linux-toradex.git/drivers/hid/i2c-hid, branch v4.4.103

HID: i2c-hid: allocate hid buffers for real worst case

2017-10-12T09:27:33+00:00

commit 8320caeeffdefec3b58b9d4a7ed8e1079492fe7b upstream.

The buffer allocation is not currently accounting for an extra byte for
the report id. This can cause an out of bounds access in function
i2c_hid_set_or_send_report() with reportID > 15.

Signed-off-by: Adrian Salido 
Reviewed-by: Benson Leung 
Signed-off-by: Guenter Roeck 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: i2c-hid: Add sleep between POWER ON and RESET

2017-07-05T12:37:20+00:00

[ Upstream commit a89af4abdf9b353cdd6f61afc0eaaac403304873 ]

Support for the Asus Touchpad was recently added. It turns out this
device can fail initialisation (and become unusable) when the RESET
command is sent too soon after the POWER ON command.

Unfortunately the i2c-hid specification does not specify the need for
a delay between these two commands. But it was discovered the Windows
driver has a 1ms delay.

As a result, this patch modifies the i2c-hid module to add a sleep
inbetween the POWER ON and RESET commands which lasts between 1ms and 5ms.

See https://github.com/vlasenko/hid-asus-dkms/issues/24 for further
details.

Signed-off-by: Brendan McGrath 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report()

2016-04-12T16:08:48+00:00

commit 3b654288b196ceaa156029d9457ccbded0489b98 upstream.

Even though hid_hw_* checks that passed in data_len is less than
HID_MAX_BUFFER_SIZE it is not enough, as i2c-hid does not necessarily
allocate buffers of HID_MAX_BUFFER_SIZE but rather checks all device
reports and select largest size. In-kernel users normally just send as much
data as report needs, so there is no problem, but hidraw users can do
whatever they please:

BUG: KASAN: slab-out-of-bounds in memcpy+0x34/0x54 at addr ffffffc07135ea80
Write of size 4101 by task syz-executor/8747
CPU: 2 PID: 8747 Comm: syz-executor Tainted: G    BU         3.18.0 #37
Hardware name: Google Tegra210 Smaug Rev 1,3+ (DT)
Call trace:
[] dump_backtrace+0x0/0x258 arch/arm64/kernel/traps.c:83
[] show_stack+0x1c/0x2c arch/arm64/kernel/traps.c:172
[<     inline     >] __dump_stack lib/dump_stack.c:15
[] dump_stack+0x90/0x140 lib/dump_stack.c:50
[<     inline     >] print_error_description mm/kasan/report.c:97
[<     inline     >] kasan_report_error mm/kasan/report.c:278
[] kasan_report+0x268/0x530 mm/kasan/report.c:305
[] __asan_storeN+0x20/0x150 mm/kasan/kasan.c:718
[] memcpy+0x30/0x54 mm/kasan/kasan.c:299
[] __i2c_hid_command+0x2b0/0x7b4 drivers/hid/i2c-hid/i2c-hid.c:178
[<     inline     >] i2c_hid_set_or_send_report drivers/hid/i2c-hid/i2c-hid.c:321
[] i2c_hid_output_raw_report.isra.2+0x3d4/0x4b8 drivers/hid/i2c-hid/i2c-hid.c:589
[] i2c_hid_output_report+0x54/0x68 drivers/hid/i2c-hid/i2c-hid.c:602
[<     inline     >] hid_hw_output_report include/linux/hid.h:1039
[] hidraw_send_report+0x400/0x414 drivers/hid/hidraw.c:154
[] hidraw_write+0x40/0x64 drivers/hid/hidraw.c:177
[] vfs_write+0x1d4/0x3cc fs/read_write.c:534
[<     inline     >] SYSC_pwrite64 fs/read_write.c:627
[] SyS_pwrite64+0xec/0x144 fs/read_write.c:614
Object at ffffffc07135ea80, in cache kmalloc-512
Object allocated with size 268 bytes.

Let's check data length against the buffer size before attempting to copy
data over.

Reported-by: Alexander Potapenko 
Signed-off-by: Dmitry Torokhov 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: i2c-hid: Fill in physical device providing HID functionality

2015-09-29T10:04:28+00:00

Currently hid_connect() prints out following when I2C connected HID devices
is connected:

  hid-multitouch 0018:03EB:2136.0001: ... [ATML3432:00 03EB:2136] on

After "on " should read physical device name but it is left empty by the
driver.

Make it look better and fill in the physical device name.

Signed-off-by: Mika Westerberg 
Acked-by: Benjamin Tissoires 
Reviewed-by: Daniel Martin 
Signed-off-by: Jiri Kosina

HID: i2c-hid: Only disable irq wake if it was successfully enabled during suspend

2015-08-18T13:19:45+00:00

Enabling irq wake could potentially fail and calling disable_irq_wake
after a failed call to enable_irq_wake could result in an unbalanced irq
warning. This patch warns if enable_irq_wake fails and avoids other
potential issues caused by calling disable_irq_wake on resume after
enable_irq_wake failed during suspend.

Signed-off-by: Andrew Duggan 
Signed-off-by: Jiri Kosina

HID: i2c-hid: Call device suspend callback before disabling irq

2015-07-08T10:43:20+00:00

i2c-hid takes care of requesting and handling IRQs for HID devices
which in turns might expect them to be always active when working
in normal conditions. Hence, disabling IRQs before calling the suspend
callbacks can potentially cause problems since device drivers might
try to perform operations needing them.

Fix this by disabling IRQs only after the suspend callbacks had been
executed.

Signed-off-by: Gabriele Mazzotta 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

Merge branches 'for-4.2/i2c-hid', 'for-4.2/lenovo', 'for-4.2/plantronics', 'for-4.2/rmi', 'for-4.2/sensor-hub', 'for-4.2/sjoy', 'for-4.2/sony' and 'for-4.2/wacom' into for-linus

2015-06-22T14:23:43+00:00

Conflicts:
	drivers/hid/wacom_wac.c

Merge branches 'for-4.1/upstream-fixes', 'for-4.2/upstream' and 'for-4.2/logitech' into for-linus

2015-06-22T14:22:06+00:00

Conflicts:
	drivers/hid/hid-logitech-hidpp.c

HID: i2c-hid: Do not set the ACPI companion field in the HID device

2015-06-03T08:43:55+00:00

The HID device does not need to know about the ACPI device associated with
the underlying i2c device. Setting the ACPI companion field in the HID device
also has the side effect of causing HID to be set as wake capable, since
acpi_bind_one uses's the companion ACPI device's wakeup flags to set the
device as wake capable. Which results in power/wakeup files in sysfs for
the HID device which do not do anything.

Signed-off-by: Andrew Duggan 
Reviewed-by: Benson Leung 
Tested-by: Benson Leung 
Acked-by: Mika Westerberg 
Signed-off-by: Jiri Kosina

HID: i2c-hid: fix harmless test_bit() issue

2015-05-18T09:22:53+00:00

These defines are used like this:

	if (test_bit(I2C_HID_STARTED, &ihid->flags))

The intent was to use bits 0, 1, and 2 but because of the extra shifts
we're using bits 1, 2, and 4.  It's harmless becuase it's done
consistently but it's not the intent and static checkers will complain.

Fixes: 4a200c3b9a40 ('HID: i2c-hid: introduce HID over i2c specification implementation')
Signed-off-by: Dan Carpenter 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina