brain-hackers_pepepper-mirror/linux-brain
1
0
Fork 0
mirror of https://github.com/brain-hackers/linux-brain.git synced 2024-06-09 07:16:21 +09:00
Code Issues Projects Releases Wiki Activity
4.9-2.3.x-imx
linux-brain/drivers/hid
History
Vladis Dronov 64a9f5f2e4 HID: debug: fix the ring buffer implementation 
commit 13054abbaa upstream.

Ring buffer implementation in hid_debug_event() and hid_debug_events_read()
is strange allowing lost or corrupted data. After commit 717adfdaf1
("HID: debug: check length before copy_to_user()") it is possible to enter
an infinite loop in hid_debug_events_read() by providing 0 as count, this
locks up a system. Fix this by rewriting the ring buffer implementation
with kfifo and simplify the code.

This fixes CVE-2019-3819.

v2: fix an execution logic and add a comment
v3: use __set_current_state() instead of set_current_state()

Backport to v4.9: some tree-wide patches are missing in v4.9 so
cherry-pick relevant pieces from:
 * 6396bb2215 ("treewide: kzalloc() -> kcalloc()")
 * a9a08845e9 ("vfs: do bulk POLL* -> EPOLL* replacement")
 * 174cd4b1e5 ("sched/headers: Prepare to move signal wakeup & sigpending
   methods from <linux/sched.h> into <linux/sched/signal.h>")

