linux-toradex.git/drivers/hid, branch v2.6.32.64

HID: provide a helper for validating hid reports

2014-05-19T05:53:29+00:00

commit 331415ff16a12147d57d5c953f3a961b7ede348b upstream

Many drivers need to validate the characteristics of their HID report
during initialization to avoid misusing the reports. This adds a common
helper to perform validation of the report exisitng, the field existing,
and the expected number of values within the field.

Signed-off-by: Kees Cook 
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 

[jmm: backported to 2.6.32]
[wt: dev_err() in 2.6.32 instead of hid_err()]
Signed-off-by: Willy Tarreau

HID: check for NULL field when setting values

2014-05-19T05:53:29+00:00

commit be67b68d52fa28b9b721c47bb42068f0c1214855 upstream

Defensively check that the field to be worked on is not NULL.

Signed-off-by: Kees Cook 
Cc: stable@kernel.org
Signed-off-by: Jiri Kosina 
Signed-off-by: Willy Tarreau

HID: LG: validate HID output report details

2014-05-19T05:53:28+00:00

commit 0fb6bd06e06792469acc15bbe427361b56ada528 upstream

A HID device could send a malicious output report that would cause the
lg, lg3, and lg4 HID drivers to write beyond the output report allocation
during an event, causing a heap overflow:

[  325.245240] usb 1-1: New USB device found, idVendor=046d, idProduct=c287
...
[  414.518960] BUG kmalloc-4096 (Not tainted): Redzone overwritten

Additionally, while lg2 did correctly validate the report details, it was
cleaned up and shortened.

CVE-2013-2893

Signed-off-by: Kees Cook 
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 

[jmm: backported to 2.6.32]
Signed-off-by: Willy Tarreau

HID: pantherlord: validate output report details

2014-05-19T05:53:28+00:00

commit 412f30105ec6735224535791eed5cdc02888ecb4 upstream

A HID device could send a malicious output report that would cause the
pantherlord HID driver to write beyond the output report allocation
during initialization, causing a heap overflow:

[  310.939483] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0003
...
[  315.980774] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten

CVE-2013-2892

Signed-off-by: Kees Cook 
Cc: stable@kernel.org
Signed-off-by: Jiri Kosina 
Signed-off-by: Willy Tarreau

HID: zeroplus: validate output report details

2014-05-19T05:53:27+00:00

commit 78214e81a1bf43740ce89bb5efda78eac2f8ef83 upstream

The zeroplus HID driver was not checking the size of allocated values
in fields it used. A HID device could send a malicious output report
that would cause the driver to write beyond the output report allocation
during initialization, causing a heap overflow:

[ 1442.728680] usb 1-1: New USB device found, idVendor=0c12, idProduct=0005
...
[ 1466.243173] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten

CVE-2013-2889

Signed-off-by: Kees Cook 
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
[jmm: backport to 2.6.32]
Signed-off-by: Willy Tarreau

HID: validate HID report id size

2014-05-19T05:53:27+00:00

commit 43622021d2e2b82ea03d883926605bdd0525e1d1 upstream

The "Report ID" field of a HID report is used to build indexes of
reports. The kernel's index of these is limited to 256 entries, so any
malicious device that sets a Report ID greater than 255 will trigger
memory corruption on the host:

[ 1347.156239] BUG: unable to handle kernel paging request at ffff88094958a878
[ 1347.156261] IP: [] hid_register_report+0x2a/0x8b

CVE-2013-2888

Signed-off-by: Kees Cook 
Cc: stable@kernel.org
Signed-off-by: Jiri Kosina 
[jmm: backport to 2.6.32]
Signed-off-by: Willy Tarreau

HID: bump maximum global item tag report size to 96 bytes

2012-01-25T21:53:19+00:00

commit e46e927b9b7e8d95526e69322855243882b7e1a3 upstream.

This allows the latest N-Trig devices to function properly.

BugLink: https://bugs.launchpad.net/bugs/724831

Signed-off-by: Chase Douglas 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: usbhid: Add support for SiGma Micro chip

2011-11-07T20:32:13+00:00

commit f5e4282586dc0c9dab8c7d32e6c43aa07f68586b upstream.

Patch to add SiGma Micro-based keyboards (1c4f:0002) to hid-quirks.

These keyboards dont seem to allow the records to be initialized, and hence a
timeout occurs when the usbhid driver attempts to initialize them. The patch
just adds the signature for these keyboards to the hid-quirks list with the
setting HID_QUIRK_NO_INIT_REPORTS. This removes the 5-10 second wait for the
timeout to occur.

Signed-off-by: Jeremiah Matthey 
Signed-off-by: Jiri Kosina 
Signed-off-by: Jonathan Nieder 
Signed-off-by: Greg Kroah-Hartman

HID: add MacBookAir 3,1 and 3,2 support

2011-05-09T22:55:37+00:00

commit 99b9f758bbc904f22faffcf4d83205f4a5e7bc0c upstream.

This patch add support for the MacBookAir3,1 and MacBookAir3,2 to the hid
driver.

Signed-off-by: Edgar (gimli) Hucek 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: add support for Acan FG-8100 barcode reader

2011-03-07T23:17:56+00:00

commit e8d0eab4d9eda9f5e97852f780f020bfb134f9f0 upstream.

Acan FG-8100 barcode reader (0x04b4/0xbca1) has vendor ID of
cypress and requires the same MIN/MAX swap descriptor quirk
as other barcode readers from cypress.

Reported-by: Stijn Ghesquiere 
Signed-off-by: Jiri Kosina 
Cc: maximilian attems 
Signed-off-by: Greg Kroah-Hartman