kernel.git/drivers/hid/hid-core.c, branch linux-3.16.y

HID: Fix slab-out-of-bounds read in hid_field_extract

2020-04-28T18:02:51Z

commit 8ec321e96e056de84022c032ffea253431a83c3c upstream. The syzbot fuzzer found a slab-out-of-bounds bug in the HID report handler. The bug was caused by a report descriptor which included a field with size 12 bits and count 4899, for a total size of 7349 bytes. The usbhid driver uses at most a single-page 4-KB buffer for reports. In the test there wasn't any problem about overflowing the buffer, since only one byte was received from the device. Rather, the bug occurred when the HID core tried to extract the data from the report fields, which caused it to try reading data beyond the end of the allocated buffer. This patch fixes the problem by rejecting any report whose total length exceeds the HID_MAX_BUFFER_SIZE limit (minus one byte to allow for a possible report index). In theory a device could have a report longer than that, but if there was such a thing we wouldn't handle it correctly anyway. Reported-and-tested-by: syzbot+09ef48aa58261464b621@syzkaller.appspotmail.com Signed-off-by: Alan Stern Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings

HID: sony: Support DS4 dongle

2020-01-11T02:04:40Z

commit de66a1a04c25f2560a8dca7a95e2a150b0d5e17e upstream. Add support for USB based DS4 dongle device, which allows connecting a DS4 through Bluetooth, but hides Bluetooth from the host system. Signed-off-by: Roderick Colenbrander Signed-off-by: Jiri Kosina [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings

HID: sony: Update device ids

2020-01-11T02:04:40Z

commit cf1015d65d7c8a5504a4c03afb60fb86bff0f032 upstream. Support additional DS4 model. Signed-off-by: Roderick Colenbrander Reviewed-by: Benjamin Tissoires Signed-off-by: Jiri Kosina [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings

HID: fix error message in hid_open_report()

2019-12-19T15:57:52Z

commit b3a81c777dcb093020680490ab970d85e2f6f04f upstream. On HID report descriptor parsing error the code displays bogus pointer instead of error offset (subtracts start=NULL from end). Make the message more useful by displaying correct error offset and include total buffer size for reference. This was carried over from ancient times - "Fixed" commit just promoted the message from DEBUG to ERROR. Fixes: 8c3d52fc393b ("HID: make parser more verbose about parsing errors by default") Signed-off-by: Michał Mirosław Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings

HID: core: Fix size as type u32

2018-10-21T07:44:48Z

commit 6de0b13cc0b4ba10e98a9263d7a83b940720b77a upstream. When size is negative, calling memset will make segment fault. Declare the size as type u32 to keep memset safe. size in struct hid_report is unsigned, fix return type of hid_report_len to u32. Signed-off-by: Aaron Ma Signed-off-by: Jiri Kosina [bwh: Backported to 3.16: adjust filename, context] Signed-off-by: Ben Hutchings

usb: ldusb: add PIDs for new CASSY devices supported by this driver

2018-06-16T21:22:16Z

commit 52ad2bd8918158266fc88a05f95429b56b6a33c5 upstream. This patch adds support for new CASSY devices to the ldusb driver. The PIDs are also added to the ignore list in hid-quirks. Signed-off-by: Karsten Koop Signed-off-by: Greg Kroah-Hartman [bwh: Backported to 3.16: adjust filename] Signed-off-by: Ben Hutchings

HID: microsoft: Add Surface 4 type cover pro 4 not JP versions

2017-09-15T17:30:02Z

commit 2ae3986b84e9d325bc92a1efbcf0c6b0f5016b35 upstream. Adding support for not JP versions of the Microsoft Surface 4 Type Cover Pro [jkosina@suse.cz: The identical patch has been sent by Jeff Farthing, so I am including his signoff as well] Signed-off-by: Jeff Farthing Signed-off-by: Daniel Keller Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings

HID: microsoft: Add Surface 4 type cover pro 4 (JP)

2017-09-15T17:30:02Z

commit b490a8537df60d449199e162417da74ee9262515 upstream. Adding support for the Microsoft Surface 4 Type Cover Pro (JP). Signed-off-by: Yuta Kobayashi Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings

HID: Add new Microsoft Type Cover 3 product ID

2017-09-15T17:30:00Z

commit c6956eb70e2549a3c2fa6ee525e02776d293caf4 upstream. Adds support for Microsoft Type Cover 3 with 0x07e2 product ID. Signed-off-by: Donavan Lance Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings

HID: microsoft: Add Surface 3 type cover

2017-09-15T17:29:59Z

commit 0439de75d32c249bd9f5824ffd5e40c4c2109d77 upstream. Adding support for the Microsoft Surface 3 (non-pro) Type Cover. The existing definitions and quirks are actually for the Surface Pro 3 type covers. I've renamed the old constants to reflect that they belong to the Surface Pro 3, and added a new constant and matching code for the Surface 3. Signed-off-by: Stephen Just Signed-off-by: Jiri Kosina [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings