| 0fb6bd06e06792469acc15bbe427361b56ada528 |
|
11-Sep-2013 |
Kees Cook <keescook@chromium.org> |
HID: LG: validate HID output report details
A HID device could send a malicious output report that would cause the
lg, lg3, and lg4 HID drivers to write beyond the output report allocation
during an event, causing a heap overflow:
[ 325.245240] usb 1-1: New USB device found, idVendor=046d, idProduct=c287
...
[ 414.518960] BUG kmalloc-4096 (Not tainted): Redzone overwritten
Additionally, while lg2 did correctly validate the report details, it was
cleaned up and shortened.
CVE-2013-2893
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
| d881427253da011495f4193663d809d0e9dfa215 |
|
25-Feb-2013 |
Benjamin Tissoires <benjamin.tissoires@gmail.com> |
HID: use hid_hw_request() instead of direct call to usbhid
This allows the hid drivers to be independent from the transport layer.
The patch was constructed by replacing all occurences of
usbhid_submit_report() by its hid_hw_request() counterpart.
Then, drivers not requiring USB_HID anymore have their USB_HID
dependency cleaned in the Kconfig file.
Finally, few drivers still depends on USB_HID. Many of them
are requiring the io wait callback. They are found in the next patch.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
For the sensor-hub part:
Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
| 4291ee305e9bb0699504a66f0e2b7aefcf0512a5 |
|
10-Dec-2010 |
Joe Perches <joe@perches.com> |
HID: Add and use hid_<level>: dev_<level> equivalents
Neaten current uses of dev_<level> by adding and using
hid specific hid_<level> macros.
Convert existing uses of dev_<level> uses to hid_<level>.
Convert hid-pidff printk uses to hid_<level>.
Remove err_hid and use hid_err instead.
Add missing newlines to logging messages where necessary.
Coalesce format strings.
Add and use pr_fmt(fmt) KBUILD_MODNAME ": " fmt
Other miscellaneous changes:
Add const struct hid_device * argument to hid-core functions
extract() and implement() so hid_<level> can be used by them.
Fix bad indentation in hid-core hid_input_field function
that calls extract() function above.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
| 74f292ca8c7a2b9370f80d97a49e48174f4c7635 |
|
13-Jan-2010 |
Gary Stein <LordCnidarian@gmail.com> |
HID: add driver for the Logitech Flight System G940
Implements a new USB-HID for Force Feedback based on the normal
Logitech Force Feedback code and FF-Memless.
Currently only supports the FF_CONSTANT effect although the joystick
appears to support additional non-standard ones.
Signed-off-by: Gary Stein <LordCnidarian@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|