has been present in the code for ages, but devices that are able to trigger it have started to appear only now, from Jiri Kosina - fixes for CVE-2013-2899, CVE-2013-2898, CVE-2013-2896, CVE-2013-2892, CVE-2013-2888 (all triggerable only by specially crafted malicious HW devices plugged into the system), from Kees Cook - hidraw oops fix, from Manoj Chourasia - various smaller fixes here and there, support for a bunch of new devices by various contributors" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (53 commits) HID: MAINTAINERS: add roccat drivers HID: hid-sensor-hub: change kmalloc + memcpy by kmemdup HID: hid-sensor-hub: move to devm_kzalloc HID: hid-sensor-hub: fix indentation accross the code HID: move HID_REPORT_TYPES closer to the report-definitions HID: check for NULL field when setting values HID: picolcd_core: validate output report details HID: sensor-hub: validate feature report details HID: ntrig: validate feature report details HID: pantherlord: validate output report details HID: hid-wiimote: print small buffers via %*phC HID: uhid: improve uhid example client HID: Correct the USB IDs for the new Macbook Air 6 HID: wiimote: add support for Guitar-Hero guitars HID: wiimote: add support for Guitar-Hero drums Input: introduce BTN/ABS bits for drums and guitars HID: battery: don't do DMA from stack HID: roccat: add support for KonePureOptical v2 HID: picolcd: Prevent NULL pointer dereference on _remove() HID: usbhid: quirk for N-Trig DuoSense Touch Screen ...
| *-----. Merge branches 'for-3.12/devm', 'for-3.12/i2c-hid', 'for-3.12/i2c-hid-dt', ↵Jiri Kosina2013-09-06
| |\ \ \ \ | | | | | | | | | | | | | | | | | | 'for-3.12/logitech', 'for-3.12/multitouch-win8', 'for-3.12/trasnport-driver-cleanup', 'for-3.12/uhid', 'for-3.12/upstream' and 'for-3.12/wiimote' into for-linus
| | | | * \ Merge branch 'for-3.11/CVE-2013-2888' into for-3.12/upstreamJiri Kosina2013-09-04
| | | | |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This one didn't make it for 3.11 due to being applied too close to release, queue it for 3.12 merge window. Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | | * | HID: validate HID report id sizeKees Cook2013-08-29
| | |_|_|/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "Report ID" field of a HID report is used to build indexes of reports. The kernel's index of these is limited to 256 entries, so any malicious device that sets a Report ID greater than 255 will trigger memory corruption on the host: [ 1347.156239] BUG: unable to handle kernel paging request at ffff88094958a878 [ 1347.156261] IP: [<ffffffff813e4da0>] hid_register_report+0x2a/0x8b CVE-2013-2888 Signed-off-by: Kees Cook <keescook@chromium.org> Cc: stable@kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * | HID: check for NULL field when setting valuesKees Cook2013-09-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Defensively check that the field to be worked on is not NULL. Signed-off-by: Kees Cook <keescook@chromium.org> Cc: stable@kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * | Merge branch 'master' into for-3.12/upstreamJiri Kosina2013-09-04
| | | | |\ \ | | |_|_|/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | Sync with Linus' tree to be able to apply fixup patch on top of 9d9a04ee75 ("HID: apple: Add support for the 2013 Macbook Air") Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * | HID: roccat: add support for KonePureOptical v2Stefan Achatz2013-09-02
| | | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | KonePureOptical is a KonePure with different sensor. Signed-off-by: Stefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * HID: Add new driver for non-compliant Xin-Mo devices.Olivier Scherler2013-07-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The driver currently only supports the Dual Arcade controller. It fixes the negative axis event values (the devices sends -2) to match the logical axis minimum of the HID report descriptor (the report announces -1). It is needed because hid-input discards out of bounds values. Signed-off-by: Olivier Scherler <oscherler@ithink.ch> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * HID: fix data access in implement()Jiri Kosina2013-07-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | implement() is setting bytes in LE data stream. In case the data is not aligned to 64bits, it reads past the allocated buffer. It doesn't really change any value there (it's properly bitmasked), but in case that this read past the boundary hits a page boundary, pagefault happens when accessing 64bits of 'x' in implement(), and kernel oopses. This happens much more often when numbered reports are in use, as the initial 8bit skip in the buffer makes the whole process work on values which are not aligned to 64bits. This problem dates back to attempts in 2005 and 2006 to make implement() and extract() as generic as possible, and even back then the problem was realized by Adam Kroperlin, but falsely assumed to be impossible to cause any harm: http://www.mail-archive.com/linux-usb-devel@lists.sourceforge.net/msg47690.html I have made several attempts at fixing it "on the spot" directly in implement(), but the results were horrible; the special casing for processing last 64bit chunk and switching to different math makes it unreadable mess. I therefore took a path to allocate a few bytes more which will never make it into final report, but are there as a cushion for all the 64bit math operations happening in implement() and extract(). All callers of hid_output_report() are converted at the same time to allocate the buffer by newly introduced hid_alloc_report_buf() helper. Bruno noticed that the whole raw_size test can be dropped as well, as hid_alloc_report_buf() makes sure that the buffer is always of a proper size. Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Acked-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * HID: kye: Add report fixup for Genius Gx Imperator KeyboardBenjamin Tissoires2013-07-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Genius Gx Imperator Keyboard presents the same problem in its report descriptors than Genius Gila Gaming Mouse. Use the same fixup for both. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=928561 Reported-and-tested-by: Honza Brazdil <jbrazdil@redhat.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * HID: core: fix hid delimiter local tag parsing.Paul Chavent2013-07-12
| | | |/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When device with the DELIMITER tag in its report descriptor is encountered during parsing, it's mistakenly immediately refused by HID core for no justifiable reason. [jkosina@suse.cz: polish changelog] Signed-off-by: Paul Chavent <paul.chavent@onera.fr> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: detect Win 8 multitouch devices in coreBenjamin Tissoires2013-08-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Detecting Win 8 multitouch devices in core allows us to set quirks before the device is parsed through hid_hw_start(). It also simplifies the detection of those devices in hid-multitouch and makes the handling of those devices cleaner. As Win 8 multitouch panels are in the group multitouch and rely on a special feature to be detected, this patch adds a bitfield in the parser. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Reviewed-by: Henrik Rydberg <rydberg@euromail.se> Tested-by: Srinivas Pandruvada<srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: Use hid_parser for pre-scanning the report descriptorsBenjamin Tissoires2013-08-27
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Win 8 detection is sufficiently complex to warrant use of the full parser code, in spite of the inferred memory usage. Therefore, we can use the existing HID parser in hid-core for hid_scan_report() by re-using the code from hid_open_report(). hid_parser_global, hid_parser_local and hid_parser_reserved does not have any side effects. We just need to reimplement the MAIN_ITEM callback to have a proper parsing without side effects. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Reviewed-by: Henrik Rydberg <rydberg@euromail.se> Tested-by: Srinivas Pandruvada<srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | / HID: convert bus code to use dev_groupsGreg Kroah-Hartman2013-08-26
|/ / | | | | | | | | | | | | | | | | The dev_attrs field of struct bus_type is going away soon, dev_groups should be used instead. This converts the HID bus code to use the correct field. Acked-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | Merge branch 'for-linus' of ↵Linus Torvalds2013-07-04
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: "First round of updates for the input subsystem. You will get a new touchsreen driver for Cypress 4th generation devices, a driver for a special controller implementing PS/2 protocol in OLPC devices, and a driver for power key for SiRFprimaII PWRC. HID and bcm5497 now support for the 2013 MacBook Air. EVIOCGKEY and the rest of evdev ioctls now flush events of matching type from the client's event queue so that clients can be sure any events received after issuing EVIOCG* ioctl are new events. And a host of cleanups and improvements in other drivers" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (87 commits) Input: cyttsp4 - kfree xfer_buf on error path in probe() Input: tps6507x-ts - select INPUT_POLLDEV Input: bcm5974 - add support for the 2013 MacBook Air HID: apple: Add support for the 2013 Macbook Air Input: cyttsp4 - leak on error path in probe() Input: cyttsp4 - silence NULL dereference warning Input: cyttsp4 - silence shift wrap warning Input: tps6507x-ts - convert to polled input device infrastructure ARM: davinci: da850-evm: remove vref from touchscreen platform data Input: cyttsp4 - SPI driver for Cypress TMA4XX touchscreen devices Input: cyttsp4 - I2C driver for Cypress TMA4XX touchscreen devices Input: cyttsp4 - add core driver for Cypress TMA4XX touchscreen devices Input: cyttsp - I2C driver split into two modules Input: add OLPC AP-SP driver Input: nspire-keypad - remove redundant dev_err call in nspire_keypad_probe() Input: tps6507x-ts - remove vref from platform data Input: tps6507x-ts - use bool for booleans Input: tps6507x-ts - remove bogus unreachable code Input: samsung-keypad - let device core setup the default pin configuration Input: wacom_i2c - implement hovering capability ...
