lkml.org 
[lkml]   [2021]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 07/74] HID: check for valid USB device for many HID drivers
    Date
    From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    commit 93020953d0fa7035fd036ad87a47ae2b7aa4ae33 upstream.

    Many HID drivers assume that the HID device assigned to them is a USB
    device as that was the only way HID devices used to be able to be
    created in Linux. However, with the additional ways that HID devices
    can be created for many different bus types, that is no longer true, so
    properly check that we have a USB device associated with the HID device
    before allowing a driver that makes this assumption to claim it.

    Cc: Jiri Kosina <jikos@kernel.org>
    Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    Cc: Michael Zaidman <michael.zaidman@gmail.com>
    Cc: Stefan Achatz <erazor_de@users.sourceforge.net>
    Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
    Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
    Cc: linux-input@vger.kernel.org
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    [bentiss: amended for thrustmater.c hunk to apply]
    Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    Link: https://lore.kernel.org/r/20211201183503.2373082-3-gregkh@linuxfoundation.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/hid/hid-chicony.c | 8 ++++++--
    drivers/hid/hid-corsair.c | 7 ++++++-
    drivers/hid/hid-elan.c | 2 +-
    drivers/hid/hid-elo.c | 3 +++
    drivers/hid/hid-holtek-kbd.c | 9 +++++++--
    drivers/hid/hid-holtek-mouse.c | 9 +++++++++
    drivers/hid/hid-lg.c | 10 ++++++++--
    drivers/hid/hid-prodikeys.c | 10 ++++++++--
    drivers/hid/hid-roccat-arvo.c | 3 +++
    drivers/hid/hid-roccat-isku.c | 3 +++
    drivers/hid/hid-roccat-kone.c | 3 +++
    drivers/hid/hid-roccat-koneplus.c | 3 +++
    drivers/hid/hid-roccat-konepure.c | 3 +++
    drivers/hid/hid-roccat-kovaplus.c | 3 +++
    drivers/hid/hid-roccat-lua.c | 3 +++
    drivers/hid/hid-roccat-pyra.c | 3 +++
    drivers/hid/hid-roccat-ryos.c | 3 +++
    drivers/hid/hid-roccat-savu.c | 3 +++
    drivers/hid/hid-samsung.c | 3 +++
    drivers/hid/hid-uclogic.c | 3 +++
    20 files changed, 84 insertions(+), 10 deletions(-)

    --- a/drivers/hid/hid-chicony.c
    +++ b/drivers/hid/hid-chicony.c
    @@ -61,8 +61,12 @@ static int ch_input_mapping(struct hid_d
    static __u8 *ch_switch12_report_fixup(struct hid_device *hdev, __u8 *rdesc,
    unsigned int *rsize)
    {
    - struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
    -
    + struct usb_interface *intf;
    +
    + if (!hid_is_usb(hdev))
    + return rdesc;
    +
    + intf = to_usb_interface(hdev->dev.parent);
    if (intf->cur_altsetting->desc.bInterfaceNumber == 1) {
    /* Change usage maximum and logical maximum from 0x7fff to
    * 0x2fff, so they don't exceed HID_MAX_USAGES */
    --- a/drivers/hid/hid-corsair.c
    +++ b/drivers/hid/hid-corsair.c
    @@ -556,7 +556,12 @@ static int corsair_probe(struct hid_devi
    int ret;
    unsigned long quirks = id->driver_data;
    struct corsair_drvdata *drvdata;
    - struct usb_interface *usbif = to_usb_interface(dev->dev.parent);
    + struct usb_interface *usbif;
    +
    + if (!hid_is_usb(dev))
    + return -EINVAL;
    +
    + usbif = to_usb_interface(dev->dev.parent);

    drvdata = devm_kzalloc(&dev->dev, sizeof(struct corsair_drvdata),
    GFP_KERNEL);
    --- a/drivers/hid/hid-elan.c
    +++ b/drivers/hid/hid-elan.c
    @@ -54,7 +54,7 @@ struct elan_drvdata {

