linux/drivers/hid, branch v5.15

HID: amd_sfh: Fix potential NULL pointer dereference

2021-09-27T08:00:43Z

The cl_data field of a privdata must be allocated and updated before using in amd_sfh_hid_client_init() function. Hence handling NULL pointer cl_data accordingly. Fixes: d46ef750ed58 ("HID: amd_sfh: Fix potential NULL pointer dereference") Signed-off-by: Basavaraj Natikar Signed-off-by: Jiri Kosina

HID: u2fzero: ignore incomplete packets without data

2021-09-22T07:31:18Z

Since the actual_length calculation is performed unsigned, packets shorter than 7 bytes (e.g. packets without data or otherwise truncated) or non-received packets ("zero" bytes) can cause buffer overflow. Link: https://bugzilla.kernel.org/show_bug.cgi?id=214437 Fixes: 42337b9d4d958("HID: add driver for U2F Zero built-in LED and RNG") Signed-off-by: Andrej Shadura Signed-off-by: Jiri Kosina

HID: amd_sfh: Fix potential NULL pointer dereference

2021-09-16T07:14:33Z

devm_add_action_or_reset() can suddenly invoke amd_mp2_pci_remove() at registration that will cause NULL pointer dereference since corresponding data is not initialized yet. The patch moves initialization of data before devm_add_action_or_reset(). Found by Linux Driver Verification project (linuxtesting.org). [jkosina@suse.cz: rebase] Signed-off-by: Evgeny Novikov Acked-by: Basavaraj Natikar Signed-off-by: Jiri Kosina

HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs

2021-09-15T15:20:15Z

Add the new PIDs to wacom_wac.c to support the new models in the Intuos series. [jkosina@suse.cz: fix changelog] Signed-off-by: Joshua Dickens Reviewed-by: Ping Cheng Signed-off-by: Jiri Kosina

HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS

2021-09-15T14:44:10Z

Apple Magic Keyboard(JIS)'s Logical Maximum and Usage Maximum are wrong. Below is a report descriptor. 0x05, 0x01, /* Usage Page (Desktop), */ 0x09, 0x06, /* Usage (Keyboard), */ 0xA1, 0x01, /* Collection (Application), */ 0x85, 0x01, /* Report ID (1), */ 0x05, 0x07, /* Usage Page (Keyboard), */ 0x15, 0x00, /* Logical Minimum (0), */ 0x25, 0x01, /* Logical Maximum (1), */ 0x19, 0xE0, /* Usage Minimum (KB Leftcontrol), */ 0x29, 0xE7, /* Usage Maximum (KB Right GUI), */ 0x75, 0x01, /* Report Size (1), */ 0x95, 0x08, /* Report Count (8), */ 0x81, 0x02, /* Input (Variable), */ 0x95, 0x05, /* Report Count (5), */ 0x75, 0x01, /* Report Size (1), */ 0x05, 0x08, /* Usage Page (LED), */ 0x19, 0x01, /* Usage Minimum (01h), */ 0x29, 0x05, /* Usage Maximum (05h), */ 0x91, 0x02, /* Output (Variable), */ 0x95, 0x01, /* Report Count (1), */ 0x75, 0x03, /* Report Size (3), */ 0x91, 0x03, /* Output (Constant, Variable), */ 0x95, 0x08, /* Report Count (8), */ 0x75, 0x01, /* Report Size (1), */ 0x15, 0x00, /* Logical Minimum (0), */ 0x25, 0x01, /* Logical Maximum (1), */ here is a report descriptor which is parsed one in kernel. see sys/kernel/debug/hid//rdesc 05 01 09 06 a1 01 85 01 05 07 15 00 25 01 19 e0 29 e7 75 01 95 08 81 02 95 05 75 01 05 08 19 01 29 05 91 02 95 01 75 03 91 03 95 08 75 01 15 00 25 01 06 00 ff 09 03 81 03 95 06 75 08 15 00 25 [65] 05 07 19 00 29 [65] 81 00 95 01 75 01 15 00 25 01 05 0c 09 b8 81 02 95 01 75 01 06 01 ff 09 03 81 02 95 01 75 06 81 03 06 02 ff 09 55 85 55 15 00 26 ff 00 75 08 95 40 b1 a2 c0 06 00 ff 09 14 a1 01 85 90 05 84 75 01 95 03 15 00 25 01 09 61 05 85 09 44 09 46 81 02 95 05 81 01 75 08 95 01 15 00 26 ff 00 09 65 81 02 c0 00 Position 64(Logical Maximum) and 70(Usage Maximum) are 101. Both should be 0xE7 to support JIS specific keys(ろ, Eisu, Kana, |) support. position 117 is also 101 but not related(it is Usage 65h). There are no difference of product id between JIS and ANSI. They are same 0x0267. Signed-off-by: Mizuho Mori Signed-off-by: Jiri Kosina

