kernel.git/drivers/hid/hidraw.c, branch linux-3.4.y

HID: hidraw: correctly deallocate memory on device disconnect

2014-04-14T13:44:19Z

commit 212a871a3934beccf43431608c27ed2e05a476ec upstream. This changes puts the commit 4fe9f8e203f back in place with the fixes for slab corruption because of the commit. When a device is unplugged, wait for all processes that have opened the device to close before deallocating the device. This commit was solving kernel crash because of the corruption in rb tree of vmalloc. The rootcause was the device data pointer was geting excessed after the memory associated with hidraw was freed. The commit 4fe9f8e203f was buggy as it was also freeing the hidraw first and then calling delete operation on the list associated with that hidraw leading to slab corruption. Signed-off-by: Manoj Chourasia Tested-by: Peter Wu Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings Cc: Yijing Wang Signed-off-by: Greg Kroah-Hartman

HID: hidraw: improve error handling in hidraw_init()

2014-04-14T13:44:18Z

commit bcb4a75bde3821cecb17a71d287abfd6ef9bd68d upstream. Several improvements in error handling: - do not report success if alloc_chrdev_region() failed - check for error code of cdev_add() - use unregister_chrdev_region() instead of unregister_chrdev() if class_create() failed Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings Cc: Yijing Wang Signed-off-by: Greg Kroah-Hartman

HID: hidraw: fix list->buffer memleak

2014-04-14T13:44:18Z

commit 4c7b417ecb756e85dfc955b0e7a04fd45585533e upstream. If we don't read fast enough hidraw device, hidraw_report_event will cycle and we will leak list->buffer. Also list->buffer are not free on release. After this patch, kmemleak report nothing. Signed-off-by: Matthieu CASTET Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings Cc: Yijing Wang Signed-off-by: Greg Kroah-Hartman

HID: hidraw: add proper error handling to raw event reporting

2014-04-14T13:44:18Z

commit b6787242f32700377d3da3b8d788ab3928bab849 upstream. If kmemdup() in hidraw_report_event() fails, we are not propagating this fact properly. Let hidraw_report_event() and hid_report_raw_event() return an error value to the caller. Reported-by: Oliver Neukum Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings Cc: Yijing Wang Signed-off-by: Greg Kroah-Hartman

Merge branch 'upstream' into for-linus

2011-10-25T07:59:04Z

Conflicts: drivers/hid/hid-core.c drivers/hid/hid-ids.h

HID: hidraw: open count should not increase if error

2011-09-27T16:42:22Z

In hidraw_open, if hid_hw_power returns with error, hidraw device open count should not increase. Signed-off-by: Amit Nagal Signed-off-by: Jiri Kosina

HID: hidraw: protect hidraw_disconnect() better

2011-09-20T13:23:46Z

The function hidraw_disconnect() only acquires the hidraw minors_lock when clearing the entry in hidraw_table. However the device_destroy() call can cause a userland read/write to return with an error. It may cause the program to release the file descripter before the disconnect is finished. hidraw_disconnect() has already set hidraw->exist to 0, which makes hidraw_release() kfree the hidraw structure, which hidraw_disconnect() continues to access and even tries to kfree again. Similarly if a hidraw_release() occurs after setting hidraw->exist to 0, the same thing can happen. This is fixed by expanding the mutex critical section to cover the whole function from setting hidraw->exist to 0 to freeing the hidraw structure, preventing a hidraw_release() from interfering. Signed-off-by: James Hogan Tested-by: David Herrmann Signed-off-by: Jiri Kosina

HID: hidraw: free list for all error in hidraw_open

2011-09-07T11:48:47Z

In function hidraw_open struct hidraw_list *list should be freed for all error conditions. Signed-off-by: Amit Nagal Signed-off-by: Jiri Kosina

HID: 'name' and 'phys' in 'struct hid_device' can never be NULL

2011-05-18T11:23:31Z

As they are static members of fix size, there is no need to NULL-check them. Signed-off-by: Daniel Mack Cc: Dmitry Torokhov Cc: Jiri Kosina Signed-off-by: Jiri Kosina

HID: hidraw: fix comments

2011-03-27T18:30:32Z

Adjust the comments a little bit. Signed-off-by: Jiri Kosina