    static int is_not_elan_touchpad(struct hid_device *hdev)
    {
    - if (hdev->bus == BUS_USB) {
    + if (hid_is_usb(hdev)) {
    struct usb_interface *intf = to_usb_interface(hdev->dev.parent);

    return (intf->altsetting->desc.bInterfaceNumber !=
    --- a/drivers/hid/hid-elo.c
    +++ b/drivers/hid/hid-elo.c
    @@ -230,6 +230,9 @@ static int elo_probe(struct hid_device *
    struct elo_priv *priv;
    int ret;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    priv = kzalloc(sizeof(*priv), GFP_KERNEL);
    if (!priv)
    return -ENOMEM;
    --- a/drivers/hid/hid-holtek-kbd.c
    +++ b/drivers/hid/hid-holtek-kbd.c
    @@ -143,12 +143,17 @@ static int holtek_kbd_input_event(struct
    static int holtek_kbd_probe(struct hid_device *hdev,
    const struct hid_device_id *id)
    {
    - struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
    - int ret = hid_parse(hdev);
    + struct usb_interface *intf;
    + int ret;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    + ret = hid_parse(hdev);
    if (!ret)
    ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);

    + intf = to_usb_interface(hdev->dev.parent);
    if (!ret && intf->cur_altsetting->desc.bInterfaceNumber == 1) {
    struct hid_input *hidinput;
    list_for_each_entry(hidinput, &hdev->inputs, list) {
    --- a/drivers/hid/hid-holtek-mouse.c
    +++ b/drivers/hid/hid-holtek-mouse.c
    @@ -65,6 +65,14 @@ static __u8 *holtek_mouse_report_fixup(s
    return rdesc;
    }

    +static int holtek_mouse_probe(struct hid_device *hdev,
    + const struct hid_device_id *id)
    +{
    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    + return 0;
    +}
    +
    static const struct hid_device_id holtek_mouse_devices[] = {
    { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
    USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067) },
    @@ -86,6 +94,7 @@ static struct hid_driver holtek_mouse_dr
    .name = "holtek_mouse",
    .id_table = holtek_mouse_devices,
    .report_fixup = holtek_mouse_report_fixup,
    + .probe = holtek_mouse_probe,
    };

    module_hid_driver(holtek_mouse_driver);
    --- a/drivers/hid/hid-lg.c
    +++ b/drivers/hid/hid-lg.c
    @@ -714,12 +714,18 @@ static int lg_raw_event(struct hid_devic

