From: Greg Kroah-Hartman Date: Thu, 9 Dec 2021 21:16:51 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.4.295~73 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7d445054a2bf7e548fe118e998993372b75c8a93;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: hid-check-for-valid-usb-device-for-many-hid-drivers.patch --- diff --git a/queue-4.9/hid-check-for-valid-usb-device-for-many-hid-drivers.patch b/queue-4.9/hid-check-for-valid-usb-device-for-many-hid-drivers.patch new file mode 100644 index 00000000000..c58f03798d9 --- /dev/null +++ b/queue-4.9/hid-check-for-valid-usb-device-for-many-hid-drivers.patch @@ -0,0 +1,334 @@ +From 93020953d0fa7035fd036ad87a47ae2b7aa4ae33 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Wed, 1 Dec 2021 19:35:03 +0100 +Subject: HID: check for valid USB device for many HID drivers + +From: Greg Kroah-Hartman + +commit 93020953d0fa7035fd036ad87a47ae2b7aa4ae33 upstream. + +Many HID drivers assume that the HID device assigned to them is a USB +device as that was the only way HID devices used to be able to be +created in Linux. However, with the additional ways that HID devices +can be created for many different bus types, that is no longer true, so +properly check that we have a USB device associated with the HID device +before allowing a driver that makes this assumption to claim it. + +Cc: Jiri Kosina +Cc: Benjamin Tissoires +Cc: Michael Zaidman +Cc: Stefan Achatz +Cc: Maxime Coquelin +Cc: Alexandre Torgue +Cc: linux-input@vger.kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +Tested-by: Benjamin Tissoires +[bentiss: amended for thrustmater.c hunk to apply] +Signed-off-by: Benjamin Tissoires +Link: https://lore.kernel.org/r/20211201183503.2373082-3-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-chicony.c | 8 ++++++-- + drivers/hid/hid-corsair.c | 7 ++++++- + drivers/hid/hid-elo.c | 3 +++ + drivers/hid/hid-holtek-kbd.c | 9 +++++++-- + drivers/hid/hid-holtek-mouse.c | 9 +++++++++ + drivers/hid/hid-lg.c | 10 ++++++++-- + drivers/hid/hid-prodikeys.c | 10 ++++++++-- + drivers/hid/hid-roccat-arvo.c | 3 +++ + drivers/hid/hid-roccat-isku.c | 3 +++ + drivers/hid/hid-roccat-kone.c | 3 +++ + drivers/hid/hid-roccat-koneplus.c | 3 +++ + drivers/hid/hid-roccat-konepure.c | 3 +++ + drivers/hid/hid-roccat-kovaplus.c | 3 +++ + drivers/hid/hid-roccat-lua.c | 3 +++ + drivers/hid/hid-roccat-pyra.c | 3 +++ + drivers/hid/hid-roccat-ryos.c | 3 +++ + drivers/hid/hid-roccat-savu.c | 3 +++ + drivers/hid/hid-samsung.c | 3 +++ + drivers/hid/hid-uclogic.c | 3 +++ + 19 files changed, 83 insertions(+), 9 deletions(-) + +--- a/drivers/hid/hid-chicony.c ++++ b/drivers/hid/hid-chicony.c +@@ -61,8 +61,12 @@ static int ch_input_mapping(struct hid_d + static __u8 *ch_switch12_report_fixup(struct hid_device *hdev, __u8 *rdesc, + unsigned int *rsize) + { +- struct usb_interface *intf = to_usb_interface(hdev->dev.parent); +- ++ struct usb_interface *intf; ++ ++ if (!hid_is_usb(hdev)) ++ return rdesc; ++ ++ intf = to_usb_interface(hdev->dev.parent); + if (intf->cur_altsetting->desc.bInterfaceNumber == 1) { + /* Change usage maximum and logical maximum from 0x7fff to + * 0x2fff, so they don't exceed HID_MAX_USAGES */ +--- a/drivers/hid/hid-corsair.c ++++ b/drivers/hid/hid-corsair.c +@@ -553,7 +553,12 @@ static int corsair_probe(struct hid_devi + int