Commit 901e64db authored by Stefan Achatz's avatar Stefan Achatz Committed by Jiri Kosina
Browse files

HID: roccat: fix NULL pointer dereference, add range checks 



On rare occassions raw events can be triggered before drvdata gets set up
which leads to NULL pointer dereferences. This was only observed with pyra on
2.6.39, but is fixed for all devices now to play it save.
kovaplus returned wrong actual values when profile change was initiated from host.
Added range checks for setting actual profile on all devices.

Signed-off-by: default avatarStefan Achatz <erazor_de@users.sourceforge.net>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 1edd5b42

drivers/hid/hid-roccat-arvo.c

+4 −1
Original line number Diff line number Diff line
@@ -163,6 +163,9 @@ static ssize_t arvo_sysfs_set_actual_profile(struct device *dev, 
	if (retval)

		return retval;



	if (profile < 1 || profile > 5)

		return -EINVAL;



	temp_buf.command = ARVO_COMMAND_ACTUAL_PROFILE;

	temp_buf.actual_profile = profile;
@@ -399,7 +402,7 @@ static int arvo_raw_event(struct hid_device *hdev, 
	if (size != 3)

		return 0;



	if (arvo->roccat_claimed)

	if (arvo && arvo->roccat_claimed)

		arvo_report_to_chrdev(arvo, data);



	return 0;

drivers/hid/hid-roccat-kone.c

+3 −0
Original line number Diff line number Diff line
@@ -832,6 +832,9 @@ static int kone_raw_event(struct hid_device *hdev, struct hid_report *report, 
	if (size != sizeof(struct kone_mouse_event))

		return 0;



	if (kone == NULL)

		return 0;



	/*

	 * Firmware 1.38 introduced new behaviour for tilt and special buttons.

	 * Pressed button is reported in each movement event.

drivers/hid/hid-roccat-koneplus.c

+7 −1
Original line number Diff line number Diff line
@@ -431,6 +431,9 @@ static ssize_t koneplus_sysfs_set_actual_profile(struct device *dev, 
	if (retval)

		return retval;



	if (profile > 4)

		return -EINVAL;



	mutex_lock(&koneplus->koneplus_lock);



	retval = koneplus_set_actual_profile(usb_dev, profile);
@@ -439,7 +442,7 @@ static ssize_t koneplus_sysfs_set_actual_profile(struct device *dev, 
		return retval;

	}



	koneplus->actual_profile = profile;

	koneplus_profile_activated(koneplus, profile);



	roccat_report.type = KONEPLUS_MOUSE_REPORT_BUTTON_TYPE_PROFILE;

	roccat_report.data1 = profile + 1;
@@ -751,6 +754,9 @@ static int koneplus_raw_event(struct hid_device *hdev, 
			!= USB_INTERFACE_PROTOCOL_MOUSE)

		return 0;



	if (koneplus == NULL)

		return 0;



	koneplus_keep_values_up_to_date(koneplus, data);



	if (koneplus->roccat_claimed)

drivers/hid/hid-roccat-kovaplus.c

+4 −1
Original line number Diff line number Diff line
@@ -337,7 +337,7 @@ static ssize_t kovaplus_sysfs_set_actual_profile(struct device *dev, 


	mutex_lock(&kovaplus->kovaplus_lock);

	retval = kovaplus_set_actual_profile(usb_dev, profile);

	kovaplus->actual_profile = profile;

	kovaplus_profile_activated(kovaplus, profile);

	mutex_unlock(&kovaplus->kovaplus_lock);

	if (retval)

		return retval;
@@ -662,6 +662,9 @@ static int kovaplus_raw_event(struct hid_device *hdev, 
			!= USB_INTERFACE_PROTOCOL_MOUSE)

		return 0;



	if (kovaplus == NULL)

		return 0;



	kovaplus_keep_values_up_to_date(kovaplus, data);



	if (kovaplus->roccat_claimed)

drivers/hid/hid-roccat-pyra.c

+3 −0
Original line number Diff line number Diff line
@@ -637,6 +637,9 @@ static int pyra_raw_event(struct hid_device *hdev, struct hid_report *report, 
			!= USB_INTERFACE_PROTOCOL_MOUSE)

		return 0;



	if (pyra == NULL)

		return 0;



	pyra_keep_values_up_to_date(pyra, data);



	if (pyra->roccat_claimed)

CRA Git | Maintained and supported by SUSTech CRA and CCSE