    static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id)
    {
    - struct usb_interface *iface = to_usb_interface(hdev->dev.parent);
    - __u8 iface_num = iface->cur_altsetting->desc.bInterfaceNumber;
    + struct usb_interface *iface;
    + __u8 iface_num;
    unsigned int connect_mask = HID_CONNECT_DEFAULT;
    struct lg_drv_data *drv_data;
    int ret;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    + iface = to_usb_interface(hdev->dev.parent);
    + iface_num = iface->cur_altsetting->desc.bInterfaceNumber;
    +
    /* G29 only work with the 1st interface */
    if ((hdev->product == USB_DEVICE_ID_LOGITECH_G29_WHEEL) &&
    (iface_num != 0)) {
    --- a/drivers/hid/hid-prodikeys.c
    +++ b/drivers/hid/hid-prodikeys.c
    @@ -802,12 +802,18 @@ static int pk_raw_event(struct hid_devic
    static int pk_probe(struct hid_device *hdev, const struct hid_device_id *id)
    {
    int ret;
    - struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
    - unsigned short ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
    + struct usb_interface *intf;
    + unsigned short ifnum;
    unsigned long quirks = id->driver_data;
    struct pk_device *pk;
    struct pcmidi_snd *pm = NULL;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    + intf = to_usb_interface(hdev->dev.parent);
    + ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
    +
    pk = kzalloc(sizeof(*pk), GFP_KERNEL);
    if (pk == NULL) {
    hid_err(hdev, "can't alloc descriptor\n");
    --- a/drivers/hid/hid-roccat-arvo.c
    +++ b/drivers/hid/hid-roccat-arvo.c
    @@ -347,6 +347,9 @@ static int arvo_probe(struct hid_device
    {
    int retval;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    retval = hid_parse(hdev);
    if (retval) {
    hid_err(hdev, "parse failed\n");
    --- a/drivers/hid/hid-roccat-isku.c
    +++ b/drivers/hid/hid-roccat-isku.c
    @@ -327,6 +327,9 @@ static int isku_probe(struct hid_device
    {
    int retval;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    retval = hid_parse(hdev);
    if (retval) {
    hid_err(hdev, "parse failed\n");
    --- a/drivers/hid/hid-roccat-kone.c
    +++ b/drivers/hid/hid-roccat-kone.c
    @@ -752,6 +752,9 @@ static int kone_probe(struct hid_device
    {
    int retval;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    retval = hid_parse(hdev);
    if (retval) {
    hid_err(hdev, "parse failed\n");
    --- a/drivers/hid/hid-roccat-koneplus.c
    +++ b/drivers/hid/hid-roccat-koneplus.c
    @@ -434,6 +434,9 @@ static int koneplus_probe(struct hid_dev
    {
    int retval;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    retval = hid_parse(hdev);
    if (retval) {
    hid_err(hdev, "parse failed\n");
    --- a/drivers/hid/hid-roccat-konepure.c
    +++ b/drivers/hid/hid-roccat-konepure.c
    @@ -136,6 +136,9 @@ static int konepure_probe(struct hid_dev
    {
    int retval;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    retval = hid_parse(hdev);
    if (retval) {
    hid_err(hdev, "parse failed\n");
    --- a/drivers/hid/hid-roccat-kovaplus.c
    +++ b/drivers/hid/hid-roccat-kovaplus.c
    @@ -504,6 +504,9 @@ static int kovaplus_probe(struct hid_dev
    {
    int retval;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    retval = hid_parse(hdev);
    if (retval) {
    hid_err(hdev, "parse failed\n");
    --- a/drivers/hid/hid-roccat-lua.c
    +++ b/drivers/hid/hid-roccat-lua.c
    @@ -163,6 +163,9 @@ static int lua_probe(struct hid_device *
    {
    int retval;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    retval = hid_parse(hdev);
    if (retval) {
    hid_err(hdev, "parse failed\n");
    --- a/drivers/hid/hid-roccat-pyra.c
    +++ b/drivers/hid/hid-roccat-pyra.c
    @@ -452,6 +452,9 @@ static int pyra_probe(struct hid_device
    {
    int retval;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    retval = hid_parse(hdev);
    if (retval) {
    hid_err(hdev, "parse failed\n");
    --- a/drivers/hid/hid-roccat-ryos.c
    +++ b/drivers/hid/hid-roccat-ryos.c
    @@ -144,6 +144,9 @@ static int ryos_probe(struct hid_device
    {
    int retval;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    retval = hid_parse(hdev);
    if (retval) {
    hid_err(hdev, "parse failed\n");
    --- a/drivers/hid/hid-roccat-savu.c
    +++ b/drivers/hid/hid-roccat-savu.c
    @@ -116,6 +116,9 @@ static int savu_probe(struct hid_device
    {
    int retval;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    retval = hid_parse(hdev);
    if (retval) {
    hid_err(hdev, "parse failed\n");
    --- a/drivers/hid/hid-samsung.c
    +++ b/drivers/hid/hid-samsung.c
    @@ -157,6 +157,9 @@ static int samsung_probe(struct hid_devi
    int ret;
    unsigned int cmask = HID_CONNECT_DEFAULT;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    ret = hid_parse(hdev);
    if (ret) {
    hid_err(hdev, "parse failed\n");
    --- a/drivers/hid/hid-uclogic.c
    +++ b/drivers/hid/hid-uclogic.c
    @@ -791,6 +791,9 @@ static int uclogic_tablet_enable(struct
    __u8 *p;
    s32 v;

    + if (!hid_is_usb(hdev))
    + return -EINVAL;
    +
    /*
    * Read string descriptor containing tablet parameters. The specific
    * string descriptor and data were discovered by sniffing the Windows

    \
     
     \ /
      Last update: 2021-12-13 11:10    [W:4.347 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site