linux-toradex.git/drivers/hid, branch v3.2.68

HID: roccat: potential out of bounds in pyra_sysfs_write_settings()

2015-02-20T00:49:35+00:00

commit 606185b20caf4c57d7e41e5a5ea4aff460aef2ab upstream.

This is a static checker fix.  We write some binary settings to the
sysfs file.  One of the settings is the "->startup_profile".  There
isn't any checking to make sure it fits into the
pyra->profile_settings[] array in the profile_activated() function.

I added a check to pyra_sysfs_write_settings() in both places because
I wasn't positive that the other callers were correct.

Signed-off-by: Dan Carpenter 
Signed-off-by: Jiri Kosina 
[bwh: Backported to 3.2: pyra_sysfs_write_settings() doesn't define a
 settings variable, so write the cast-expression inline]
Signed-off-by: Ben Hutchings

HID: picolcd: sanity check report size in raw_event() callback

2014-09-13T22:41:47+00:00

commit 844817e47eef14141cf59b8d5ac08dd11c0a9189 upstream.

The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that raw_data
that we hold in picolcd_pending structure are always kept within proper
bounds.

Reported-by: Steven Vittitoe 
Signed-off-by: Jiri Kosina 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

HID: magicmouse: sanity check report size in raw_event() callback

2014-09-13T22:41:47+00:00

commit c54def7bd64d7c0b6993336abcffb8444795bf38 upstream.

The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that
magicmouse_emit_touch() gets only valid values of raw_id.

Reported-by: Steven Vittitoe 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

HID: logitech-dj: prevent false errors to be shown

2014-09-13T22:41:47+00:00

commit 5abfe85c1d4694d5d4bbd13ecc166262b937adf0 upstream.

Commit "HID: logitech: perform bounds checking on device_id early
enough" unfortunately leaks some errors to dmesg which are not real
ones:
- if the report is not a DJ one, then there is not point in checking
  the device_id
- the receiver (index 0) can also receive some notifications which
  can be safely ignored given the current implementation

Move out the test regarding the report_id and also discards
printing errors when the receiver got notified.

Fixes: ad3e14d7c5268c2e24477c6ef54bbdf88add5d36

Reported-and-tested-by: Markus Trippelsdorf 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

HID: fix a couple of off-by-ones

2014-09-13T22:41:46+00:00

commit 4ab25786c87eb20857bbb715c3ae34ec8fd6a214 upstream.

There are a few very theoretical off-by-one bugs in report descriptor size
checking when performing a pre-parsing fixup. Fix those.

Reported-by: Ben Hawkes 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

HID: logitech: perform bounds checking on device_id early enough

2014-09-13T22:41:46+00:00

commit ad3e14d7c5268c2e24477c6ef54bbdf88add5d36 upstream.

device_index is a char type and the size of paired_dj_deivces is 7
elements, therefore proper bounds checking has to be applied to
device_index before it is used.

We are currently performing the bounds checking in
logi_dj_recv_add_djhid_device(), which is too late, as malicious device
could send REPORT_TYPE_NOTIF_DEVICE_UNPAIRED early enough and trigger the
problem in one of the report forwarding functions called from
logi_dj_raw_event().

Fix this by performing the check at the earliest possible ocasion in
logi_dj_raw_event().

Reported-by: Ben Hawkes 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

HID: core: fix validation of report id 0

2014-07-11T12:33:35+00:00

commit 1b15d2e5b8077670b1e6a33250a0d9577efff4a5 upstream.

Some drivers use the first HID report in the list instead of using an
index. In these cases, validation uses ID 0, which was supposed to mean
"first known report". This fixes the problem, which was causing at least
the lgff family of devices to stop working since hid_validate_values
was being called with ID 0, but the devices used single numbered IDs
for their reports:

0x05, 0x01,         /*  Usage Page (Desktop),                   */
0x09, 0x05,         /*  Usage (Gamepad),                        */
0xA1, 0x01,         /*  Collection (Application),               */
0xA1, 0x02,         /*      Collection (Logical),               */
0x85, 0x01,         /*          Report ID (1),                  */
...

Reported-by: Simon Wood 
Signed-off-by: Kees Cook 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

HID: add NO_INIT_REPORTS quirk for Synaptics Touch Pad V 103S

2014-06-09T12:29:08+00:00

commit 2f433083e854ec72c19dc9b0e1cebcc8e230fd75 upstream.

This touchpad seriously dislikes init reports, not only timeing out, but
also refusing to work after this.

Reported-and-tested-by: Vincent Fortier 
Signed-off-by: Hans de Goede 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

HID: usbhid: quirk for Synaptics Quad HD touchscreen

2014-06-09T12:29:07+00:00

commit 12f508aede4bda5d20a2dd3ff3deb16ef47a97e9 upstream.

Add Synaptics HD touchscreen(06cb:1ac3) to no init report quirk

Signed-off-by: AceLan Kao 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings

HID: usbhid: quirk for Synaptics HD touchscreen

2014-06-09T12:29:07+00:00

commit d8e2e7581d2521910398c4c80d7a3b78e84da7d5 upstream.

Add Synaptics HD touchscreen(06cb:0ac3) to no init report quirk.

Signed-off-by: AceLan Kao 
Signed-off-by: Jiri Kosina 
Signed-off-by: Ben Hutchings