HID: betop: fix slab-out-of-bounds Write in betop_probe

2021-09-15T14:31:21Z

Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver. The problem is the driver assumes the device must have an input report but some malicious devices violate this assumption. So this patch checks hid_device's input is non empty before it's been used. Reported-by: syzbot+07efed3bc5a1407bd742@syzkaller.appspotmail.com Signed-off-by: F.A. SULAIMAN Reviewed-by: Pavel Skripkin Signed-off-by: Jiri Kosina

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

2021-09-02T21:30:46Z

Pull HID updates from Jiri Kosina: - Fix in i2c-hid driver for Elan touchpad quirk regression (Jim Broadus) - Quirk preventing ASUS Claymore from accidentally suspending whole system (Luke D. Jones) - Updates to the existing FW reporting mechanism, MP2 FW status checks, adding proper power management support for amd-sfh (Basavaraj Natikar) - Regression fix for an issue in HID core that got uncovered by recent USB core cleanup leading to issues when transfer_buffer_length is not in line with wLength (Alan Stern) - Memory leak fix in USB HID core (Anirudh Rayabharam) - Improvement of stylus battery reporting (Dmitry Torokhov) - Power management improvement for Goodix driver (Douglas Anderson) - High-resolution scroll support for Magicmouse devices (José Expósito) - Support for GHLive PS4 dongles (Daniel Nguyen) - Support proper EV_MSC emissions to hid-apple (Vincent Lefevre) * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (31 commits) HID: usbhid: Simplify code in hid_submit_ctrl() HID: usbhid: Fix warning caused by 0-length input reports HID: usbhid: Fix flood of "control queue full" messages HID: sony: Fix more ShanWan clone gamepads to not rumble when plugged in. HID: sony: support for the ghlive ps4 dongles HID: thrustmaster: clean up Makefile and adapt quirks HID: i2c-hid: Fix Elan touchpad regression HID: asus: Prevent Claymore sending suspend event HID: amd_sfh: Add dyndbg prints for debugging HID: amd_sfh: Add support for PM suspend and resume HID: amd_sfh: Move hid probe after sensor is enabled HID: amd_sfh: Add command response to check command status HID: amd_sfh: Fix period data field to enable sensor HID: logitech-hidpp: battery: provide CAPACITY property for newer devices HID: thrustmaster: Fix memory leak in thrustmaster_interrupts() HID: thrustmaster: Fix memory leak in remove HID: thrustmaster: Fix memory leaks in probe HID: elo: update the reference count of the usb device structure HID: logitech-hidpp: Use 'atomic_inc_return' instead of hand-writing it HID: apple: Add missing scan code event for keys handled by hid-apple ...

Merge branch 'for-5.15/apple' into for-linus

2021-09-01T20:11:24Z

- Support proper EV_MSC emissions to hid-apple (Vincent Lefevre)

Merge branch 'for-5.15/wacom' into for-linus

2021-09-01T20:04:50Z

Merge branch 'for-5.15/thrustmaster' into for-linus

2021-09-01T20:04:05Z

- Fixes for memory leaks