kernel.git/drivers/hid/hid-picolcd.c, branch linux-3.4.y

HID: picolcd: sanity check report size in raw_event() callback

2014-09-25T03:49:15Z

commit 844817e47eef14141cf59b8d5ac08dd11c0a9189 upstream. The report passed to us from transport driver could potentially be arbitrarily large, therefore we better sanity-check it so that raw_data that we hold in picolcd_pending structure are always kept within proper bounds. Reported-by: Steven Vittitoe Signed-off-by: Jiri Kosina [lizf: Backported to 3.4: adjust filename] Signed-off-by: Zefan Li

HID: picolcd_core: validate output report details

2013-12-08T15:29:42Z

commit 1e87a2456b0227ca4ab881e19a11bb99d164e792 upstream. A HID device could send a malicious output report that would cause the picolcd HID driver to trigger a NULL dereference during attr file writing. [jkosina@suse.cz: changed report->maxfield < 1 to report->maxfield != 1 as suggested by Bruno]. CVE-2013-2899 Signed-off-by: Kees Cook Cc: stable@kernel.org Reviewed-by: Bruno Prémont Acked-by: Bruno Prémont Signed-off-by: Jiri Kosina [Kefeng: backported to stable 3.4: adjust filename] Signed-off-by: Kefeng Wang Signed-off-by: Greg Kroah-Hartman

simple_open: automatically convert to simple_open()

2012-04-05T22:25:50Z

Many users of debugfs copy the implementation of default_open() when they want to support a custom read/write function op. This leads to a proliferation of the default_open() implementation across the entire tree. Now that the common implementation has been consolidated into libfs we can replace all the users of this function with simple_open(). This replacement was done with the following semantic patch: @ open @ identifier open_f != simple_open; identifier i, f; @@ -int open_f(struct inode *i, struct file *f) -{ ( -if (i->i_private) -f->private_data = i->i_private; | -f->private_data = i->i_private; ) -return 0; -} @ has_open depends on open @ identifier fops; identifier open.open_f; @@ struct file_operations fops = { ... -.open = open_f, +.open = simple_open, ... }; [akpm@linux-foundation.org: checkpatch fixes] Signed-off-by: Stephen Boyd Cc: Greg Kroah-Hartman Cc: Al Viro Cc: Julia Lawall Acked-by: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

Merge branches 'hyperv', 'multitouch', 'roccat', 'upstream', 'upstream-fixes', 'wacom' and 'wiimote' into for-linus

2012-01-05T14:51:02Z

HID: picolcd: make fb_pending_lock and picolcd_fb_cleanup static

2011-11-22T22:25:28Z

Signed-off-by: Jiri Kosina

hid: Add module.h to fix up implicit users of it

2011-10-31T23:31:17Z

A pending cleanup will mean that module.h won't be implicitly everywhere anymore. Make sure the modular drivers in clocksource are actually calling out for explicitly in advance. Signed-off-by: Paul Gortmaker

PM / Runtime: Add macro to test for runtime PM events

2011-08-19T21:49:48Z

This patch (as1482) adds a macro for testing whether or not a pm_message value represents an autosuspend or autoresume (i.e., a runtime PM) event. Encapsulating this notion seems preferable to open-coding the test all over the place. Signed-off-by: Alan Stern Acked-by: Greg Kroah-Hartman Signed-off-by: Rafael J. Wysocki

Merge branch 'master' into upstream.

2011-05-18T15:06:49Z

This is sync with Linus' tree to receive KEY_IMAGES definition that went in through input tree.

HID: picolcd: Avoid compile warning/error triggered by copy_from_user()

2011-05-05T11:45:52Z

With CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y compilation of PicoLCD driver fails on copy_from_user(), without it a warning is generated: CC [M] drivers/hid/hid-picolcd.o In file included from /usr/src/linux-2.6/arch/x86/include/asm/uaccess.h:571, from /usr/src/linux-2.6/arch/x86/include/asm/sections.h:5, from /usr/src/linux-2.6/arch/x86/include/asm/hw_irq.h:26, from /usr/src/linux-2.6/include/linux/irq.h:359, from /usr/src/linux-2.6/arch/x86/include/asm/hardirq.h:5, from /usr/src/linux-2.6/include/linux/hardirq.h:7, from /usr/src/linux-2.6/include/linux/interrupt.h:12, from /usr/src/linux-2.6/include/linux/usb.h:15, from /usr/src/linux-2.6/drivers/hid/hid-picolcd.c:25: In function 'copy_from_user', inlined from 'picolcd_debug_eeprom_write' at drivers/hid/hid-picolcd.c:1592: arch/x86/include/asm/uaccess_32.h:212: error: call to 'copy_from_user_overflow' declared with attribute error: copy_from_user() buffer size is not provably correct gcc-4.4.5 is not able to track size calculation when it is stored into a variable, thus tell copy_from_user() maximum size via min(*max-size*, *effective-size*) explicitly and inline how much to copy at most. Signed-off-by: Bruno Prémont Signed-off-by: Jiri Kosina

Fix common misspellings

2011-03-31T14:26:23Z

Fixes generated by 'codespell' and manually reviewed. Signed-off-by: Lucas De Marchi