Doug / smarc-fsl-linux-kernel

22 Jul, 2013

1 commit

  • 27ce40503   HID: fix data access in implement() ... Browse Code »

    implement() is setting bytes in LE data stream. In case the data is not
    aligned to 64bits, it reads past the allocated buffer. It doesn't really
    change any value there (it's properly bitmasked), but in case that this
    read past the boundary hits a page boundary, pagefault happens when
    accessing 64bits of 'x' in implement(), and kernel oopses.

    This happens much more often when numbered reports are in use, as the
    initial 8bit skip in the buffer makes the whole process work on values
    which are not aligned to 64bits.

    This problem dates back to attempts in 2005 and 2006 to make implement()
    and extract() as generic as possible, and even back then the problem
    was realized by Adam Kroperlin, but falsely assumed to be impossible
    to cause any harm:

    http://www.mail-archive.com/linux-usb-devel@lists.sourceforge.net/msg47690.html

    I have made several attempts at fixing it "on the spot" directly in
    implement(), but the results were horrible; the special casing for processing
    last 64bit chunk and switching to different math makes it unreadable mess.

    I therefore took a path to allocate a few bytes more which will never make
    it into final report, but are there as a cushion for all the 64bit math
    operations happening in implement() and extract().

    All callers of hid_output_report() are converted at the same time to allocate
    the buffer by newly introduced hid_alloc_report_buf() helper.

    Bruno noticed that the whole raw_size test can be dropped as well, as
    hid_alloc_report_buf() makes sure that the buffer is always of a proper
    size.

    Reviewed-by: Benjamin Tissoires
    Acked-by: Gustavo Padovan
    Signed-off-by: Jiri Kosina

    Jiri Kosina
     

25 Feb, 2013

1 commit

  • d88142725   HID: use hid_hw_request() instead of direct call to usbhid ... Browse Code »

    This allows the hid drivers to be independent from the transport layer.

    The patch was constructed by replacing all occurences of
    usbhid_submit_report() by its hid_hw_request() counterpart.
    Then, drivers not requiring USB_HID anymore have their USB_HID
    dependency cleaned in the Kconfig file.

    Finally, few drivers still depends on USB_HID. Many of them
    are requiring the io wait callback. They are found in the next patch.

    Signed-off-by: Benjamin Tissoires
    Reviewed-by: Mika Westerberg

    For the sensor-hub part:
    Tested-by: Mika Westerberg
    Signed-off-by: Jiri Kosina

    Benjamin Tissoires
     

01 Oct, 2012

1 commit

25 Sep, 2012

1 commit

  • 5ed84c341   HID: picoLCD: bounds check in dump_buff_as_hex() ... Browse Code »

    Make sure we keep enough space for terminating NUL character after last
    newline. If we have too much data, replace last byte with '.'s to
    make overflow visible.

    Using hex_dump_to_buffer() is not interesting as it adds more overhead
    and does not append the trailing linefeed.

    Reported-by: Dan Carpenter
    Signed-off-by: Bruno Prémont
    Signed-off-by: Jiri Kosina

    Bruno Prémont
     

05 Sep, 2012

2 commits

  • f2df5b783   HID: picoLCD: fix dumping of IR_DATA report ... Browse Code »

    The first payload byte indicates how many IR data bytes are following, not
    including itself. The IR data bytes appear in pairs as they represent a
    series of 16bit intervals.

    Signed-off-by: Bruno Prémont
    Signed-off-by: Jiri Kosina

    Bruno Prémont
     
  • 63583c645   HID: picoLCD: optimize for inactive debugfs ... Browse Code »

    Matthieu CASTET adjusted picolcd_debug_out_report() to only operate when
    there is an active listener on debugfs for events.

    Do the same on the more important picolcd_debug_raw_event() that is
    called in interrupt context as opposed to picolcd_debug_out_report()
    which happens in whichever context that sends reports to device.

    Signed-off-by: Bruno Prémont
    Signed-off-by: Jiri Kosina

    Bruno Prémont
     

22 Aug, 2012

1 commit

  • 9277738dd   HID: picolcd: Add missing #include <linux/uaccess.h> ... Browse Code »

    m68k/allmodconfig:

    drivers/hid/hid-picolcd_debugfs.c: In function ‘picolcd_debug_reset_write’:
    drivers/hid/hid-picolcd_debugfs.c:54: error: implicit declaration of function ‘copy_from_user’
    drivers/hid/hid-picolcd_debugfs.c: In function ‘picolcd_debug_eeprom_read’:
    drivers/hid/hid-picolcd_debugfs.c:112: error: implicit declaration of function ‘copy_to_user’

    Signed-off-by: Geert Uytterhoeven
    Signed-off-by: Jiri Kosina

    Geert Uytterhoeven
     

15 Aug, 2012

2 commits

  • baacf9c5d   HID: picoLCD: satify some checkpatch warnings ... Browse Code »

    WARNING: static const char * array should probably be static const char * const
    +static const char *error_codes[] = {

    WARNING: min() should probably be min_t(size_t, 20, s)
    + raw_data[2] = min((size_t)20, s);

    Note: the second min_t suggestion cannot be followed because GCC is not
    smart enough to track constants through it and make
    copy_from_user_overflow() check happy.

    WARNING: min() should probably be min_t(u8, 20, raw_data[2])
    + if (copy_from_user(raw_data+3, u, min((u8)20, raw_data[2])))
    return -EFAULT;

    Signed-off-by: Bruno Prémont
    Signed-off-by: Jiri Kosina

    Bruno Prémont
     
  • fabdbf2fd   HID: picoLCD: split driver code ... Browse Code »

    In order to make code maintenance easier, split the vairous
    functions into individial files (this removes a bunch of #ifdefs).

    Signed-off-by: Bruno Prémont
    Signed-off-by: Jiri Kosina

    Bruno Prémont