Link: https://bugzilla.redhat.com/show_bug.cgi?id=1669187
Cc: stable@vger.kernel.org # v4.18+
Fixes: cd667ce247 ("HID: use debugfs for events/reports dumping")
Fixes: 717adfdaf1 ("HID: debug: check length before copy_to_user()")
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-15 08:07:39 +01:00
..
i2c-hid HID: i2c-hid: check if device is there before really probing 2018-08-03 07:55:21 +02:00
intel-ish-hid HID: intel_ish-hid: ipc: register more pm callbacks to support hibernation 2018-06-26 08:08:08 +08:00
usbhid HID: hiddev: fix potential Spectre v1 2018-11-13 11:16:56 -08:00
hid-a4tech.c HID: trivial devm conversion for special hid drivers 2013-07-31 10:12:28 +02:00
hid-alps.c Merge branches 'for-4.8/upstream-fixes', 'for-4.9/alps', 'for-4.9/hid-input', 'for-4.9/intel-ish', 'for-4.9/kye-uclogic-waltop-fixes', 'for-4.9/logitech', 'for-4.9/sony', 'for-4.9/upstream' and 'for-4.9/wacom' into for-linus 2016-10-07 09:59:48 +02:00
hid-apple.c HID: add support for Apple Magic Keyboards 2018-10-10 08:53:20 +02:00
hid-appleir.c HID: hid-input: allow input_configured callback return errors 2015-11-05 09:51:50 -08:00
hid-asus.c HID: asus: add support for VivoBook E200HA 2016-04-04 09:59:21 +02:00
hid-aureal.c HID: fix some indenting issues 2015-10-21 13:15:53 +02:00
hid-axff.c HID: enable Mayflash USB Gamecube Adapter 2013-11-12 19:06:23 +01:00
hid-belkin.c
hid-betopff.c HID: betop: add drivers/hid/hid-betopff.c 2014-12-22 15:00:25 +01:00
hid-cherry.c HID: fix a couple of off-by-ones 2014-08-21 10:43:28 -05:00
hid-chicony.c HID: chicony: Add support for another ASUS Zen AiO keyboard 2017-12-14 09:28:18 +01:00
hid-cmedia.c HID: Support for CMedia CM6533 HID audio jack controls 2016-03-02 10:31:36 +01:00
hid-core.c HID: quirks: fix support for Apple Magic Keyboards 2018-10-20 09:51:32 +02:00
hid-corsair.c HID: corsair: Add driver Scimitar Pro RGB gaming mouse 1b1c:1b3e support to hid-corsair 2017-12-25 14:23:37 +01:00
hid-cp2112.c HID: cp2112: fix broken gpio_direction_input callback 2017-12-20 10:07:26 +01:00
hid-cypress.c HID: hid-cypress: validate length of report 2017-01-15 13:42:56 +01:00
hid-debug.c HID: debug: fix the ring buffer implementation 2019-02-15 08:07:39 +01:00
hid-dr.c Revert "HID: dragonrise: fix HID Descriptor for 0x0006 PID" 2016-10-10 10:52:01 +02:00
hid-elecom.c HID: fix some indenting issues 2015-10-21 13:15:53 +02:00
hid-elo.c HID: elo: clear BTN_LEFT mapping 2018-03-22 09:17:53 +01:00
hid-emsff.c
hid-ezkey.c
hid-gaff.c
hid-gembird.c HID: gembird: add new driver to fix Gembird JPD-DualForce 2 2015-08-18 15:03:43 +02:00
hid-generic.c
hid-gfrm.c HID: hid-gfrm: avoid warning for input_configured API change 2015-11-05 10:15:35 -08:00
hid-gt683r.c HID: use to_hid_device() 2015-12-28 13:41:44 +01:00
hid-gyration.c
hid-holtek-kbd.c
hid-holtek-mouse.c HID: Add Holtek USB ID 04d9:a0c2 ETEKCITY Scroll 2014-09-08 09:48:56 +02:00
hid-holtekff.c HID: hid-holtekff: don't push static constants on stack for %*ph 2013-08-05 11:29:57 +02:00
hid-hyperv.c HID: hyperv: match wait_for_completion_timeout return type 2015-01-26 14:25:41 +01:00
hid-icade.c
hid-ids.h HID: input: Ignore battery reported by Symbol DS4308 2018-12-13 09:20:25 +01:00
hid-input.c HID: input: Ignore battery reported by Symbol DS4308 2018-12-13 09:20:25 +01:00
hid-kensington.c
hid-keytouch.c
hid-kye.c HID: kye: Fix MousePen i608X v2 report descriptor 2016-09-19 14:32:22 +02:00
hid-lcpower.c
hid-led.c HID: hid-led: fix issue with transfer buffer not being dma capable 2016-10-10 10:47:03 +02:00
hid-lenovo.c HID: lenovo: Add checks to fix of_led_classdev_register 2019-02-12 19:44:59 +01:00
hid-lg.c HID: hid-lg: Fix immediate disconnection of Logitech Rumblepad 2 2017-02-09 08:08:29 +01:00
hid-lg.h HID: hid-lg4ff: Introduce a module parameter to disable automatic switch of compatibility mode 2015-02-18 21:14:54 +01:00
hid-lg2ff.c HID: logitech - lg2ff: Add IDs for Formula Vibration Feedback Wheel 2013-10-09 12:06:02 +02:00
hid-lg3ff.c HID: LG: validate HID output report details 2013-09-13 15:12:39 +02:00
hid-lg4ff.c HID: hid-logitech: Improve Wingman Formula Force GP support 2016-09-26 15:39:56 +02:00
hid-lg4ff.h HID: hid-logitech: Add combined pedal support Logitech wheels 2016-09-26 15:39:54 +02:00
hid-lgff.c HID: LG: validate HID output report details 2013-09-13 15:12:39 +02:00
hid-logitech-dj.c HID: logitech-dj: check report length 2014-12-17 08:50:12 +01:00
hid-logitech-hidpp.c HID: logitech-hidpp: limit visibility of init/deinit functions 2016-01-28 14:28:39 +01:00
hid-magicmouse.c HID: magicmouse: make transfer buffers DMA capable 2016-11-23 17:43:25 +01:00
hid-microsoft.c HID: multitouch: enable the Surface 3 Type Cover to report multitouch data 2017-04-12 12:41:16 +02:00
hid-monterey.c HID: fix a couple of off-by-ones 2014-08-21 10:43:28 -05:00
hid-multitouch.c HID: Fix hid_report_len usage 2018-04-24 09:34:11 +02:00
hid-ntrig.c HID: hid-ntrig: add error handling for sysfs_create_group 2018-10-03 17:01:47 -07:00
hid-ortek.c
hid-penmount.c HID: penmount: report only one button for PenMount 6000 USB touchscreen controller 2016-03-10 17:17:26 +01:00
