* [PATCH AUTOSEL 4.19 42/68] HID: quirks: Set the INCREMENT_USAGE_ON_DUPLICATE quirk on Saitek X52
From: Sasha Levin @ 2019-08-14 2:15 UTC (permalink / raw)
To: linux-kernel, stable
Cc: István Váradi, Jiri Kosina, Sasha Levin, linux-input
In-Reply-To: <20190814021548.16001-1-sashal@kernel.org>
From: István Váradi <ivaradi@varadiistvan.hu>
[ Upstream commit 7bc74853fd61432ec59f812a40425bf6d8c986a4 ]
The Saitek X52 joystick has a pair of axes that are originally
(by the Windows driver) used as mouse pointer controls. The corresponding
usage->hid values are 0x50024 and 0x50026. Thus they are handled
as unknown axes and both get mapped to ABS_MISC. The quirk makes
the second axis to be mapped to ABS_MISC1 and thus made available
separately.
[jkosina@suse.cz: squashed two patches into one]
Signed-off-by: István Váradi <ivaradi@varadiistvan.hu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 2898bb0619454..4a2fa57ddcb84 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -971,6 +971,7 @@
#define USB_DEVICE_ID_SAITEK_RAT7 0x0cd7
#define USB_DEVICE_ID_SAITEK_RAT9 0x0cfa
#define USB_DEVICE_ID_SAITEK_MMO7 0x0cd0
+#define USB_DEVICE_ID_SAITEK_X52 0x075c
#define USB_VENDOR_ID_SAMSUNG 0x0419
#define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index d29c7c9cd185d..e553f6fae7a4c 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -143,6 +143,7 @@ static const struct hid_device_id hid_quirks[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPAD), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
{ HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPORT), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
{ HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD), HID_QUIRK_BADPAD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
{ HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
{ HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
{ HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET },
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 4.19 35/68] Input: kbtab - sanity check for endpoint type
From: Sasha Levin @ 2019-08-14 2:15 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Oliver Neukum, syzbot+c7df50363aaff50aa363, Dmitry Torokhov,
Sasha Levin, linux-input
In-Reply-To: <20190814021548.16001-1-sashal@kernel.org>
From: Oliver Neukum <oneukum@suse.com>
[ Upstream commit c88090dfc84254fa149174eb3e6a8458de1912c4 ]
The driver should check whether the endpoint it uses has the correct
type.
Reported-by: syzbot+c7df50363aaff50aa363@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/tablet/kbtab.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c
index 75b500651e4e4..b1cf0c9712740 100644
--- a/drivers/input/tablet/kbtab.c
+++ b/drivers/input/tablet/kbtab.c
@@ -116,6 +116,10 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
if (intf->cur_altsetting->desc.bNumEndpoints < 1)
return -ENODEV;
+ endpoint = &intf->cur_altsetting->endpoint[0].desc;
+ if (!usb_endpoint_is_int_in(endpoint))
+ return -ENODEV;
+
kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL);
input_dev = input_allocate_device();
if (!kbtab || !input_dev)
@@ -154,8 +158,6 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
input_set_abs_params(input_dev, ABS_Y, 0, 0x1750, 4, 0);
input_set_abs_params(input_dev, ABS_PRESSURE, 0, 0xff, 0, 0);
- endpoint = &intf->cur_altsetting->endpoint[0].desc;
-
usb_fill_int_urb(kbtab->irq, dev,
usb_rcvintpipe(dev, endpoint->bEndpointAddress),
kbtab->data, 8,
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 4.19 03/68] HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT
From: Sasha Levin @ 2019-08-14 2:14 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilya Trukhanov, Jiri Kosina, Sasha Levin, linux-input
In-Reply-To: <20190814021548.16001-1-sashal@kernel.org>
From: Ilya Trukhanov <lahvuun@gmail.com>
[ Upstream commit 65f11c72780fa9d598df88def045ccb6a885cf80 ]
Enable force feedback for the Thrustmaster Dual Trigger 2 in 1 Rumble Force
gamepad. Compared to other Thrustmaster devices, left and right rumble
motors here are swapped.
Signed-off-by: Ilya Trukhanov <lahvuun@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-tmff.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c
index bea8def64f437..30b8c3256c991 100644
--- a/drivers/hid/hid-tmff.c
+++ b/drivers/hid/hid-tmff.c
@@ -34,6 +34,8 @@
#include "hid-ids.h"
+#define THRUSTMASTER_DEVICE_ID_2_IN_1_DT 0xb320
+
static const signed short ff_rumble[] = {
FF_RUMBLE,
-1
@@ -88,6 +90,7 @@ static int tmff_play(struct input_dev *dev, void *data,
struct hid_field *ff_field = tmff->ff_field;
int x, y;
int left, right; /* Rumbling */
+ int motor_swap;
switch (effect->type) {
case FF_CONSTANT:
@@ -112,6 +115,13 @@ static int tmff_play(struct input_dev *dev, void *data,
ff_field->logical_minimum,
ff_field->logical_maximum);
+ /* 2-in-1 strong motor is left */
+ if (hid->product == THRUSTMASTER_DEVICE_ID_2_IN_1_DT) {
+ motor_swap = left;
+ left = right;
+ right = motor_swap;
+ }
+
dbg_hid("(left,right)=(%08x, %08x)\n", left, right);
ff_field->value[0] = left;
ff_field->value[1] = right;
@@ -238,6 +248,8 @@ static const struct hid_device_id tm_devices[] = {
.driver_data = (unsigned long)ff_rumble },
{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304), /* FireStorm Dual Power 2 (and 3) */
.driver_data = (unsigned long)ff_rumble },
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, THRUSTMASTER_DEVICE_ID_2_IN_1_DT), /* Dual Trigger 2-in-1 */
+ .driver_data = (unsigned long)ff_rumble },
{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb323), /* Dual Trigger 3-in-1 (PC Mode) */
.driver_data = (unsigned long)ff_rumble },
{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb324), /* Dual Trigger 3-in-1 (PS3 Mode) */
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.2 101/123] Input: iforce - add sanity checks
From: Sasha Levin @ 2019-08-14 2:10 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Oliver Neukum, syzbot+5efc10c005014d061a74, Dmitry Torokhov,
Sasha Levin, linux-input
In-Reply-To: <20190814021047.14828-1-sashal@kernel.org>
From: Oliver Neukum <oneukum@suse.com>
[ Upstream commit 849f5ae3a513c550cad741c68dd3d7eb2bcc2a2c ]
The endpoint type should also be checked before a device
is accepted.
Reported-by: syzbot+5efc10c005014d061a74@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/joystick/iforce/iforce-usb.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index f1569ae8381bc..a0a686f56ac4f 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -129,7 +129,12 @@ static int iforce_usb_probe(struct usb_interface *intf,
return -ENODEV;
epirq = &interface->endpoint[0].desc;
+ if (!usb_endpoint_is_int_in(epirq))
+ return -ENODEV;
+
epout = &interface->endpoint[1].desc;
+ if (!usb_endpoint_is_int_out(epout))
+ return -ENODEV;
if (!(iforce = kzalloc(sizeof(struct iforce) + 32, GFP_KERNEL)))
goto fail;
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.2 093/123] HID: hiddev: do cleanup in failure of opening a device
From: Sasha Levin @ 2019-08-14 2:10 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hillf Danton, syzbot, Andrey Konovalov, Jiri Kosina, Sasha Levin,
linux-usb, linux-input
In-Reply-To: <20190814021047.14828-1-sashal@kernel.org>
From: Hillf Danton <hdanton@sina.com>
[ Upstream commit 6d4472d7bec39917b54e4e80245784ea5d60ce49 ]
Undo what we did for opening before releasing the memory slice.
Reported-by: syzbot <syzbot+62a1e04fd3ec2abf099e@syzkaller.appspotmail.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/usbhid/hiddev.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index c07df82923802..4e11cc6fc34bc 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -308,6 +308,10 @@ static int hiddev_open(struct inode *inode, struct file *file)
hid_hw_power(hid, PM_HINT_NORMAL);
bail_unlock:
mutex_unlock(&hiddev->existancelock);
+
+ spin_lock_irq(&list->hiddev->list_lock);
+ list_del(&list->node);
+ spin_unlock_irq(&list->hiddev->list_lock);
bail:
file->private_data = NULL;
vfree(list);
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.2 092/123] HID: hiddev: avoid opening a disconnected device
From: Sasha Levin @ 2019-08-14 2:10 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hillf Danton, syzbot, Andrey Konovalov, Jiri Kosina, Sasha Levin,
linux-usb, linux-input
In-Reply-To: <20190814021047.14828-1-sashal@kernel.org>
From: Hillf Danton <hdanton@sina.com>
[ Upstream commit 9c09b214f30e3c11f9b0b03f89442df03643794d ]
syzbot found the following crash on:
HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=147ac20c600000
kernel config: https://syzkaller.appspot.com/x/.config?x=792eb47789f57810
dashboard link: https://syzkaller.appspot.com/bug?extid=62a1e04fd3ec2abf099e
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50
kernel/locking/lockdep.c:3753
Read of size 8 at addr ffff8881cf591a08 by task syz-executor.1/26260
CPU: 1 PID: 26260 Comm: syz-executor.1 Not tainted 5.3.0-rc2+ #24
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
print_address_description+0x6a/0x32c mm/kasan/report.c:351
__kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
kasan_report+0xe/0x12 mm/kasan/common.c:612
__lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753
lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159
hiddev_release+0x82/0x520 drivers/hid/usbhid/hiddev.c:221
__fput+0x2d7/0x840 fs/file_table.c:280
task_work_run+0x13f/0x1c0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x8ef/0x2c50 kernel/exit.c:878
do_group_exit+0x125/0x340 kernel/exit.c:982
get_signal+0x466/0x23d0 kernel/signal.c:2728
do_signal+0x88/0x14e0 arch/x86/kernel/signal.c:815
exit_to_usermode_loop+0x1a2/0x200 arch/x86/entry/common.c:159
prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459829
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f75b2a6ccf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000075c078 RCX: 0000000000459829
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075c078
RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075c07c
R13: 00007ffcdfe1023f R14: 00007f75b2a6d9c0 R15: 000000000075c07c
Allocated by task 104:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc mm/kasan/common.c:487 [inline]
__kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
kmalloc include/linux/slab.h:552 [inline]
kzalloc include/linux/slab.h:748 [inline]
hiddev_connect+0x242/0x5b0 drivers/hid/usbhid/hiddev.c:900
hid_connect+0x239/0xbb0 drivers/hid/hid-core.c:1882
hid_hw_start drivers/hid/hid-core.c:1981 [inline]
hid_hw_start+0xa2/0x130 drivers/hid/hid-core.c:1972
appleir_probe+0x13e/0x1a0 drivers/hid/hid-appleir.c:308
hid_device_probe+0x2be/0x3f0 drivers/hid/hid-core.c:2209
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
hid_add_device+0x33c/0x990 drivers/hid/hid-core.c:2365
usbhid_probe+0xa81/0xfa0 drivers/hid/usbhid/hid-core.c:1386
usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Freed by task 104:
save_stack+0x1b/0x80 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
slab_free_hook mm/slub.c:1423 [inline]
slab_free_freelist_hook mm/slub.c:1470 [inline]
slab_free mm/slub.c:3012 [inline]
kfree+0xe4/0x2f0 mm/slub.c:3953
hiddev_connect.cold+0x45/0x5c drivers/hid/usbhid/hiddev.c:914
hid_connect+0x239/0xbb0 drivers/hid/hid-core.c:1882
hid_hw_start drivers/hid/hid-core.c:1981 [inline]
hid_hw_start+0xa2/0x130 drivers/hid/hid-core.c:1972
appleir_probe+0x13e/0x1a0 drivers/hid/hid-appleir.c:308
hid_device_probe+0x2be/0x3f0 drivers/hid/hid-core.c:2209
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
hid_add_device+0x33c/0x990 drivers/hid/hid-core.c:2365
usbhid_probe+0xa81/0xfa0 drivers/hid/usbhid/hid-core.c:1386
usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x650 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:882
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2114
usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
The buggy address belongs to the object at ffff8881cf591900
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 264 bytes inside of
512-byte region [ffff8881cf591900, ffff8881cf591b00)
The buggy address belongs to the page:
page:ffffea00073d6400 refcount:1 mapcount:0 mapping:ffff8881da002500
index:0x0 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 0000000000000000 0000000100000001 ffff8881da002500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881cf591900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881cf591980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8881cf591a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881cf591a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881cf591b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
In order to avoid opening a disconnected device, we need to check exist
again after acquiring the existance lock, and bail out if necessary.
Reported-by: syzbot <syzbot+62a1e04fd3ec2abf099e@syzkaller.appspotmail.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/usbhid/hiddev.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 55b72573066b9..c07df82923802 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -284,6 +284,14 @@ static int hiddev_open(struct inode *inode, struct file *file)
spin_unlock_irq(&list->hiddev->list_lock);
mutex_lock(&hiddev->existancelock);
+ /*
+ * recheck exist with existance lock held to
+ * avoid opening a disconnected device
+ */
+ if (!list->hiddev->exist) {
+ res = -ENODEV;
+ goto bail_unlock;
+ }
if (!list->hiddev->open++)
if (list->hiddev->exist) {
struct hid_device *hid = hiddev->hid;
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.2 088/123] HID: input: fix a4tech horizontal wheel custom usage
From: Sasha Levin @ 2019-08-14 2:10 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nicolas Saenz Julienne, Jiri Kosina, Sasha Levin, linux-input
In-Reply-To: <20190814021047.14828-1-sashal@kernel.org>
From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
[ Upstream commit 1c703b53e5bfb5c2205c30f0fb157ce271fd42fb ]
Some a4tech mice use the 'GenericDesktop.00b8' usage to inform whether
the previous wheel report was horizontal or vertical. Before
c01908a14bf73 ("HID: input: add mapping for "Toggle Display" key") this
usage was being mapped to 'Relative.Misc'. After the patch it's simply
ignored (usage->type == 0 & usage->code == 0). Which ultimately makes
hid-a4tech ignore the WHEEL/HWHEEL selection event, as it has no
usage->type.
We shouldn't rely on a mapping for that usage as it's nonstandard and
doesn't really map to an input event. So we bypass the mapping and make
sure the custom event handling properly handles both reports.
Fixes: c01908a14bf73 ("HID: input: add mapping for "Toggle Display" key")
Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-a4tech.c | 30 +++++++++++++++++++++++++++---
1 file changed, 27 insertions(+), 3 deletions(-)
diff --git a/drivers/hid/hid-a4tech.c b/drivers/hid/hid-a4tech.c
index 98bf694626f71..3a8c4a5971f70 100644
--- a/drivers/hid/hid-a4tech.c
+++ b/drivers/hid/hid-a4tech.c
@@ -23,12 +23,36 @@
#define A4_2WHEEL_MOUSE_HACK_7 0x01
#define A4_2WHEEL_MOUSE_HACK_B8 0x02
+#define A4_WHEEL_ORIENTATION (HID_UP_GENDESK | 0x000000b8)
+
struct a4tech_sc {
unsigned long quirks;
unsigned int hw_wheel;
__s32 delayed_value;
};
+static int a4_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ struct hid_field *field, struct hid_usage *usage,
+ unsigned long **bit, int *max)
+{
+ struct a4tech_sc *a4 = hid_get_drvdata(hdev);
+
+ if (a4->quirks & A4_2WHEEL_MOUSE_HACK_B8 &&
+ usage->hid == A4_WHEEL_ORIENTATION) {
+ /*
+ * We do not want to have this usage mapped to anything as it's
+ * nonstandard and doesn't really behave like an HID report.
