linux-toradex.git/drivers/hid/usbhid/hiddev.c, branch v6.11

USB: make devnode() callback in usb_class_driver take a const *

2022-10-20T10:11:56+00:00

With the changes to the driver core to make more pointers const, the USB
subsystem also needs to be modified to take a const * for the devnode
callback so that the driver core's constant pointer will also be
properly propagated.

Cc: Benjamin Tissoires 
Cc: Juergen Stuber 
Reviewed-by: Johan Hovold 
Acked-by: Pete Zaitcev 
Reviewed-by: Jiri Kosina 
Link: https://lore.kernel.org/r/20221001165128.2688526-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

HID: hiddev: Return specific error codes on connect failure

2021-03-08T10:12:22+00:00

The only caller of this function only cares about gross success/failure
but we still might as well resolve the following smatch warning and fix
the other error paths as well:

    hiddev.c:894 hiddev_connect() warn: returning -1 instead of -ENOMEM is sloppy

Signed-off-by: Jason Gerecke 
Signed-off-by: Jiri Kosina

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

2020-08-25T18:13:29+00:00

Pull HID fixes from Jiri Kosina:

 - regression fix / revert of a commit that intended to reduce probing
   delay by ~50ms, but introduced a race that causes quite a few devices
   not to enumerate, or get stuck on first IRQ

 - buffer overflow fix in hiddev, from Peilin Ye

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  Revert "HID: usbhid: do not sleep when opening device"
  HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
  HID: quirks: Always poll three more Lenovo PixArt mice
  HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON commands
  HID: macally: Constify macally_id_table
  HID: cougar: Constify cougar_id_table

treewide: Use fallthrough pseudo-keyword

2020-08-23T22:36:59+00:00

Replace the existing /* fall through */ comments and its variants with
the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary
fall-through markings when it is the case.

[1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

Signed-off-by: Gustavo A. R. Silva

HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()

2020-08-17T10:21:09+00:00

`uref->usage_index` is not always being properly checked, causing
hiddev_ioctl_usage() to go out of bounds under some cases. Fix it.

Reported-by: syzbot+34ee1b45d88571c2fa8b@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=f2aebe90b8c56806b050a20b36f51ed6acabe802
Reviewed-by: Dan Carpenter 
Signed-off-by: Peilin Ye 
Signed-off-by: Jiri Kosina

HID: hiddev: Fix race in in hiddev_disconnect()

2020-02-12T13:46:56+00:00

Syzbot reports that "hiddev" is used after it's free in hiddev_disconnect().
The hiddev_disconnect() function sets "hiddev->exist = 0;" so
hiddev_release() can free it as soon as we drop the "existancelock"
lock.  This patch moves the mutex_unlock(&hiddev->existancelock) until
after we have finished using it.

Reported-by: syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com
Fixes: 7f77897ef2b6 ("HID: hiddev: fix potential use-after-free")
Suggested-by: Alan Stern 
Signed-off-by: Dan Carpenter 
Signed-off-by: Jiri Kosina

HID: hiddev: fix mess in hiddev_open()

2019-12-18T14:18:38+00:00

The open method of hiddev handler fails to bring the device out of
autosuspend state as was promised in 0361a28d3f9a, as it actually has 2
blocks that try to start the transport (call hid_hw_open()) with both
being guarded by the "open" counter, so the 2nd block is never executed as
the first block increments the counter so it is never at 0 when we check
it for the second block.

Additionally hiddev_open() was leaving counter incremented on errors,
causing the device to never be reopened properly if there was ever an
error.

Let's fix all of this by factoring out code that creates client structure
and powers up the device into a separate function that is being called
from usbhid_open() with the "existancelock" being held.

Fixes: 0361a28d3f9a ("HID: autosuspend support for USB HID")
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Benjamin Tissoires

compat_ioctl: move drivers to compat_ptr_ioctl

2019-10-23T15:23:43+00:00

Each of these drivers has a copy of the same trivial helper function to
convert the pointer argument and then call the native ioctl handler.

We now have a generic implementation of that, so use it.

Acked-by: Greg Kroah-Hartman 
Acked-by: Michael S. Tsirkin 
Acked-by: David S. Miller 
Acked-by: Jarkko Sakkinen 
Reviewed-by: Jarkko Sakkinen 
Reviewed-by: Jason Gunthorpe 
Reviewed-by: Jiri Kosina 
Reviewed-by: Stefan Hajnoczi 
Reviewed-by: Cornelia Huck 
Signed-off-by: Arnd Bergmann

Merge branch 'for-5.4/hidraw-hiddev-epoll' into for-linus

2019-09-22T20:32:23+00:00

- proper propagation of EPOLLOUT from hiddev and hidraw, from
  Fabian Henneke

Signed-off-by: Jiri Kosina

HID: hiddev: do cleanup in failure of opening a device

2019-08-06T10:42:22+00:00

Undo what we did for opening before releasing the memory slice.

Reported-by: syzbot 
Cc: Andrey Konovalov 
Signed-off-by: Hillf Danton 
Signed-off-by: Jiri Kosina