hid-petalynx.c HID: fix a couple of off-by-ones 2014-08-21 10:43:28 -05:00
hid-picolcd_backlight.c HID: picoLCD: Deletion of unnecessary checks before three function calls 2015-06-29 14:51:12 +02:00
hid-picolcd_cir.c HID: picoLCD: Deletion of unnecessary checks before three function calls 2015-06-29 14:51:12 +02:00
hid-picolcd_core.c HID: picolcd: be more verbose when reporting report size error 2014-08-27 23:27:10 +02:00
hid-picolcd_debugfs.c HID: picolcd: remove unnecessary NULL test before debugfs_remove 2014-06-30 09:54:22 +02:00
hid-picolcd_fb.c drivers/hid/hid-picolcd_fb: avoid world-writable sysfs files. 2014-05-14 10:53:56 +09:30
hid-picolcd_lcd.c HID: picoLCD: Deletion of unnecessary checks before three function calls 2015-06-29 14:51:12 +02:00
hid-picolcd_leds.c HID: use to_hid_device() 2015-12-28 13:41:44 +01:00
hid-picolcd.h
hid-pl.c HID: pantherlord: validate output report details 2013-09-04 11:58:32 +02:00
hid-plantronics.c HID: hid-plantronics: Re-resend Update to map button for PTT products 2018-08-03 07:55:21 +02:00
hid-primax.c
hid-prodikeys.c HID: use to_hid_device() 2015-12-28 13:41:44 +01:00
hid-rmi.c HID: Fix hid_report_len usage 2018-04-24 09:34:11 +02:00
hid-roccat-arvo.c HID: use kobj_to_dev() 2015-12-28 13:41:51 +01:00
hid-roccat-arvo.h
hid-roccat-common.c HID: use kobj_to_dev() 2015-12-28 13:41:51 +01:00
hid-roccat-common.h HID: roccat: generalize some common code 2013-10-30 14:17:31 +01:00
hid-roccat-isku.c HID: use kobj_to_dev() 2015-12-28 13:41:51 +01:00
hid-roccat-isku.h
hid-roccat-kone.c HID: use kobj_to_dev() 2015-12-28 13:41:51 +01:00
hid-roccat-kone.h
hid-roccat-koneplus.c HID: use kobj_to_dev() 2015-12-28 13:41:51 +01:00
hid-roccat-koneplus.h
hid-roccat-konepure.c HID: roccat: generalize some common code 2013-10-30 14:17:31 +01:00
hid-roccat-kovaplus.c HID: roccat: prevent an out of bounds read in kovaplus_profile_activated() 2018-05-30 07:50:21 +02:00
hid-roccat-kovaplus.h
hid-roccat-lua.c HID: use kobj_to_dev() 2015-12-28 13:41:51 +01:00
hid-roccat-lua.h
hid-roccat-pyra.c HID: use kobj_to_dev() 2015-12-28 13:41:51 +01:00
hid-roccat-pyra.h
hid-roccat-ryos.c HID: roccat: add support for Ryos MK keyboards 2013-10-30 14:17:31 +01:00
hid-roccat-savu.c HID: roccat: generalize some common code 2013-10-30 14:17:31 +01:00
hid-roccat-savu.h HID: roccat: generalize some common code 2013-10-30 14:17:31 +01:00
hid-roccat.c HID: roccat: silence an uninitialized variable warning 2016-04-04 09:49:12 +02:00
hid-saitek.c HID: hid-saitek: Add device ID for RAT 7 Contagion 2018-10-10 08:53:20 +02:00
hid-samsung.c
hid-sensor-custom.c HID: sensor: fix attributes in HID sensor interface 2016-11-05 16:56:09 +01:00
hid-sensor-hub.c HID: sensor-hub: add quirk for Microchip MM7150 2017-04-12 12:41:16 +02:00
hid-sjoy.c HID: sjoy: support Super Joy Box 4 2015-05-07 10:47:53 +02:00
hid-sony.c HID: sony: Support DS4 dongle 2018-09-29 03:07:35 -07:00
hid-speedlink.c HID: Fix Speedlink VAD Cezanne support for some devices 2013-08-26 13:51:10 +02:00
hid-steelseries.c HID: use to_hid_device() 2015-12-28 13:41:44 +01:00
hid-sunplus.c HID: fix a couple of off-by-ones 2014-08-21 10:43:28 -05:00
hid-tivo.c HID: tivo: enable all buttons on the TiVo Slide Pro remote 2015-03-15 10:04:27 -04:00
hid-tmff.c
hid-topseed.c
hid-twinhan.c
hid-uclogic.c HID: uclogic: Add support for UC-Logic TWHA60 v3 2016-09-19 14:32:24 +02:00
hid-waltop.c HID: Remove broken links to tablet descriptions 2016-09-19 14:32:21 +02:00
hid-wiimote-core.c HID: wiimote: replace hid_output_raw_report with hid_hw_output_report for output requests 2014-02-17 14:57:17 +01:00
hid-wiimote-debug.c HID: wiimote: fix DRM debug-attr to correctly parse input 2013-06-03 11:07:06 +02:00
hid-wiimote-modules.c HID: wiimote: Fix wiimote mp scale linearization 2016-03-18 17:31:38 +01:00
hid-wiimote.h HID: use to_hid_device() 2015-12-28 13:41:44 +01:00
hid-xinmo.c HID: xinmo: fix for out of range for THT 2P arcade controller. 2017-12-25 14:23:40 +01:00
hid-zpff.c HID: zeroplus: validate output report details 2013-09-13 15:11:34 +02:00
hid-zydacron.c HID: trivial devm conversion for special hid drivers 2013-07-31 10:12:28 +02:00
hidraw.c HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device 2018-04-24 09:34:16 +02:00
Kconfig HID: corsair: Add driver Scimitar Pro RGB gaming mouse 1b1c:1b3e support to hid-corsair 2017-12-25 14:23:37 +01:00
Makefile HID: intel_ish-hid: ISH Transport layer 2016-08-17 11:13:07 +02:00
uhid.c HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges 2018-11-27 16:09:42 +01:00
wacom_sys.c HID: Fix hid_report_len usage 2018-04-24 09:34:11 +02:00
wacom_wac.c HID: wacom: Correct touch maximum XY of 2nd-gen Intuos 2018-08-24 13:12:35 +02:00
wacom_wac.h Merge branches 'for-4.8/upstream-fixes', 'for-4.9/alps', 'for-4.9/hid-input', 'for-4.9/intel-ish', 'for-4.9/kye-uclogic-waltop-fixes', 'for-4.9/logitech', 'for-4.9/sony', 'for-4.9/upstream' and 'for-4.9/wacom' into for-linus 2016-10-07 09:59:48 +02:00
wacom.h HID: wacom: power_supply: provide the actual model_name 2016-08-05 13:39:23 +02:00