+ * It's only selecting the orientation (vertical/horizontal) of
+ * the previous mouse wheel report. The input_events will be
+ * generated once both reports are recorded in a4_event().
+ */
+ return -1;
+ }
+
+ return 0;
+
+}
+
static int a4_input_mapped(struct hid_device *hdev, struct hid_input *hi,
struct hid_field *field, struct hid_usage *usage,
unsigned long **bit, int *max)
@@ -52,8 +76,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
struct a4tech_sc *a4 = hid_get_drvdata(hdev);
struct input_dev *input;
- if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput ||
- !usage->type)
+ if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput)
return 0;
input = field->hidinput->input;
@@ -64,7 +87,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
return 1;
}
- if (usage->hid == 0x000100b8) {
+ if (usage->hid == A4_WHEEL_ORIENTATION) {
input_event(input, EV_REL, value ? REL_HWHEEL :
REL_WHEEL, a4->delayed_value);
input_event(input, EV_REL, value ? REL_HWHEEL_HI_RES :
@@ -131,6 +154,7 @@ MODULE_DEVICE_TABLE(hid, a4_devices);
static struct hid_driver a4_driver = {
.name = "a4tech",
.id_table = a4_devices,
+ .input_mapping = a4_input_mapping,
.input_mapped = a4_input_mapped,
.event = a4_event,
.probe = a4_probe,
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.2 087/123] HID: holtek: test for sanity of intfdata
From: Sasha Levin @ 2019-08-14 2:10 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Oliver Neukum, syzbot+965152643a75a56737be, Jiri Kosina,
Sasha Levin, linux-input
In-Reply-To: <20190814021047.14828-1-sashal@kernel.org>
From: Oliver Neukum <oneukum@suse.com>
[ Upstream commit 01ec0a5f19c8c82960a07f6c7410fc9e01d7fb51 ]
The ioctl handler uses the intfdata of a second interface,
which may not be present in a broken or malicious device, hence
the intfdata needs to be checked for NULL.
[jkosina@suse.cz: fix newly added spurious space]
Reported-by: syzbot+965152643a75a56737be@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-holtek-kbd.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/hid/hid-holtek-kbd.c b/drivers/hid/hid-holtek-kbd.c
index b3d502421b79d..0a38e8e9bc783 100644
--- a/drivers/hid/hid-holtek-kbd.c
+++ b/drivers/hid/hid-holtek-kbd.c
@@ -123,9 +123,14 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type,
/* Locate the boot interface, to receive the LED change events */
struct usb_interface *boot_interface = usb_ifnum_to_if(usb_dev, 0);
+ struct hid_device *boot_hid;
+ struct hid_input *boot_hid_input;
- struct hid_device *boot_hid = usb_get_intfdata(boot_interface);
- struct hid_input *boot_hid_input = list_first_entry(&boot_hid->inputs,
+ if (unlikely(boot_interface == NULL))
+ return -ENODEV;
+
+ boot_hid = usb_get_intfdata(boot_interface);
+ boot_hid_input = list_first_entry(&boot_hid->inputs,
struct hid_input, list);
return boot_hid_input->input->event(boot_hid_input->input, type, code,
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.2 086/123] HID: quirks: Set the INCREMENT_USAGE_ON_DUPLICATE quirk on Saitek X52
From: Sasha Levin @ 2019-08-14 2:10 UTC (permalink / raw)
To: linux-kernel, stable
Cc: István Váradi, Jiri Kosina, Sasha Levin, linux-input
In-Reply-To: <20190814021047.14828-1-sashal@kernel.org>
From: István Váradi <ivaradi@varadiistvan.hu>
[ Upstream commit 7bc74853fd61432ec59f812a40425bf6d8c986a4 ]
The Saitek X52 joystick has a pair of axes that are originally
(by the Windows driver) used as mouse pointer controls. The corresponding
usage->hid values are 0x50024 and 0x50026. Thus they are handled
as unknown axes and both get mapped to ABS_MISC. The quirk makes
the second axis to be mapped to ABS_MISC1 and thus made available
separately.
[jkosina@suse.cz: squashed two patches into one]
Signed-off-by: István Váradi <ivaradi@varadiistvan.hu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 34a812025b948..76aa474e92c15 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -990,6 +990,7 @@
#define USB_DEVICE_ID_SAITEK_RAT7 0x0cd7
#define USB_DEVICE_ID_SAITEK_RAT9 0x0cfa
#define USB_DEVICE_ID_SAITEK_MMO7 0x0cd0
+#define USB_DEVICE_ID_SAITEK_X52 0x075c
#define USB_VENDOR_ID_SAMSUNG 0x0419
#define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 5b669f7d653fa..4fe2c3ab76f9c 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -141,6 +141,7 @@ static const struct hid_device_id hid_quirks[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPAD), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
{ HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPORT), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
{ HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD), HID_QUIRK_BADPAD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
{ HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
{ HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
{ HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET },
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.2 072/123] Input: kbtab - sanity check for endpoint type
From: Sasha Levin @ 2019-08-14 2:09 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Oliver Neukum, syzbot+c7df50363aaff50aa363, Dmitry Torokhov,
Sasha Levin, linux-input
In-Reply-To: <20190814021047.14828-1-sashal@kernel.org>
From: Oliver Neukum <oneukum@suse.com>
[ Upstream commit c88090dfc84254fa149174eb3e6a8458de1912c4 ]
The driver should check whether the endpoint it uses has the correct
type.
Reported-by: syzbot+c7df50363aaff50aa363@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/tablet/kbtab.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c
index 04b85571f41e3..aa577898e952b 100644
--- a/drivers/input/tablet/kbtab.c
+++ b/drivers/input/tablet/kbtab.c
@@ -117,6 +117,10 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
if (intf->cur_altsetting->desc.bNumEndpoints < 1)
return -ENODEV;
+ endpoint = &intf->cur_altsetting->endpoint[0].desc;
+ if (!usb_endpoint_is_int_in(endpoint))
+ return -ENODEV;
+
kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL);
input_dev = input_allocate_device();
if (!kbtab || !input_dev)
@@ -155,8 +159,6 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
input_set_abs_params(input_dev, ABS_Y, 0, 0x1750, 4, 0);
input_set_abs_params(input_dev, ABS_PRESSURE, 0, 0xff, 0, 0);
- endpoint = &intf->cur_altsetting->endpoint[0].desc;
-
usb_fill_int_urb(kbtab->irq, dev,
usb_rcvintpipe(dev, endpoint->bEndpointAddress),
kbtab->data, 8,
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.2 017/123] HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT
From: Sasha Levin @ 2019-08-14 2:09 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilya Trukhanov, Jiri Kosina, Sasha Levin, linux-input
In-Reply-To: <20190814021047.14828-1-sashal@kernel.org>
From: Ilya Trukhanov <lahvuun@gmail.com>
[ Upstream commit 65f11c72780fa9d598df88def045ccb6a885cf80 ]
Enable force feedback for the Thrustmaster Dual Trigger 2 in 1 Rumble Force
gamepad. Compared to other Thrustmaster devices, left and right rumble
motors here are swapped.
Signed-off-by: Ilya Trukhanov <lahvuun@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-tmff.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c
index e12f2588ddebb..bdfc5ff3b2c5c 100644
--- a/drivers/hid/hid-tmff.c
+++ b/drivers/hid/hid-tmff.c
@@ -22,6 +22,8 @@
#include "hid-ids.h"
+#define THRUSTMASTER_DEVICE_ID_2_IN_1_DT 0xb320
+
static const signed short ff_rumble[] = {
FF_RUMBLE,
-1
@@ -76,6 +78,7 @@ static int tmff_play(struct input_dev *dev, void *data,
struct hid_field *ff_field = tmff->ff_field;
int x, y;
int left, right; /* Rumbling */
+ int motor_swap;
switch (effect->type) {
case FF_CONSTANT:
@@ -100,6 +103,13 @@ static int tmff_play(struct input_dev *dev, void *data,
ff_field->logical_minimum,
ff_field->logical_maximum);
+ /* 2-in-1 strong motor is left */
+ if (hid->product == THRUSTMASTER_DEVICE_ID_2_IN_1_DT) {
+ motor_swap = left;
+ left = right;
+ right = motor_swap;
+ }
+
dbg_hid("(left,right)=(%08x, %08x)\n", left, right);
ff_field->value[0] = left;
ff_field->value[1] = right;
@@ -226,6 +236,8 @@ static const struct hid_device_id tm_devices[] = {
.driver_data = (unsigned long)ff_rumble },
{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304), /* FireStorm Dual Power 2 (and 3) */
.driver_data = (unsigned long)ff_rumble },
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, THRUSTMASTER_DEVICE_ID_2_IN_1_DT), /* Dual Trigger 2-in-1 */
+ .driver_data = (unsigned long)ff_rumble },
{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb323), /* Dual Trigger 3-in-1 (PC Mode) */
.driver_data = (unsigned long)ff_rumble },
{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb324), /* Dual Trigger 3-in-1 (PS3 Mode) */
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.2 016/123] HID: logitech-hidpp: add USB PID for a few more supported mice
From: Sasha Levin @ 2019-08-14 2:09 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Filipe Laíns, Jiri Kosina, Sasha Levin, linux-input
In-Reply-To: <20190814021047.14828-1-sashal@kernel.org>
From: Filipe Laíns <lains@archlinux.org>
[ Upstream commit 27fc32fd9417968a459d43d9a7c50fd423d53eb9 ]
Add more device IDs to logitech-hidpp driver.
Signed-off-by: Filipe Laíns <lains@archlinux.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-logitech-hidpp.c | 32 +++++++++++++++++++++++++++++++-
1 file changed, 31 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index cf05816a601f5..34e2b3f9d540d 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3749,15 +3749,45 @@ static const struct hid_device_id hidpp_devices[] = {
{ L27MHZ_DEVICE(HID_ANY_ID) },
- { /* Logitech G403 Gaming Mouse over USB */
+ { /* Logitech G203/Prodigy Gaming Mouse */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC084) },
+ { /* Logitech G302 Gaming Mouse */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07F) },
+ { /* Logitech G303 Gaming Mouse */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC080) },
+ { /* Logitech G400 Gaming Mouse */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07E) },
+ { /* Logitech G403 Wireless Gaming Mouse over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC082) },
+ { /* Logitech G403 Gaming Mouse */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC083) },
+ { /* Logitech G403 Hero Gaming Mouse over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08F) },
+ { /* Logitech G502 Proteus Core Gaming Mouse */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07D) },
+ { /* Logitech G502 Proteus Spectrum Gaming Mouse over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC332) },
+ { /* Logitech G502 Hero Gaming Mouse over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08B) },
{ /* Logitech G700 Gaming Mouse over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC06B) },
+ { /* Logitech G700s Gaming Mouse over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07C) },
+ { /* Logitech G703 Gaming Mouse over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC087) },
+ { /* Logitech G703 Hero Gaming Mouse over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC090) },
{ /* Logitech G900 Gaming Mouse over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC081) },
+ { /* Logitech G903 Gaming Mouse over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC086) },
+ { /* Logitech G903 Hero Gaming Mouse over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC091) },
{ /* Logitech G920 Wheel over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL),
.driver_data = HIDPP_QUIRK_CLASS_G920 | HIDPP_QUIRK_FORCE_OUTPUT_REPORTS},
+ { /* Logitech G Pro Gaming Mouse over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC088) },
{ /* MX5000 keyboard over Bluetooth */
HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb305),
--
2.20.1
^ permalink raw reply related
* Re: [PATCH 0/2] Fix support of a few Logitech devices broken in 5.3
From: Benjamin Tissoires @ 2019-08-13 14:36 UTC (permalink / raw)
To: Filipe Laíns; +Cc: Jiri Kosina, open list:HID CORE LAYER, lkml
In-Reply-To: <d558b953e88558b8d7955e591fefbe898edeb3ae.camel@archlinux.org>
On Tue, Aug 13, 2019 at 4:21 PM Filipe Laíns <lains@archlinux.org> wrote:
>
> On Tue, 2019-08-13 at 15:38 +0200, Benjamin Tissoires wrote:
> > Hi Jiri,
> >
> > another set of patches to send to Linus ASAP.
> > It turns out that we have been breaking devices, so this should
> > be sent before 5.3 final.
> >
> > Cheers,
> > Benjamin
> >
> > Benjamin Tissoires (2):
> > Revert "HID: logitech-hidpp: add USB PID for a few more supported
> > mice"
> > HID: logitech-hidpp: remove support for the G700 over USB
> >
> > drivers/hid/hid-logitech-hidpp.c | 22 ----------------------
> > 1 file changed, 22 deletions(-)
> >
>
> Reviewed-by: Filipe Laíns <lains@archlinux.org>
Thanks.
I have schedule those 2 patches into for-5.3/upstream-fixes.
Cheers,
Benjamin
^ permalink raw reply
* Re: [PATCH 0/2] Fix support of a few Logitech devices broken in 5.3
From: Filipe Laíns @ 2019-08-13 14:21 UTC (permalink / raw)
To: Benjamin Tissoires, Jiri Kosina; +Cc: linux-input, linux-kernel
In-Reply-To: <20190813133807.12384-1-benjamin.tissoires@redhat.com>
[-- Attachment #1: Type: text/plain, Size: 615 bytes --]
On Tue, 2019-08-13 at 15:38 +0200, Benjamin Tissoires wrote:
> Hi Jiri,
>
> another set of patches to send to Linus ASAP.
> It turns out that we have been breaking devices, so this should
> be sent before 5.3 final.
>
> Cheers,
> Benjamin
>
> Benjamin Tissoires (2):
> Revert "HID: logitech-hidpp: add USB PID for a few more supported
> mice"
> HID: logitech-hidpp: remove support for the G700 over USB
>
> drivers/hid/hid-logitech-hidpp.c | 22 ----------------------
> 1 file changed, 22 deletions(-)
>
Reviewed-by: Filipe Laíns <lains@archlinux.org>
Thanks,
Filipe Laíns
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply
* Re: [PATCH] Input: add support for polling to input devices
From: Benjamin Tissoires @ 2019-08-13 14:04 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: open list:HID CORE LAYER, lkml, Rob Herring
In-Reply-To: <20190812171135.GA178933@dtor-ws>
On Mon, Aug 12, 2019 at 7:11 PM Dmitry Torokhov
<dmitry.torokhov@gmail.com> wrote:
>
> Hi Benjamin,
>
> On Mon, Aug 12, 2019 at 06:50:38PM +0200, Benjamin Tissoires wrote:
> > Hi Dmitry,
> >
> > On Fri, Aug 9, 2019 at 7:35 PM Dmitry Torokhov
> > <dmitry.torokhov@gmail.com> wrote:
> > >
> > > Separating "normal" and "polled" input devices was a mistake, as often we
> > > want to allow the very same device work on both interrupt-driven and
> > > polled mode, depending on the board on which the device is used.
> > >
> > > This introduces new APIs:
> > >
> > > - input_setup_polling
> > > - input_set_poll_interval
> > > - input_set_min_poll_interval
> > > - input_set_max_poll_interval
> > >
> > > These new APIs allow switching an input device into polled mode with sysfs
> > > attributes matching drivers using input_polled_dev APIs that will be
> > > eventually removed.
