forked from torvalds/linux
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel…
…/git/hid/hid Pull HID fixes from Jiri Kosina: - fix for race condition that could lead to NULL pointer dereferences or UAF during uhid device destruction (Jann Horn) - contact count handling regression fixes for Wacom devices (Jason Gerecke) - fix for handling unnumbered HID reports handling in Google Vivaldi driver (Dmitry Torokhov) * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: wacom: Avoid using stale array indicies to read contact count HID: wacom: Ignore the confidence flag when a touch is removed HID: wacom: Reset expected and received contact counts at the same time HID: uhid: Use READ_ONCE()/WRITE_ONCE() for ->running HID: uhid: Fix worker destroying device without any protection HID: vivaldi: Minor cleanups HID: vivaldi: fix handling devices not using numbered reports HID: Ignore battery for Elan touchscreen on HP Envy X360 15t-dr100
- Loading branch information
Showing
5 changed files
with
105 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -6,16 +6,17 @@ | |
* Author: Sean O'Brien <[email protected]> | ||
*/ | ||
|
||
#include <linux/device.h> | ||
#include <linux/hid.h> | ||
#include <linux/kernel.h> | ||
#include <linux/module.h> | ||
#include <linux/sysfs.h> | ||
|
||
#define MIN_FN_ROW_KEY 1 | ||
#define MAX_FN_ROW_KEY 24 | ||
#define HID_VD_FN_ROW_PHYSMAP 0x00000001 | ||
#define HID_USAGE_FN_ROW_PHYSMAP (HID_UP_GOOGLEVENDOR | HID_VD_FN_ROW_PHYSMAP) | ||
|
||
static struct hid_driver hid_vivaldi; | ||
|
||
struct vivaldi_data { | ||
u32 function_row_physmap[MAX_FN_ROW_KEY - MIN_FN_ROW_KEY + 1]; | ||
int max_function_row_key; | ||
|
@@ -40,7 +41,7 @@ static ssize_t function_row_physmap_show(struct device *dev, | |
return size; | ||
} | ||
|
||
DEVICE_ATTR_RO(function_row_physmap); | ||
static DEVICE_ATTR_RO(function_row_physmap); | ||
static struct attribute *sysfs_attrs[] = { | ||
&dev_attr_function_row_physmap.attr, | ||
NULL | ||
|
@@ -74,10 +75,11 @@ static void vivaldi_feature_mapping(struct hid_device *hdev, | |
struct hid_usage *usage) | ||
{ | ||
struct vivaldi_data *drvdata = hid_get_drvdata(hdev); | ||
struct hid_report *report = field->report; | ||
int fn_key; | ||
int ret; | ||
u32 report_len; | ||
u8 *buf; | ||
u8 *report_data, *buf; | ||
|
||
if (field->logical != HID_USAGE_FN_ROW_PHYSMAP || | ||
(usage->hid & HID_USAGE_PAGE) != HID_UP_ORDINAL) | ||
|
@@ -89,12 +91,24 @@ static void vivaldi_feature_mapping(struct hid_device *hdev, | |
if (fn_key > drvdata->max_function_row_key) | ||
drvdata->max_function_row_key = fn_key; | ||
|
||
buf = hid_alloc_report_buf(field->report, GFP_KERNEL); | ||
if (!buf) | ||
report_data = buf = hid_alloc_report_buf(report, GFP_KERNEL); | ||
if (!report_data) | ||
return; | ||
|
||
report_len = hid_report_len(field->report); | ||
ret = hid_hw_raw_request(hdev, field->report->id, buf, | ||
report_len = hid_report_len(report); | ||
if (!report->id) { | ||
/* | ||
* hid_hw_raw_request() will stuff report ID (which will be 0) | ||
* into the first byte of the buffer even for unnumbered | ||
* reports, so we need to account for this to avoid getting | ||
* -EOVERFLOW in return. | ||
* Note that hid_alloc_report_buf() adds 7 bytes to the size | ||
* so we can safely say that we have space for an extra byte. | ||
*/ | ||
report_len++; | ||
} | ||
|
||
ret = hid_hw_raw_request(hdev, report->id, report_data, | ||
report_len, HID_FEATURE_REPORT, | ||
HID_REQ_GET_REPORT); | ||
if (ret < 0) { | ||
|
@@ -103,7 +117,16 @@ static void vivaldi_feature_mapping(struct hid_device *hdev, | |
goto out; | ||
} | ||
|
||
ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf, | ||
if (!report->id) { | ||
/* | ||
* Undo the damage from hid_hw_raw_request() for unnumbered | ||
* reports. | ||
*/ | ||
report_data++; | ||
report_len--; | ||
} | ||
|
||
ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, report_data, | ||
report_len, 0); | ||
if (ret) { | ||
dev_warn(&hdev->dev, "failed to report feature %d\n", | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters