Commit 092150a2 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 

Pull HID fixes from Jiri Kosina:

 - spectrev1 pattern fix in hiddev from Gustavo A. R. Silva

 - bounds check fix for hid-debug from Daniel Rosenberg

 - regression fix for HID autobinding from Benjamin Tissoires

 - removal of excessive logging from i2c-hid driver from Jason Andryuk

 - fix specific to 2nd generation of Wacom Intuos devices from Jason
   Gerecke

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: hiddev: fix potential Spectre v1
  HID: i2c-hid: Fix "incomplete report" noise
  HID: wacom: Correct touch maximum XY of 2nd-gen Intuos
  HID: debug: check length before copy_to_user()
  HID: core: allow concurrent registration of drivers
parents bdf33113 4f65245f

drivers/hid/hid-core.c

+4 −1
Original line number Diff line number Diff line
@@ -1952,6 +1952,8 @@ static int hid_device_probe(struct device *dev) 
	}

	hdev->io_started = false;



	clear_bit(ffs(HID_STAT_REPROBED), &hdev->status);



	if (!hdev->driver) {

		id = hid_match_device(hdev, hdrv);

		if (id == NULL) {
@@ -2215,7 +2217,8 @@ static int __hid_bus_reprobe_drivers(struct device *dev, void *data) 
	struct hid_device *hdev = to_hid_device(dev);



	if (hdev->driver == hdrv &&

	    !hdrv->match(hdev, hid_ignore_special_drivers))

	    !hdrv->match(hdev, hid_ignore_special_drivers) &&

	    !test_and_set_bit(ffs(HID_STAT_REPROBED), &hdev->status))

		return device_reprobe(dev);



	return 0;

drivers/hid/hid-debug.c

+7 −1
Original line number Diff line number Diff line
@@ -1154,6 +1154,8 @@ copy_rest: 
			goto out;

		if (list->tail > list->head) {

			len = list->tail - list->head;

			if (len > count)

				len = count;



			if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) {

				ret = -EFAULT;
@@ -1163,6 +1165,8 @@ copy_rest: 
			list->head += len;

		} else {

			len = HID_DEBUG_BUFSIZE - list->head;

			if (len > count)

				len = count;



			if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) {

				ret = -EFAULT;
@@ -1170,6 +1174,8 @@ copy_rest: 
			}

			list->head = 0;

			ret += len;

			count -= len;

			if (count > 0)

				goto copy_rest;

		}

drivers/hid/i2c-hid/i2c-hid.c

+1 −1
Original line number Diff line number Diff line
@@ -484,7 +484,7 @@ static void i2c_hid_get_input(struct i2c_hid *ihid) 
		return;

	}



	if ((ret_size > size) || (ret_size <= 2)) {

	if ((ret_size > size) || (ret_size < 2)) {

		dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",

			__func__, size, ret_size);

		return;

drivers/hid/usbhid/hiddev.c

+11 −0
Original line number Diff line number Diff line
@@ -36,6 +36,7 @@ 
#include <linux/hiddev.h>

#include <linux/compat.h>

#include <linux/vmalloc.h>

#include <linux/nospec.h>

#include "usbhid.h"



#ifdef CONFIG_USB_DYNAMIC_MINORS
@@ -469,10 +470,14 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, 


		if (uref->field_index >= report->maxfield)

			goto inval;

		uref->field_index = array_index_nospec(uref->field_index,

						       report->maxfield);



		field = report->field[uref->field_index];

		if (uref->usage_index >= field->maxusage)

			goto inval;

		uref->usage_index = array_index_nospec(uref->usage_index,

						       field->maxusage);



		uref->usage_code = field->usage[uref->usage_index].hid;
@@ -499,6 +504,8 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, 


			if (uref->field_index >= report->maxfield)

				goto inval;

			uref->field_index = array_index_nospec(uref->field_index,

							       report->maxfield);



			field = report->field[uref->field_index];
@@ -753,6 +760,8 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 


		if (finfo.field_index >= report->maxfield)

			break;

		finfo.field_index = array_index_nospec(finfo.field_index,

						       report->maxfield);



		field = report->field[finfo.field_index];

		memset(&finfo, 0, sizeof(finfo));
@@ -797,6 +806,8 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 


		if (cinfo.index >= hid->maxcollection)

			break;

		cinfo.index = array_index_nospec(cinfo.index,

						 hid->maxcollection);



		cinfo.type = hid->collection[cinfo.index].type;

		cinfo.usage = hid->collection[cinfo.index].usage;

drivers/hid/wacom_wac.c

+8 −2
Original line number Diff line number Diff line
@@ -3365,9 +3365,15 @@ void wacom_setup_device_quirks(struct wacom *wacom) 
			if (features->type >= INTUOSHT && features->type <= BAMBOO_PT)

				features->device_type |= WACOM_DEVICETYPE_PAD;



			if (features->type == INTUOSHT2) {

				features->x_max = features->x_max / 10;

				features->y_max = features->y_max / 10;

			}

			else {

				features->x_max = 4096;

				features->y_max = 4096;

			}

		}

		else if (features->pktlen == WACOM_PKGLEN_BBTOUCH) {

			features->device_type |= WACOM_DEVICETYPE_PAD;

		}

CRA Git | Maintained and supported by SUSTech CRA and CCSE