> >
> > Are you sure that using sysfs is the correct way here?
> > I would think using generic properties that can be overwritten by the
> > DSDT or by the device tree would make things easier from a driver
> > point of view.
>
> Couple of points: I wanted it to be compatible with input-polldev.c so
> the sysfs attributes must match (so that we can convert existing drivers
> and zap input-polldev).
Oh, I missed that. Good point.
> I also am not sure if polling parameters are
> property of board, or it is either fundamental hardware limitation or
> simply desired system behavior.
I think it's a combination of everything: sometimes the board misses
the capability to not do IRQs for that device, and using properties
would be better here: you can define them where you need (board,
platform or device level), and have a working platfrom from the kernel
description entirely.
However, it doesn't solve the issue of input-polldev, so maybe
properties should be added on top of this sysfs.
> If Rob is OK with adding device
> properties I'd be fine adding them as a followup, otherwise we can have
> udev adjust the behavior as needed for given box shortly after boot.
Fair enough.
>
> >
> > Also, checkpatch complains about a few octal permissions that are
> > preferred over symbolic ones, and there is a possible 'out of memory'
> > nessage at drivers/input/input-poller.c:75.
>
> Yes, there is. It is there so we would know what device we were trying
> to set up when OOM happened. You can probable decipher the driver from
> the stack trace, but figuring particular device instance is harder.
Could you add a comment there explaining this choice? I have a feeling
you'll have to refuse a few patches of people running coccinelle
scripts and be too happy to send a kernel patch.
Other than that:
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cheers,
Benjamin
>
> Thanks.
>
> >
> > Cheers,
> > Benjamin
> >
> > >
> > > Tested-by: Michal Vokáč <michal.vokac@ysoft.com>
> > > Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> > > ---
> > > drivers/input/Makefile | 2 +-
> > > drivers/input/input-poller.c | 208 +++++++++++++++++++++++++++++++++++
> > > drivers/input/input-poller.h | 18 +++
> > > drivers/input/input.c | 36 ++++--
> > > include/linux/input.h | 12 ++
> > > 5 files changed, 268 insertions(+), 8 deletions(-)
> > >
> > > diff --git a/drivers/input/Makefile b/drivers/input/Makefile
> > > index 40de6a7be641..e35650930371 100644
> > > --- a/drivers/input/Makefile
> > > +++ b/drivers/input/Makefile
> > > @@ -6,7 +6,7 @@
> > > # Each configuration option enables a list of files.
> > >
> > > obj-$(CONFIG_INPUT) += input-core.o
> > > -input-core-y := input.o input-compat.o input-mt.o ff-core.o
> > > +input-core-y := input.o input-compat.o input-mt.o input-poller.o ff-core.o
> > >
> > > obj-$(CONFIG_INPUT_FF_MEMLESS) += ff-memless.o
> > > obj-$(CONFIG_INPUT_POLLDEV) += input-polldev.o
> > > diff --git a/drivers/input/input-poller.c b/drivers/input/input-poller.c
> > > new file mode 100644
> > > index 000000000000..e041adb04f5a
> > > --- /dev/null
> > > +++ b/drivers/input/input-poller.c
> > > @@ -0,0 +1,208 @@
> > > +// SPDX-License-Identifier: GPL-2.0-only
> > > +/*
> > > + * Support for polling mode for input devices.
> > > + */
> > > +
> > > +#include <linux/device.h>
> > > +#include <linux/input.h>
> > > +#include <linux/jiffies.h>
> > > +#include <linux/mutex.h>
> > > +#include <linux/slab.h>
> > > +#include <linux/types.h>
> > > +#include <linux/workqueue.h>
> > > +#include "input-poller.h"
> > > +
> > > +struct input_dev_poller {
> > > + void (*poll)(struct input_dev *dev);
> > > +
> > > + unsigned int poll_interval; /* msec */
> > > + unsigned int poll_interval_max; /* msec */
> > > + unsigned int poll_interval_min; /* msec */
> > > +
> > > + struct input_dev *input;
> > > + struct delayed_work work;
> > > +};
> > > +
> > > +static void input_dev_poller_queue_work(struct input_dev_poller *poller)
> > > +{
> > > + unsigned long delay;
> > > +
> > > + delay = msecs_to_jiffies(poller->poll_interval);
> > > + if (delay >= HZ)
> > > + delay = round_jiffies_relative(delay);
> > > +
> > > + queue_delayed_work(system_freezable_wq, &poller->work, delay);
> > > +}
> > > +
> > > +static void input_dev_poller_work(struct work_struct *work)
> > > +{
> > > + struct input_dev_poller *poller =
> > > + container_of(work, struct input_dev_poller, work.work);
> > > +
> > > + poller->poll(poller->input);
> > > + input_dev_poller_queue_work(poller);
> > > +}
> > > +
> > > +void input_dev_poller_finalize(struct input_dev_poller *poller)
> > > +{
> > > + if (!poller->poll_interval)
> > > + poller->poll_interval = 500;
> > > + if (!poller->poll_interval_max)
> > > + poller->poll_interval_max = poller->poll_interval;
> > > +}
> > > +
> > > +void input_dev_poller_start(struct input_dev_poller *poller)
> > > +{
> > > + /* Only start polling if polling is enabled */
> > > + if (poller->poll_interval > 0) {
> > > + poller->poll(poller->input);
> > > + input_dev_poller_queue_work(poller);
> > > + }
> > > +}
> > > +
> > > +void input_dev_poller_stop(struct input_dev_poller *poller)
> > > +{
> > > + cancel_delayed_work_sync(&poller->work);
> > > +}
> > > +
> > > +int input_setup_polling(struct input_dev *dev,
> > > + void (*poll_fn)(struct input_dev *dev))
> > > +{
> > > + struct input_dev_poller *poller;
> > > +
> > > + poller = kzalloc(sizeof(*poller), GFP_KERNEL);
> > > + if (!poller) {
> > > + dev_err(dev->dev.parent ?: &dev->dev,
> > > + "%s: unable to allocate poller structure\n", __func__);
> > > + return -ENOMEM;
> > > + }
> > > +
> > > + INIT_DELAYED_WORK(&poller->work, input_dev_poller_work);
> > > + poller->input = dev;
> > > + poller->poll = poll_fn;
> > > +
> > > + dev->poller = poller;
> > > + return 0;
> > > +}
> > > +EXPORT_SYMBOL(input_setup_polling);
> > > +
> > > +static bool input_dev_ensure_poller(struct input_dev *dev)
> > > +{
> > > + if (!dev->poller) {
> > > + dev_err(dev->dev.parent ?: &dev->dev,
> > > + "poller structure has not been set up\n");
> > > + return false;
> > > + }
> > > +
> > > + return true;
> > > +}
> > > +
> > > +void input_set_poll_interval(struct input_dev *dev, unsigned int interval)
> > > +{
> > > + if (input_dev_ensure_poller(dev))
> > > + dev->poller->poll_interval = interval;
> > > +}
> > > +EXPORT_SYMBOL(input_set_poll_interval);
> > > +
> > > +void input_set_min_poll_interval(struct input_dev *dev, unsigned int interval)
> > > +{
> > > + if (input_dev_ensure_poller(dev))
> > > + dev->poller->poll_interval_min = interval;
> > > +}
> > > +EXPORT_SYMBOL(input_set_min_poll_interval);
> > > +
> > > +void input_set_max_poll_interval(struct input_dev *dev, unsigned int interval)
> > > +{
> > > + if (input_dev_ensure_poller(dev))
> > > + dev->poller->poll_interval_max = interval;
> > > +}
> > > +EXPORT_SYMBOL(input_set_max_poll_interval);
> > > +
> > > +/* SYSFS interface */
> > > +
> > > +static ssize_t input_dev_get_poll_interval(struct device *dev,
> > > + struct device_attribute *attr,
> > > + char *buf)
> > > +{
