The syzbot fuzzer found a slab-out-of-bounds write bug in the hid-gaff
driver. The problem is caused by the driver's assumption that the
device must have an input report. While this will be true for all
normal HID input devices, a suitably malicious device can violate the
assumption.
The same assumption is present in over a dozen other HID drivers.
This patch fixes them by checking that the list of hid_inputs for the
hid_device is nonempty before allowing it to be used.
Reported-and-tested-by: syzbot+403741a091bf41d4ae79@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
hidp_send_message was changed to return non-zero values on success,
which some other bits did not expect. This caused spurious errors to be
propagated through the stack, breaking some drivers, such as hid-sony
for the Dualshock 4 in Bluetooth mode.
As pointed out by Dan Carpenter, hid-microsoft directly relied on that
assumption as well.
Fixes: 48d9cc9d85 ("Bluetooth: hidp: Let hidp_send_message return number of queued bytes")
Signed-off-by: Dan Elkouby <streetwalkermc@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Based on 1 normalized pattern(s):
this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license as published by
the free software foundation either version 2 of the license or at
your option any later version
extracted by the scancode license scanner the SPDX license identifier
GPL-2.0-or-later
has been chosen to replace the boilerplate/reference in 3029 file(s).
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Allison Randal <allison@lohutok.net>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070032.746973796@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add HID quirk driver for Xbox One S controller over bluetooth.
This driver only adds support for rumble. Standard controller
functionality is exposed by default HID driver.
[jkosina@suse.cz: straightforward rebase on more recent driver code]
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: linux-input@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: Pierre-Loup A. Griffais <pgriffais@valvesoftware.com>
Signed-off-by: Juha Kuikka <juha.kuikka@gmail.com>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
In order to be able to have more than just an unsigned long worth of
private data, convert the code to allocate and use a dedicated struct.
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: linux-input@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: Pierre-Loup A. Griffais <pgriffais@valvesoftware.com>
Signed-off-by: Juha Kuikka <juha.kuikka@gmail.com>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The tool works nicely with hid-generic, but it ends up creating 9
different input nodes with most of them only having ABS_MISC set.
Filter the axis out, which reduces the amount of devices to 2. One is
the proper System Multi-axis collection, the other exported device
seems to provide SLEEP and POWER Key, not sure how one can trigger
those events though.
Filtering the ABS_X and ABS_Y axes also prevents udev to detect this as
a touchscreen.
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Nearly identical to the previous set of patches related to Microsoft
Surface Keyboards.
Removes Surface Pro 3 generation TypeCover support from hid-microsoft
so proper multitouch data can be reported from the touchpad.
Signed-off-by: Dennis Chen <barracks510@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Nearly identical to the patch "multitouch: enable the Surface 4 Type Cover Pro
(JP) to report multitouch data"
We can now remove the support of the Surface 4 Type Cover Pro (not JP versions)
from hid-microsoft so it can properly report multi touch from the touchpad.
Signed-off-by: Daniel Keller <daniel.keller@gcd.de>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Since commit 8fe89ef076 ("HID: multitouch: enable the Surface 3 Type
Cover to report multitouch data"), the TypeCover can be properly handled
by hid-multitouch and don't require any special quirk in the kernel.
Remove the support of the Surface 4 Type Cover Pro (JP) from
hid-microsoft so it can properly report multitouch from the touchpad.
Signed-off-by: Yuta Kobayashi <alu.ula@outlook.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
There is no reasons to filter out keyboard and consumer control collections
in hid-multitouch.
With the previous hid-input fix, there is now a full support of the Type
Cover and we can remove all specific bits from hid-core and hid-microsoft.
hid-multitouch will automatically set HID_QUIRK_NO_INIT_REPORTS so we can
also remove it from the list of ushbid quirks.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Adding support for not JP versions of the Microsoft Surface 4 Type Cover Pro
[jkosina@suse.cz: The identical patch has been sent by Jeff Farthing, so I am
including his signoff as well]
Signed-off-by: Jeff Farthing <jeff@jfarthing.com>
Signed-off-by: Daniel Keller <daniel.keller@gcd.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This reverts commit 3ccc60f9d8.
While investigating bug https://bugzilla.kernel.org/show_bug.cgi?id=37982 ,
there was solid evidences that Microsoft reused the same report
descriptor for the its Digital Media keyboard series.
Since 1989dad "HID: input: ignore System Control application usages if not
System Controls", the keyboard series do not produce a spurious joystick
input device inode without needing to patch the problematic report
descriptor. As such the MS_RDESC_3K reportdescriptor fixup can be removed.
