linux-toradex.git/drivers/hid/hid-ntrig.c, branch v3.4.78 Linux kernel for Apalis and Colibri modules HID: ntrig: validate feature report details 2013-09-27T00:15:36+00:00 Kees Cook keescook@chromium.org 2013-08-28T20:31:28+00:00 2dbe9ce6b7d6aeb1e6ba320837a55fb2cf194e17 commit 875b4e3763dbc941f15143dd1a18d10bb0be303b upstream. A HID device could send a malicious feature report that would cause the ntrig HID driver to trigger a NULL dereference during initialization: [57383.031190] usb 3-1: New USB device found, idVendor=1b96, idProduct=0001 ... [57383.315193] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 [57383.315308] IP: [<ffffffffa08102de>] ntrig_probe+0x25e/0x420 [hid_ntrig] CVE-2013-2896 Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 875b4e3763dbc941f15143dd1a18d10bb0be303b upstream.

A HID device could send a malicious feature report that would cause the
ntrig HID driver to trigger a NULL dereference during initialization:

[57383.031190] usb 3-1: New USB device found, idVendor=1b96, idProduct=0001
...
[57383.315193] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
[57383.315308] IP: [<ffffffffa08102de>] ntrig_probe+0x25e/0x420 [hid_ntrig]

CVE-2013-2896

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
HID: hid-ntrig: init settle and mode check 2011-03-14T12:10:13+00:00 Rafi Rubin rafi@seas.upenn.edu 2011-03-10T04:33:52+00:00 7b2a64c96ad53c4299f7e6ddf8c2f99cb48940a9 Adding a wait before the wakeup signal. As a precautionary measure sanity check the current sensor mode. If needed reset it to "dual". When the device is responding poorly and needs the wakeup call, it was missing it. Giving it a chance to settle first improves the chances that signal gets through. Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu> Tested-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz> 
Adding a wait before the wakeup signal.

As a precautionary measure sanity check the current sensor mode.  If
needed reset it to "dual".

When the device is responding poorly and needs the wakeup call, it was
missing it.  Giving it a chance to settle first improves the chances
that signal gets through.

Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
HID: ntrig remove if and drop an indent 2011-03-14T11:58:15+00:00 Rafi Rubin rafi@seas.upenn.edu 2011-03-08T02:13:28+00:00 ff4046294ba215abeaf45c10ab6cbfae41978b14 Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu> Tested-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz> 
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
HID: ntrig: apply NO_INIT_REPORTS quirk 2011-03-10T10:37:55+00:00 Rafi Rubin rafi@seas.upenn.edu 2011-03-10T04:33:51+00:00 6638dedaec6e3d32654f0ac5786f5d32963e208b Probing reports does bad things with some ntrig firmwares, better to just leave them alone. Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu> Signed-off-by: Jiri Kosina <jkosina@suse.cz> 
Probing reports does bad things with some ntrig firmwares, better to
just leave them alone.

Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
HID: ntrig don't dereference unclaimed hidinput 2011-03-08T13:36:31+00:00 Rafi Rubin rafi@seas.upenn.edu 2011-03-08T05:24:29+00:00 f41a52d3010579949a3b9fd76783120d9643b60b Check before dereferencing field->hidinput to fix a reported invalid deference bug. Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu> Signed-off-by: Jiri Kosina <jkosina@suse.cz> 
Check before dereferencing field->hidinput to fix a reported invalid
deference bug.

Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
HID: Add and use hid_<level>: dev_<level> equivalents 2010-12-10T14:10:38+00:00 Joe Perches joe@perches.com 2010-12-10T03:29:03+00:00 4291ee305e9bb0699504a66f0e2b7aefcf0512a5 Neaten current uses of dev_<level> by adding and using hid specific hid_<level> macros. Convert existing uses of dev_<level> uses to hid_<level>. Convert hid-pidff printk uses to hid_<level>. Remove err_hid and use hid_err instead. Add missing newlines to logging messages where necessary. Coalesce format strings. Add and use pr_fmt(fmt) KBUILD_MODNAME ": " fmt Other miscellaneous changes: Add const struct hid_device * argument to hid-core functions extract() and implement() so hid_<level> can be used by them. Fix bad indentation in hid-core hid_input_field function that calls extract() function above. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> 
Neaten current uses of dev_<level> by adding and using
hid specific hid_<level> macros.

Convert existing uses of dev_<level> uses to hid_<level>.
Convert hid-pidff printk uses to hid_<level>.

Remove err_hid and use hid_err instead.

Add missing newlines to logging messages where necessary.
Coalesce format strings.

Add and use pr_fmt(fmt) KBUILD_MODNAME ": " fmt

Other miscellaneous changes:

Add const struct hid_device * argument to hid-core functions
extract() and implement() so hid_<level> can be used by them.
Fix bad indentation in hid-core hid_input_field function
that calls extract() function above.

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
HID: ntrig: identify firmware version 2010-09-08T09:46:19+00:00 Rafi Rubin rafi@seas.upenn.edu 2010-09-08T09:46:14+00:00 0277873c05158c5efc97c23d52e6aec6250bde0f This adds firmware version polling to the end of probe and reports the version both in the raw form and proccessed to match the formatting used by N-Trig. Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu> Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Acked-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Jiri Kosina <jkosina@suse.cz> 
This adds firmware version polling to the end of probe and reports the
version both in the raw form and proccessed to match the formatting used
by N-Trig.

Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Acked-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
HID: ntrig: a bit of whitespace cleanup 2010-08-30T13:26:12+00:00 Rafi Rubin rafi@seas.upenn.edu 2010-08-26T04:54:55+00:00 a52dc34c0eea991115a9d789e9461f06768fa360 Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu> Signed-off-by: Jiri Kosina <jkosina@suse.cz> 
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
HID: ntrig: add support for new firwmare versions 2010-06-21T11:41:13+00:00 micki micki@micki-laptop.(none) 2010-06-19T08:37:29+00:00 6e32819e12ffbd507eced11a1871700a387d5407 Signed-off-by: Micki Balanga <micki@n-trig.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> 
Signed-off-by: Micki Balanga <micki@n-trig.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
HID: ntrig: add filtering module parameters 2010-05-11T08:45:22+00:00 Rafi Rubin rafi@seas.upenn.edu 2010-05-04T18:20:16+00:00 ab3f4980ec62b907e697ff0934a8e1d076a6d46d Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu> Signed-off-by: Jiri Kosina <jkosina@suse.cz> 
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>