> > > + struct input_dev *input = to_input_dev(dev);
> > > +
> > > + return sprintf(buf, "%d\n", input->poller->poll_interval);
> > > +}
> > > +
> > > +static ssize_t input_dev_set_poll_interval(struct device *dev,
> > > + struct device_attribute *attr,
> > > + const char *buf, size_t count)
> > > +{
> > > + struct input_dev *input = to_input_dev(dev);
> > > + struct input_dev_poller *poller = input->poller;
> > > + unsigned int interval;
> > > + int err;
> > > +
> > > + err = kstrtouint(buf, 0, &interval);
> > > + if (err)
> > > + return err;
> > > +
> > > + if (interval < poller->poll_interval_min)
> > > + return -EINVAL;
> > > +
> > > + if (interval > poller->poll_interval_max)
> > > + return -EINVAL;
> > > +
> > > + mutex_lock(&input->mutex);
> > > +
> > > + poller->poll_interval = interval;
> > > +
> > > + if (input->users) {
> > > + cancel_delayed_work_sync(&poller->work);
> > > + if (poller->poll_interval > 0)
> > > + input_dev_poller_queue_work(poller);
> > > + }
> > > +
> > > + mutex_unlock(&input->mutex);
> > > +
> > > + return count;
> > > +}
> > > +
> > > +static DEVICE_ATTR(poll, S_IRUGO | S_IWUSR,
> > > + input_dev_get_poll_interval, input_dev_set_poll_interval);
> > > +
> > > +static ssize_t input_dev_get_poll_max(struct device *dev,
> > > + struct device_attribute *attr, char *buf)
> > > +{
> > > + struct input_dev *input = to_input_dev(dev);
> > > +
> > > + return sprintf(buf, "%d\n", input->poller->poll_interval_max);
> > > +}
> > > +
> > > +static DEVICE_ATTR(max, S_IRUGO, input_dev_get_poll_max, NULL);
> > > +
> > > +static ssize_t input_dev_get_poll_min(struct device *dev,
> > > + struct device_attribute *attr, char *buf)
> > > +{
> > > + struct input_dev *input = to_input_dev(dev);
> > > +
> > > + return sprintf(buf, "%d\n", input->poller->poll_interval_min);
> > > +}
> > > +
> > > +static DEVICE_ATTR(min, S_IRUGO, input_dev_get_poll_min, NULL);
> > > +
> > > +static umode_t input_poller_attrs_visible(struct kobject *kobj,
> > > + struct attribute *attr, int n)
> > > +{
> > > + struct device *dev = kobj_to_dev(kobj);
> > > + struct input_dev *input = to_input_dev(dev);
> > > +
> > > + return input->poller ? attr->mode : 0;
> > > +}
> > > +
> > > +static struct attribute *input_poller_attrs[] = {
> > > + &dev_attr_poll.attr,
> > > + &dev_attr_max.attr,
> > > + &dev_attr_min.attr,
> > > + NULL
> > > +};
> > > +
> > > +struct attribute_group input_poller_attribute_group = {
> > > + .is_visible = input_poller_attrs_visible,
> > > + .attrs = input_poller_attrs,
> > > +};
> > > diff --git a/drivers/input/input-poller.h b/drivers/input/input-poller.h
> > > new file mode 100644
> > > index 000000000000..e3fca0be1d32
> > > --- /dev/null
> > > +++ b/drivers/input/input-poller.h
> > > @@ -0,0 +1,18 @@
> > > +/* SPDX-License-Identifier: GPL-2.0-only */
> > > +#ifndef _INPUT_POLLER_H
> > > +#define _INPUT_POLLER_H
> > > +
> > > +/*
> > > + * Support for polling mode for input devices.
> > > + */
> > > +#include <linux/sysfs.h>
> > > +
> > > +struct input_dev_poller;
> > > +
> > > +void input_dev_poller_finalize(struct input_dev_poller *poller);
> > > +void input_dev_poller_start(struct input_dev_poller *poller);
> > > +void input_dev_poller_stop(struct input_dev_poller *poller);
> > > +
> > > +extern struct attribute_group input_poller_attribute_group;
> > > +
> > > +#endif /* _INPUT_POLLER_H */
> > > diff --git a/drivers/input/input.c b/drivers/input/input.c
> > > index 7494a0dede79..c08aa3596144 100644
> > > --- a/drivers/input/input.c
> > > +++ b/drivers/input/input.c
> > > @@ -24,6 +24,7 @@
> > > #include <linux/mutex.h>
> > > #include <linux/rcupdate.h>
> > > #include "input-compat.h"
> > > +#include "input-poller.h"
> > >
> > > MODULE_AUTHOR("Vojtech Pavlik <vojtech@suse.cz>");
> > > MODULE_DESCRIPTION("Input core");
> > > @@ -603,20 +604,31 @@ int input_open_device(struct input_handle *handle)
> > >
> > > handle->open++;
> > >
> > > - if (!dev->users++ && dev->open)
> > > - retval = dev->open(dev);
> > > + if (dev->users++) {
> > > + /*
> > > + * Device is already opened, so we can exit immediately and
> > > + * report success.
> > > + */
> > > + goto out;
> > > + }
> > >
> > > - if (retval) {
> > > - dev->users--;
> > > - if (!--handle->open) {
> > > + if (dev->open) {
> > > + retval = dev->open(dev);
> > > + if (retval) {
> > > + dev->users--;
> > > + handle->open--;
> > > /*
> > > * Make sure we are not delivering any more events
> > > * through this handle
> > > */
> > > synchronize_rcu();
> > > + goto out;
> > > }
> > > }
> > >
> > > + if (dev->poller)
> > > + input_dev_poller_start(dev->poller);
> > > +
> > > out:
> > > mutex_unlock(&dev->mutex);
> > > return retval;
> > > @@ -655,8 +667,13 @@ void input_close_device(struct input_handle *handle)
> > >
> > > __input_release_device(handle);
> > >
> > > - if (!--dev->users && dev->close)
> > > - dev->close(dev);
> > > + if (!--dev->users) {
> > > + if (dev->poller)
> > > + input_dev_poller_stop(dev->poller);
> > > +
> > > + if (dev->close)
> > > + dev->close(dev);
> > > + }
> > >
> > > if (!--handle->open) {
> > > /*
> > > @@ -1502,6 +1519,7 @@ static const struct attribute_group *input_dev_attr_groups[] = {
> > > &input_dev_attr_group,
> > > &input_dev_id_attr_group,
> > > &input_dev_caps_attr_group,
> > > + &input_poller_attribute_group,
> > > NULL
> > > };
> > >
> > > @@ -1511,6 +1529,7 @@ static void input_dev_release(struct device *device)
> > >
> > > input_ff_destroy(dev);
> > > input_mt_destroy_slots(dev);
> > > + kfree(dev->poller);
> > > kfree(dev->absinfo);
> > > kfree(dev->vals);
> > > kfree(dev);
> > > @@ -2175,6 +2194,9 @@ int input_register_device(struct input_dev *dev)
> > > if (!dev->setkeycode)
> > > dev->setkeycode = input_default_setkeycode;
> > >
> > > + if (dev->poller)
> > > + input_dev_poller_finalize(dev->poller);
> > > +
> > > error = device_add(&dev->dev);
> > > if (error)
> > > goto err_free_vals;
> > > diff --git a/include/linux/input.h b/include/linux/input.h
> > > index e95a439d8bd5..94f277cd806a 100644
> > > --- a/include/linux/input.h
> > > +++ b/include/linux/input.h
> > > @@ -21,6 +21,8 @@
> > > #include <linux/timer.h>
> > > #include <linux/mod_devicetable.h>
> > >
> > > +struct input_dev_poller;
> > > +
> > > /**
> > > * struct input_value - input value representation
> > > * @type: type of value (EV_KEY, EV_ABS, etc)
> > > @@ -71,6 +73,8 @@ enum input_clock_type {
> > > * not sleep
> > > * @ff: force feedback structure associated with the device if device
> > > * supports force feedback effects
> > > + * @poller: poller structure associated with the device if device is
> > > + * set up to use polling mode
> > > * @repeat_key: stores key code of the last key pressed; used to implement
> > > * software autorepeat
> > > * @timer: timer for software autorepeat
> > > @@ -156,6 +160,8 @@ struct input_dev {
> > >
> > > struct ff_device *ff;
> > >
> > > + struct input_dev_poller *poller;
> > > +
> > > unsigned int repeat_key;
> > > struct timer_list timer;
> > >
> > > @@ -372,6 +378,12 @@ void input_unregister_device(struct input_dev *);