ret; + unsigned long quirks = id->driver_data; + struct corsair_drvdata *drvdata; +- struct usb_interface *usbif = to_usb_interface(dev->dev.parent); ++ struct usb_interface *usbif; ++ ++ if (!hid_is_usb(dev)) ++ return -EINVAL; ++ ++ usbif = to_usb_interface(dev->dev.parent); + + drvdata = devm_kzalloc(&dev->dev, sizeof(struct corsair_drvdata), + GFP_KERNEL); +--- a/drivers/hid/hid-elo.c ++++ b/drivers/hid/hid-elo.c +@@ -230,6 +230,9 @@ static int elo_probe(struct hid_device * + struct elo_priv *priv; + int ret; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + priv = kzalloc(sizeof(*priv), GFP_KERNEL); + if (!priv) + return -ENOMEM; +--- a/drivers/hid/hid-holtek-kbd.c ++++ b/drivers/hid/hid-holtek-kbd.c +@@ -143,12 +143,17 @@ static int holtek_kbd_input_event(struct + static int holtek_kbd_probe(struct hid_device *hdev, + const struct hid_device_id *id) + { +- struct usb_interface *intf = to_usb_interface(hdev->dev.parent); +- int ret = hid_parse(hdev); ++ struct usb_interface *intf; ++ int ret; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ ++ ret = hid_parse(hdev); + if (!ret) + ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); + ++ intf = to_usb_interface(hdev->dev.parent); + if (!ret && intf->cur_altsetting->desc.bInterfaceNumber == 1) { + struct hid_input *hidinput; + list_for_each_entry(hidinput, &hdev->inputs, list) { +--- a/drivers/hid/hid-holtek-mouse.c ++++ b/drivers/hid/hid-holtek-mouse.c +@@ -65,6 +65,14 @@ static __u8 *holtek_mouse_report_fixup(s + return rdesc; + } + ++static int holtek_mouse_probe(struct hid_device *hdev, ++ const struct hid_device_id *id) ++{ ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ return 0; ++} ++ + static const struct hid_device_id holtek_mouse_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, + USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067) }, +@@ -86,6 +94,7 @@ static struct hid_driver holtek_mouse_dr + .name = "holtek_mouse", + .id_table = holtek_mouse_devices, + .report_fixup = holtek_mouse_report_fixup, ++ .probe = holtek_mouse_probe, + }; + + module_hid_driver(holtek_mouse_driver); +--- a/drivers/hid/hid-lg.c ++++ b/drivers/hid/hid-lg.c +@@ -714,12 +714,18 @@ static int lg_raw_event(struct hid_devic + + static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id) + { +- struct usb_interface *iface = to_usb_interface(hdev->dev.parent); +- __u8 iface_num = iface->cur_altsetting->desc.bInterfaceNumber; ++ struct usb_interface *iface; ++ __u8 iface_num; + unsigned int connect_mask = HID_CONNECT_DEFAULT; + struct lg_drv_data *drv_data; + int ret; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ ++ iface = to_usb_interface(hdev->dev.parent); ++ iface_num = iface->cur_altsetting->desc.bInterfaceNumber; ++ + /* G29 only work with the 1st interface */ + if ((hdev->product == USB_DEVICE_ID_LOGITECH_G29_WHEEL) && + (iface_num != 0)) { +--- a/drivers/hid/hid-prodikeys.c ++++ b/drivers/hid/hid-prodikeys.c +@@ -803,12 +803,18 @@ static int pk_raw_event(struct hid_devic + static int pk_probe(struct hid_device *hdev, const struct hid_device_id *id) + { + int ret; +- struct usb_interface *intf = to_usb_interface(hdev->dev.parent); +- unsigned short ifnum = intf->cur_altsetting->desc.bInterfaceNumber; ++ struct usb_interface *intf; ++ unsigned short ifnum; + unsigned long quirks = id->driver_data; + struct pk_device *pk; + struct pcmidi_snd *pm = NULL; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ ++ intf = to_usb_interface(hdev->dev.parent); ++ ifnum = intf->cur_altsetting->desc.bInterfaceNumber; ++ + pk = kzalloc(sizeof(*pk), GFP_KERNEL); + if (pk == NULL) { + hid_err(hdev, "can't alloc descriptor\n"); +--- a/drivers/hid/hid-roccat-arvo.c ++++ b/drivers/hid/hid-roccat-arvo.c +@@ -347,6 +347,9 @@ static int arvo_probe(struct hid_device + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +--- a/drivers/hid/hid-roccat-isku.c ++++ b/drivers/hid/hid-roccat-isku.c +@@ -327,6 +327,9 @@ static int isku_probe(struct hid_device + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +--- a/drivers/hid/hid-roccat-kone.c ++++ b/drivers/hid/hid-roccat-kone.c +@@ -752,6 +752,9 @@ static int kone_probe(struct hid_device + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +--- a/drivers/hid/hid-roccat-koneplus.c ++++ b/drivers/hid/hid-roccat-koneplus.c +@@ -434,6 +434,9 @@ static int koneplus_probe(struct hid_dev + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +--- a/drivers/hid/hid-roccat-konepure.c ++++ b/drivers/hid/hid-roccat-konepure.c +@@ -136,6 +136,9 @@ static int konepure_probe(struct hid_dev + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +--- a/drivers/hid/hid-roccat-kovaplus.c ++++ b/drivers/hid/hid-roccat-kovaplus.c +@@ -504,6 +504,9 @@ static int kovaplus_probe(struct hid_dev + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +--- a/drivers/hid/hid-roccat-lua.c ++++ b/drivers/hid/hid-roccat-lua.c +@@ -163,6 +163,9 @@ static int lua_probe(struct hid_device * + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +--- a/drivers/hid/hid-roccat-pyra.c ++++ b/drivers/hid/hid-roccat-pyra.c +@@ -452,6 +452,9 @@ static int pyra_probe(struct hid_device + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +--- a/drivers/hid/hid-roccat-ryos.c ++++ b/drivers/hid/hid-roccat-ryos.c +@@ -144,6 +144,9 @@ static int ryos_probe(struct hid_device + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +--- a/drivers/hid/hid-roccat-savu.c ++++ b/drivers/hid/hid-roccat-savu.c +@@ -116,6 +116,9 @@ static int savu_probe(struct hid_device + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +--- a/drivers/hid/hid-samsung.c ++++ b/drivers/hid/hid-samsung.c +@@ -157,6 +157,9 @@ static int samsung_probe(struct hid_devi + int ret; + unsigned int cmask = HID_CONNECT_DEFAULT; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + ret = hid_parse(hdev); + if (ret) { + hid_err(hdev, "parse failed\n"); +--- a/drivers/hid/hid-uclogic.c ++++ b/drivers/hid/hid-uclogic.c +@@ -791,6 +791,9 @@ static int uclogic_tablet_enable(struct + __u8 *p; + s32 v; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + /* + * Read string descriptor containing tablet parameters. The specific + * string descriptor and data were discovered by sniffing the Windows diff --git a/queue-4.9/series b/queue-4.9/series index b2a9de7d640..33eeaee0815 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -4,3 +4,4 @@ hid-add-usb_hid-dependancy-to-hid-prodikeys.patch hid-add-usb_hid-dependancy-to-hid-chicony.patch hid-add-usb_hid-dependancy-on-some-usb-hid-drivers.patch hid-wacom-fix-problems-when-device-is-not-a-valid-usb-device.patch +hid-check-for-valid-usb-device-for-many-hid-drivers.patch