Signed-off-by: Michel Hermier <michel.hermier@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Adding support for the Microsoft Surface 4 Type Cover Pro (JP).
Signed-off-by: Yuta Kobayashi <alu.ula@outlook.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Adds support for the Micrsift Digital 4K, Media 600 and Media 3000 V1 Keyboards,
which have the same quirks as the already existing hardware MS_NE4K.
Fixes https://bugzilla.kernel.org/show_bug.cgi?id=52841
[jkosina@suse.cz: rephrase changelog]
Signed-off-by: Alistair Leslie-Hughes <leslie_alistair@hotmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Microsoft Wireless Comfort Keyboard has vendor specific My Favorites
1-5 keys. Linux already supports this buttons on other MS keyboards by
MS_ERGONOMY quirk. So apply MS_ERGONOMY quirk to USB PID 0x00e3
(Microsoft Wireless Optical Desktop Receiver 3.0A). After this
My Favorites 1..5 keys will be reported as KEY_F14..KEY_F15 events.
Signed-off-by: Slava Bacherikov <slava@bacher09.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Adds support for Microsoft Type Cover 3 with 0x07e2 product ID.
Signed-off-by: Donavan Lance <shvr@fedoraproject.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Adding support for the Microsoft Surface 3 (non-pro) Type Cover.
The existing definitions and quirks are actually for the Surface
Pro 3 type covers. I've renamed the old constants to reflect that
they belong to the Surface Pro 3, and added a new constant and
matching code for the Surface 3.
Signed-off-by: Stephen Just <stephenjust@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Adding support for the Microsoft Surface Pro Power Cover.
Signed-off-by: Raimund Roth <raimundmroth@gmail.gom>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Microsoft Natural Wireless Ergonomic Keyboard 7000 has special My
Favorites 1..5 keys which are handled through a vendor-defined usage
page (0xff05).
Apply MS_ERGONOMY quirks handling to USB PID 0x071d (Microsoft Microsoft
2.4GHz Transceiver V1.0) so that the My Favorites 1..5 keys are reported
as KEY_F14..18 events.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=52841
Signed-off-by: Jakub Sitnicki <jsitnicki@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Based on code for the US Surface Type Cover 3
from commit be3b16341d
("HID: add support for MS Surface Pro 3 Type Cover"):
Signed-off-by: Alan Wu <alan.c.wu@gmail.com>
Tested-by: Karlis Dreizis <karlisdreizis@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This reverts commit 117309c51d.
The MS Surface Pro 2 has an USB composite device with 3 interfaces
- interface 0 - sensor hub
- interface 1 - wacom digitizer
- interface 2 - the keyboard cover, if one is attached
This USB composite device changes it product id dependent on if and which
keyboard cover is attached. Adding the covers to hid_have_special_driver
prevents loading the right hid drivers for the other two interfaces, all 3
get loaded with hid-microsoft. We don't even need hid-microsoft for the
keyboards. We have to revert this to load the right hid modules for each
interface.
CC: stable@vger.kernel.org # kernel 3.14 only
Signed-off-by: Derya <derya.kiran@yahoo.de>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The Microsoft Office keyboard has a scrollwheel as well as some special keys
above the keypad which are handled through the custom MS usage page, this
commit adds support for these.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
For some devices we may also want to do custom mappings for other pages.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The Microsoft Surface Type/Touch cover 2 devices have the flag HID_DG_CONTACTID
in their reports.This causes the device to bind to the hid-multitouch driver,
which doesn't handle generic keyboard/mouse input events. The patch adds
the hardware id's of the device to hid-microsoft and to the HID special
driver array, which makes the device get handled by hid-generic/hid-input
properly.
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=64811
Singed-off-by: Reyad Attiyat <reyad.attiyat@gmail.com>
Reviewed-by: Benjamin Tissoires<benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
For 0xff05 usage in MS ergonomy keyboard quirk, we are falling through
and returning 0 instread of properly (because we've performed new mapping)
returning 1. Fix that.
Reported-by: Joe Perches <joe@perches.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This patche adds PID of Japanese Natual Ergonomic Keyboard 4000. HID
NE4K driver depends on this PID for determining its quirks. F14-F18 keys
would not work without the patch.
Signed-off-by: Adam Jiang <jiang.adam@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Use the new module_hid_driver macro in all HID drivers that have
a simple register/unregister init/exit.