> > >
> > > void input_reset_device(struct input_dev *);
> > >
> > > +int input_setup_polling(struct input_dev *dev,
> > > + void (*poll_fn)(struct input_dev *dev));
> > > +void input_set_poll_interval(struct input_dev *dev, unsigned int interval);
> > > +void input_set_min_poll_interval(struct input_dev *dev, unsigned int interval);
> > > +void input_set_max_poll_interval(struct input_dev *dev, unsigned int interval);
> > > +
> > > int __must_check input_register_handler(struct input_handler *);
> > > void input_unregister_handler(struct input_handler *);
> > >
> > > --
> > > 2.23.0.rc1.153.gdeed80330f-goog
> > >
> > >
> > > --
> > > Dmitry
>
> --
> Dmitry
^ permalink raw reply
* Re: [PATCH] HID: uhid: actually use the err number from userspace
From: Benjamin Tissoires @ 2019-08-13 13:58 UTC (permalink / raw)
To: David Rheinsberg; +Cc: Jiri Kosina, open list:HID CORE LAYER, lkml
In-Reply-To: <CADyDSO4x49GWdRVkW=cytvMc7rM3NJkJ4-Sj-FjM9Gday7C-iw@mail.gmail.com>
On Tue, Aug 13, 2019 at 12:50 PM David Rheinsberg
<david.rheinsberg@gmail.com> wrote:
>
> Hey
>
> On Mon, Aug 12, 2019 at 6:21 PM Benjamin Tissoires
> <benjamin.tissoires@redhat.com> wrote:
> >
> > This can help debugging the situation
> >
> > Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
> > ---
> >
> > Hi,
> >
> > not entirely sure if we can use this in a such simple way.
> >
> > However, this is useful to mimic device behaviour from userspace.
> >
> > Cheers,
> > Benjamin
> >
> > drivers/hid/uhid.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
> > index fa0cc0899827..2fa32e7fc733 100644
> > --- a/drivers/hid/uhid.c
> > +++ b/drivers/hid/uhid.c
> > @@ -284,7 +284,7 @@ static int uhid_hid_set_report(struct hid_device *hid, unsigned char rnum,
> > goto unlock;
> >
> > if (uhid->report_buf.u.set_report_reply.err)
> > - ret = -EIO;
> > + ret = -uhid->report_buf.u.set_report_reply.err;
>
> I am generally in favor of this. But:
>
> 1) can you do this for both set_report *and* get_report?
right :)
>
> 2) I think you have to filter some of the error codes. For instance,
> if you return one of the -ERESTARTSYS codes, this might cause the
> syscall to restart (if auto-restart is enabled on this context). At
> the same time, this is not *that* bad. It might even be useful for the
> userspace driver to trigger an EINTR. At least we should be aware of
> this. So maybe filters are not necessary.. Mhhh. Comments?
I haven't thought at all of the side effects of letting the user
return a random error code.
I have the impression that anything below EHWPOISON (133) is
relatively safe. So maybe we should just make sure the error code is
below 134?
The ERESTARTSYS has a few warnings in the include file, so I guess the
side effects might be too much for what we want to deal with.
Cheers,
Benjamin
>
> Thanks
> David
>
> > else
> > ret = count;
> >
> > --
> > 2.19.2
> >
^ permalink raw reply
* Re: KASAN: out-of-bounds Read in hidraw_ioctl
From: Andrey Konovalov @ 2019-08-13 13:43 UTC (permalink / raw)
To: syzbot
Cc: Benjamin Tissoires, Jiri Kosina, linux-input, LKML, USB list,
syzkaller-bugs
In-Reply-To: <000000000000333f53058fb33243@google.com>
On Fri, Aug 9, 2019 at 8:18 PM syzbot
<syzbot+f817d84b72194c4a5fe2@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> git tree: https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=126120e2600000
> kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> dashboard link: https://syzkaller.appspot.com/bug?extid=f817d84b72194c4a5fe2
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
>
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+f817d84b72194c4a5fe2@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: out-of-bounds in hidraw_ioctl+0x609/0xae0
> drivers/hid/hidraw.c:380
> Read of size 4 at addr ffff8881cb9fc018 by task syz-executor.1/3309
>
> CPU: 1 PID: 3309 Comm: syz-executor.1 Not tainted 5.3.0-rc2+ #25
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0xca/0x13e lib/dump_stack.c:113
> print_address_description+0x6a/0x32c mm/kasan/report.c:351
> __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
> kasan_report+0xe/0x12 mm/kasan/common.c:612
> hidraw_ioctl+0x609/0xae0 drivers/hid/hidraw.c:380
> vfs_ioctl fs/ioctl.c:46 [inline]
> file_ioctl fs/ioctl.c:509 [inline]
> do_vfs_ioctl+0xd2d/0x1330 fs/ioctl.c:696
> ksys_ioctl+0x9b/0xc0 fs/ioctl.c:713
> __do_sys_ioctl fs/ioctl.c:720 [inline]
> __se_sys_ioctl fs/ioctl.c:718 [inline]
> __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718
> do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x459829
> Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
> 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
> ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
> RSP: 002b:00007f877bde2c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459829
> RDX: 0000000020001300 RSI: 0000000080044801 RDI: 0000000000000004
> RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007f877bde36d4
> R13: 00000000004c2206 R14: 00000000004d5610 R15: 00000000ffffffff
>
> Allocated by task 2751:
> save_stack+0x1b/0x80 mm/kasan/common.c:69
> set_track mm/kasan/common.c:77 [inline]
> __kasan_kmalloc mm/kasan/common.c:487 [inline]
> __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
> slab_post_alloc_hook mm/slab.h:520 [inline]
> slab_alloc_node mm/slub.c:2766 [inline]
> __kmalloc_node_track_caller+0xd0/0x230 mm/slub.c:4361
> __kmalloc_reserve.isra.0+0x39/0xe0 net/core/skbuff.c:141
> __alloc_skb+0xef/0x5a0 net/core/skbuff.c:209
> alloc_skb include/linux/skbuff.h:1055 [inline]
> alloc_uevent_skb+0x7b/0x210 lib/kobject_uevent.c:289
> uevent_net_broadcast_untagged lib/kobject_uevent.c:325 [inline]
> kobject_uevent_net_broadcast lib/kobject_uevent.c:408 [inline]
> kobject_uevent_env+0x8ee/0x1160 lib/kobject_uevent.c:592
> device_del+0x6b2/0xb10 drivers/base/core.c:2298
> usb_disconnect+0x4c3/0x8d0 drivers/usb/core/hub.c:2225
> hub_port_connect drivers/usb/core/hub.c:4949 [inline]
> hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
> port_event drivers/usb/core/hub.c:5359 [inline]
> hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441
> process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> kthread+0x318/0x420 kernel/kthread.c:255
> ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
>
> Freed by task 238:
> save_stack+0x1b/0x80 mm/kasan/common.c:69
> set_track mm/kasan/common.c:77 [inline]
> __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
> slab_free_hook mm/slub.c:1423 [inline]
> slab_free_freelist_hook mm/slub.c:1470 [inline]
> slab_free mm/slub.c:3012 [inline]
> kfree+0xe4/0x2f0 mm/slub.c:3953
> skb_free_head+0x8b/0xa0 net/core/skbuff.c:591
> skb_release_data+0x41f/0x7c0 net/core/skbuff.c:611
> skb_release_all+0x46/0x60 net/core/skbuff.c:665
> __kfree_skb net/core/skbuff.c:679 [inline]
> consume_skb net/core/skbuff.c:838 [inline]
> consume_skb+0xd9/0x320 net/core/skbuff.c:832
> skb_free_datagram+0x16/0xf0 net/core/datagram.c:328
> netlink_recvmsg+0x65e/0xee0 net/netlink/af_netlink.c:1996
> sock_recvmsg_nosec net/socket.c:871 [inline]
