kernel/git/stable/linux.git/drivers/hid/hidraw.c, branch linux-3.18.y

HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device

2018-04-24T07:29:28+00:00

commit a955358d54695e4ad9f7d6489a7ac4d69a8fc711 upstream. Doing `ioctl(HIDIOCGFEATURE)` in a tight loop on a hidraw device and then disconnecting the device, or unloading the driver, can cause a NULL pointer dereference. When a hidraw device is destroyed it sets 0 to `dev->exist`. Most functions check 'dev->exist' before doing its work, but `hidraw_get_report()` was missing that check. Cc: stable@vger.kernel.org Signed-off-by: Rodrigo Rivas Costa Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman

Merge branch 'for-3.15/hid-core-ll-transport-cleanup' into for-linus

2014-04-01T17:05:09+00:00

Conflicts: drivers/hid/hid-ids.h drivers/hid/hid-sony.c drivers/hid/i2c-hid/i2c-hid.c

HID: sony: do not rely on hid_output_raw_report

2014-03-14T14:30:20+00:00

hid_out_raw_report is going to be obsoleted as it is not part of the unified HID low level transport documentation (Documentation/hid/hid-transport.txt) To do so, we need to introduce two new quirks: * HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP: this quirks prevents the transport driver to use the interrupt channel to send output report (and thus force to use HID_REQ_SET_REPORT command) * HID_QUIRK_SKIP_OUTPUT_REPORT_ID: this one forces usbhid to not include the report ID in the buffer it sends to the device through HID_REQ_SET_REPORT in case of an output report This also fixes a regression introduced in commit 3a75b24949a8 (HID: hidraw: replace hid_output_raw_report() calls by appropriates ones). The hidraw API was not able to communicate with the PS3 SixAxis controllers in USB mode. Reviewed-by: David Herrmann Signed-off-by: Benjamin Tissoires Tested-by: Antonio Ospite Signed-off-by: Jiri Kosina

HID: hidraw: fix warning destroying hidraw device files after parent

2014-02-26T10:01:28+00:00

I noticed that after hot unplugging a Logitech unifying receiver (drivers/hid/hid-logitech-dj.c) the kernel would occasionally spew a stack trace similar to this: usb 1-1.1.2: USB disconnect, device number 7 WARNING: CPU: 0 PID: 2865 at fs/sysfs/group.c:216 device_del+0x40/0x1b0() sysfs group ffffffff8187fa20 not found for kobject 'hidraw0' [...] CPU: 0 PID: 2865 Comm: upowerd Tainted: G W 3.14.0-rc4 #7 Hardware name: LENOVO 7783PN4/ , BIOS 9HKT43AUS 07/11/2011 0000000000000009 ffffffff814cd684 ffff880427ccfdf8 ffffffff810616e7 ffff88041ec61800 ffff880427ccfe48 ffff88041e444d80 ffff880426fab8e8 ffff880429359960 ffffffff8106174c ffffffff81714b98 0000000000000028 Call Trace: [] ? dump_stack+0x41/0x51 [] ? warn_slowpath_common+0x77/0x90 [] ? warn_slowpath_fmt+0x4c/0x50 [] ? device_del+0x40/0x1b0 [] ? device_unregister+0x2f/0x50 [] ? device_destroy+0x3a/0x40 [] ? drop_ref+0x55/0x120 [hid] [] ? hidraw_release+0x96/0xb0 [hid] [] ? __fput+0xca/0x210 [] ? task_work_run+0x97/0xd0 [] ? do_notify_resume+0x69/0xa0 [] ? int_signal+0x12/0x17 ---[ end trace 63f4a46f6566d737 ]--- During device removal hid_disconnect() is called via hid_hw_stop() to stop the device and free all its resources, including the sysfs files. The problem is that if a user space process, such as upowerd, holds a reference to a hidraw file the corresponding sysfs files will be kept around (drop_ref() does not call device_destroy() if the open counter is not 0) and it will be usb_disconnect() who, by calling device_del() for the USB device, will indirectly remove the sysfs files of the hidraw device (sysfs_remove_dir() is recursive these days). Because of this, by the time user space releases the last reference to the hidraw file and drop_ref() tries to destroy the device the sysfs files are already gone and the kernel will print the warning above. Fix this by calling device_destroy() at USB disconnect time. Signed-off-by: Fernando Luis Vazquez Cao Reviewed-by: David Herrmann Cc: stable@vger.kernel.org # 3.13 Signed-off-by: Jiri Kosina

HID: hidraw: replace hid_output_raw_report() calls by appropriates ones

2014-02-24T16:23:15+00:00

Remove hid_output_raw_report() call as it is not a ll_driver callbacj, and switch to the hid_hw_* implementation. USB-HID used to fallback into SET_REPORT when there were no output interrupt endpoint, so emulating this if hid_hw_output_report() returns -ENOSYS. Reviewed-by: David Herrmann Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: introduce helper to access hid_output_raw_report()

2014-02-17T13:05:59+00:00

Add a helper to access hdev->hid_output_raw_report(). To convert the drivers, use the following snippets: for i in drivers/hid/*.c do sed -i.bak "s/[^ \t]*->hid_output_raw_report(/hid_output_raw_report(/g" $i done Then manually fix for checkpatch.pl Reviewed-by: David Herrmann Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: remove hid_get_raw_report in struct hid_device

2014-02-17T13:05:58+00:00

dev->hid_get_raw_report(X) and hid_hw_raw_request(X, HID_REQ_GET_REPORT) are strictly equivalent. Switch the hid subsystem to the hid_hw notation and remove the field .hid_get_raw_report in struct hid_device. Reviewed-by: David Herrmann Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: hidraw: make comment more accurate and nicer

2014-01-06T15:43:27+00:00

Reformat and reword some of the comments to make them more understandable. Signed-off-by: Jiri Kosina

HID: hidraw: close underlying device at removal of last reader

2013-10-02T15:02:08+00:00

Even though device exist bit is set the underlying HW device should be closed when the last reader of the device is closed i.e. open count drops to zero. Signed-off-by: Manoj Chourasia Reported-by: mika.westerberg@linux.intel.com Tested-by: mika.westerberg@linux.intel.com Signed-off-by: Jiri Kosina

Merge branch 'master' into for-3.12/upstream

2013-09-04T08:49:57+00:00

Sync with Linus' tree to be able to apply fixup patch on top of 9d9a04ee75 ("HID: apple: Add support for the 2013 Macbook Air") Signed-off-by: Jiri Kosina