This also converts the hid drivers that test for a failure of
hid_register_driver() and report the failure. Using module_hid_driver
in those drivers removes the failure message.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
In patch "HID: microsoft: fix invalid rdesc for 3k kbd" I fixed
support for MS 3k keyboards. However the added check using memcmp and
a compound statement breaks build on architectures where memcmp is a
macro with parameters.
hid-microsoft.c:51:18: error: macro "memcmp" passed 6 arguments, but takes just 3
On x86_64, memcmp is a function, so I did not see the error.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Microsoft Digital Media Keyboard 3000 has two interfaces, and the
second one has a report descriptor with a bug. The second collection
says:
05 01 -- global; usage page -- 01 -- Generic Desktop Controls
09 80 -- local; usage -- 80 -- System Control
a1 01 -- main; collection -- 01 -- application
85 03 -- global; report ID -- 03
19 00 -- local; Usage Minimum -- 00
29 ff -- local; Usage Maximum -- ff
15 00 -- global; Logical Minimum -- 0
26 ff 00 -- global; Logical Maximum -- ff
81 00 -- main; input
c0 -- main; End Collection
I.e. it makes us think that there are all kinds of usages of system
control. That the keyboard is a not only a keyboard, but also a
joystick, mouse, gamepad, keypad, etc. The same as for the Wireless
Desktop Receiver, this should be Physical Min/Max. So fix that
appropriately.
References: https://bugzilla.novell.com/show_bug.cgi?id=776834
Cc: <stable@vger.kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Paul Walmsley has implemented dynamic quirk handling back in 2007 through
commits:
2eb5dc30eb ("USB HID: encapsulate quirk handling into hid-quirks.c")
8222fbe67c ("USB HID: clarify static quirk handling as squirks")
8cef908235 ("USB HID: add support for dynamically-created quirks")
876b9276b9 ("USB HID: add 'quirks' module parameter")
and as such, his copyright rightly belongs to
drivers/hid/usbhid/hid-quirks.c file.
However when generic HID code has been converted to bus and individual
quirks separated out to individual drivers on the bus, the copyright has
been blindly transfered into all the tiny drivers, which actually don't
contain any of Pauls' copyrighted code.
Remove the copyright from those sub-drivers.
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Acked-by: Paul Walmsley <paul@pwsan.com>
Microsoft comfort mouse 4500 report descriptor contains duplicate
usages for horizontal wheel. This patch fixes the wrong mapping
caused by that.
Signed-off-by: Ari Savolainen <ari.m.savolainen@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The Digital Media 3000 keyboard (USB id: 0x0730) features the same 1-5
Application Launch keys that the Natural Ergonomic 4000 has. Add its
usb id to the list of quirks.
Reported-by: Khelben Blackstaff <eye.of.the.8eholder@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Neaten current uses of dev_<level> by adding and using
hid specific hid_<level> macros.
Convert existing uses of dev_<level> uses to hid_<level>.
Convert hid-pidff printk uses to hid_<level>.
Remove err_hid and use hid_err instead.
Add missing newlines to logging messages where necessary.
Coalesce format strings.
Add and use pr_fmt(fmt) KBUILD_MODNAME ": " fmt
Other miscellaneous changes:
Add const struct hid_device * argument to hid-core functions
extract() and implement() so hid_<level> can be used by them.
Fix bad indentation in hid-core hid_input_field function
that calls extract() function above.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Update hid_driver's report_fixup prototype to allow changing report
descriptor size and/or returning completely different report descriptor.
Update existing usage accordingly.
This is to give more freedom in descriptor fixup and to allow having a whole
fixed descriptor in the code for the sake of readability.
Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Trivial patch which adds the __init and __exit macros to the module_init /
module_exit functions of several HID drivers from drivers/hid/
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This removal was scheduled and there is no problem with later
distros to adapt for the new bus, thanks to aliases.
module-init-tools map files are deprecated nowadays, so that
the patch which introduced hid ones into the m-i-t won't be
accepted and hence there is no reason for leaving compat stuff in.
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Report descriptor fixup for MS 1028 receiver changes also values for
Keyboard and Consumer, which incorrectly trims the range, causing correct
events being thrown away before passing to userspace.
We need to keep the GenDesk usage fixup though, as it reports totally bogus
values about axis.
Reported-by: Lucas Gadani <lgadani@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Move connecting from usbhid to the hid layer and fix also hidp in
that manner.
This removes all the ignore/force hidinput/hiddev connecting quirks.
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Alan Stern