| * HID: apple: Add support for the 2013 Macbook AirDmitry Torokhov2013-07-02
| | | | | | | | | | | | | | | | | | | | | | | | This patch adds keyboard support for MacbookAir6,2 as WELLSPRING8 (0x0291, 0x0292, 0x0293). The touchpad is handled in a separate bcm5974 patch, as usual. Cc: stable@vger.kernel.org Reported-and-tested-by: Brad Ford <plymouthffl@gmail.com> Signed-off-by: Henrik Rydberg <rydberg@euromail.se> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| |
| \
| \
| \
*---. \ Merge branches 'for-3.11/multitouch', 'for-3.11/sony' and ↵Jiri Kosina2013-07-04
|\ \ \ \ | | |_|/ | |/| | | | | | | | | | | | | | | | | | 'for-3.11/upstream' into for-linus Conflicts: drivers/hid/hid-core.c
| | | * HID: kye: Add report fixup for Genius Gila Gaming mouseBenjamin Tissoires2013-07-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Genius Gila Gaming Mouse presents an obviously wrong report descriptor. the Consumer control (report ID 3) is the following: 0x05, 0x0c, // Usage Page (Consumer Devices) 105 0x09, 0x01, // Usage (Consumer Control) 107 0xa1, 0x01, // Collection (Application) 109 0x85, 0x03, // Report ID (3) 111 0x19, 0x00, // Usage Minimum (0) 113 0x2a, 0xff, 0x7f, // Usage Maximum (32767) 115 0x15, 0x00, // Logical Minimum (0) 118 0x26, 0xff, 0x7f, // Logical Maximum (32767) 120 0x75, 0x10, // Report Size (16) 123 0x95, 0x03, // Report Count (3) 125 0x81, 0x00, // Input (Data,Arr,Abs) 127 0x75, 0x08, // Report Size (8) 129 0x95, 0x01, // Report Count (1) 131 0x81, 0x01, // Input (Cnst,Arr,Abs) 133 0xc0, // End Collection 135 So the first input whithin this report has a count of 3 but a usage range of 32768. So this value is obviously wrong as it should not be greater than the report count. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=959721 Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: core: fix reporting of raw eventsJiri Kosina2013-06-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | hdrw->raw event can return three different return value types: - ret < 0 indicates that the hdrv driver found an error while parsing - ret == 0 indicates no error has been encountered, and the driver has processed the report - ret > 0 indicates that there was no parsing error, and the driver hasn't processed the event. Calling hid_report_raw_event() has to be called appropriately so that it reflects what has been done by ->raw_event() callback, otherwise we might updates of the in-kernel structure are lost upon arrival of the report, which is wrong. Reported-and-tested-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Reported-and-tested-by: Daniel Leung <daniel.leung@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: add support for Huion 580 tabletMartin Rusko2013-05-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add hid-huion.c with support for Huion 580 tablet, which is simple 8x5" tablet with 4000LPI resolution and 2048 levels pressure-sensitive pen manufactured by the Chinese company Huion. The driver fixes incorrect report descriptor sent by the device, performs custom initialization required to switch the tablet into its native resolution mode and inverts the in-range bit. Signed-off-by: Martin Rusko <martin.rusko@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: ignore Jabra speakerphones HID interfaceVincent Palatin2013-05-23
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a quirk to ignore Jabra speakerphone 410 and 510 devices HID interface. On those devices, the USB audio interface is working nicely, but the HID interface is not working with the kernel usbhid driver, and it requires a specific userspace program. We could unbind it from userspace but just attaching the usbhid driver has sometimes nasty effects: either confusing the device state machine or triggering a storm of volume key events making eventual sound UI blinking like crazy. Signed-off-by: Vincent Palatin <vpalatin@chromium.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * HID: driver for PS2/3 Buzz controllersColin Leitner2013-05-28
| |/ | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for PS2/3 Buzz controllers into hid-sony It has been tested on Debian 7 with kernel version 3.10.0-rc2. Unfortunately I can't test the patch with a regular six-axis controller myself. Signed-off-by: Colin Leitner <colin.leitner@gmail.com> Cc: Jiri Kosina <jkosina@suse.cz> Cc: linux-input@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| |
| \
*-. \ Merge branches 'for-3.11/battery', 'for-3.11/elo', 'for-3.11/holtek' and ↵Jiri Kosina2013-07-04
|\ \ \ | |_|/ |/| | | | | 'for-3.11/i2c-hid-fixed' into for-linus