> sock_recvmsg net/socket.c:889 [inline]
> sock_recvmsg+0xca/0x110 net/socket.c:885
> ___sys_recvmsg+0x271/0x5a0 net/socket.c:2480
> __sys_recvmsg+0xe9/0x1b0 net/socket.c:2537
> do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> The buggy address belongs to the object at ffff8881cb9fc000
> which belongs to the cache kmalloc-1k of size 1024
> The buggy address is located 24 bytes inside of
> 1024-byte region [ffff8881cb9fc000, ffff8881cb9fc400)
> The buggy address belongs to the page:
> page:ffffea00072e7f00 refcount:1 mapcount:0 mapping:ffff8881da002280
> index:0x0 compound_mapcount: 0
> flags: 0x200000000010200(slab|head)
> raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881da002280
> raw: 0000000000000000 00000000000e000e 00000001ffffffff 0000000000000000
> page dumped because: kasan: bad access detected
>
> Memory state around the buggy address:
> ffff8881cb9fbf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
> ffff8881cb9fbf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
> > ffff8881cb9fc000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ^
> ffff8881cb9fc080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8881cb9fc100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ==================================================================
#syz dup: BUG: bad usercopy in hidraw_ioctl
>
>
> ---
> This bug is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this bug report. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply
* Re: KASAN: user-memory-access Read in hidraw_ioctl
From: Andrey Konovalov @ 2019-08-13 13:42 UTC (permalink / raw)
To: syzbot
Cc: Benjamin Tissoires, Jiri Kosina, linux-input, LKML, USB list,
syzkaller-bugs
In-Reply-To: <0000000000000de921058ee524e1@google.com>
On Tue, Jul 30, 2019 at 2:28 PM syzbot
<syzbot+5a8c44432a51154ff6d5@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: 7f7867ff usb-fuzzer: main usb gadget fuzzer driver
> git tree: https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=13c21ab4600000
> kernel config: https://syzkaller.appspot.com/x/.config?x=792eb47789f57810
> dashboard link: https://syzkaller.appspot.com/bug?extid=5a8c44432a51154ff6d5
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
>
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+5a8c44432a51154ff6d5@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: user-memory-access in _copy_to_user+0x124/0x150
> lib/usercopy.c:27
> Read of size 148 at addr 0000100000000000 by task syz-executor.2/19576
>
> CPU: 1 PID: 19576 Comm: syz-executor.2 Not tainted 5.3.0-rc2+ #23
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0xca/0x13e lib/dump_stack.c:113
> __kasan_report.cold+0x5/0x33 mm/kasan/report.c:486
> kasan_report+0xe/0x12 mm/kasan/common.c:612
> check_memory_region_inline mm/kasan/generic.c:185 [inline]
> check_memory_region+0x128/0x190 mm/kasan/generic.c:192
> _copy_to_user+0x124/0x150 lib/usercopy.c:27
> copy_to_user include/linux/uaccess.h:152 [inline]
> hidraw_ioctl+0x39c/0xae0 drivers/hid/hidraw.c:392
> vfs_ioctl fs/ioctl.c:46 [inline]
> file_ioctl fs/ioctl.c:509 [inline]
> do_vfs_ioctl+0xd2d/0x1330 fs/ioctl.c:696
> ksys_ioctl+0x9b/0xc0 fs/ioctl.c:713
> __do_sys_ioctl fs/ioctl.c:720 [inline]
> __se_sys_ioctl fs/ioctl.c:718 [inline]
> __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718
> do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x459829
> Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
> 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
> ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
> RSP: 002b:00007f6587cfbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459829
> RDX: 0000000020005640 RSI: 0000000090044802 RDI: 0000000000000004
> RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6587cfc6d4
> R13: 00000000004c21db R14: 00000000004d5540 R15: 00000000ffffffff
> ==================================================================
#syz dup: BUG: bad usercopy in hidraw_ioctl
>
>
> ---
> This bug is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this bug report. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply
* [PATCH 2/2] HID: logitech-hidpp: remove support for the G700 over USB
From: Benjamin Tissoires @ 2019-08-13 13:38 UTC (permalink / raw)
To: Filipe Laíns, Jiri Kosina
Cc: linux-input, linux-kernel, Benjamin Tissoires, stable
In-Reply-To: <20190813133807.12384-1-benjamin.tissoires@redhat.com>
The G700 suffers from the same issue than the G502:
when plugging it in, the driver tries to contact it but it fails.
This timeout is problematic as it introduce a delay in the boot,
and having only the mouse event node means that the hardware
macros keys can not be relayed to the userspace.
Link: https://github.com/libratbag/libratbag/issues/797
Fixes: 91cf9a98ae41 ("HID: logitech-hidpp: make .probe usbhid capable")
Cc: stable@vger.kernel.org # v5.2
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
---
drivers/hid/hid-logitech-hidpp.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 343052b117a9..0179f7ed77e5 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3751,8 +3751,6 @@ static const struct hid_device_id hidpp_devices[] = {
{ /* Logitech G403 Wireless Gaming Mouse over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC082) },
- { /* Logitech G700 Gaming Mouse over USB */
- HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC06B) },
{ /* Logitech G703 Gaming Mouse over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC087) },
{ /* Logitech G703 Hero Gaming Mouse over USB */
--
2.19.2
^ permalink raw reply related
* [PATCH 1/2] Revert "HID: logitech-hidpp: add USB PID for a few more supported mice"
From: Benjamin Tissoires @ 2019-08-13 13:38 UTC (permalink / raw)
To: Filipe Laíns, Jiri Kosina
Cc: linux-input, linux-kernel, Benjamin Tissoires
In-Reply-To: <20190813133807.12384-1-benjamin.tissoires@redhat.com>
This partially reverts commit 27fc32fd9417968a459d43d9a7c50fd423d53eb9.
It turns out that the G502 has some issues with hid-logitech-hidpp:
when plugging it in, the driver tries to contact it but it fails.
So the driver bails out leaving only the mouse event node available.
This timeout is problematic as it introduce a delay in the boot,
and having only the mouse event node means that the hardware
macros keys can not be relayed to the userspace.
Filipe and I just gave a shot at the following devices:
G403 Wireless (0xC082)
G703 (0xC087)
G703 Hero (0xC090)
G903 (0xC086)
G903 Hero (0xC091)
G Pro (0xC088)
Reverting the device we are not sure that works flawlessly.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
---
drivers/hid/hid-logitech-hidpp.c | 20 --------------------
1 file changed, 20 deletions(-)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 21268c9fa71a..343052b117a9 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3749,30 +3749,10 @@ static const struct hid_device_id hidpp_devices[] = {
{ L27MHZ_DEVICE(HID_ANY_ID) },
- { /* Logitech G203/Prodigy Gaming Mouse */
- HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC084) },
- { /* Logitech G302 Gaming Mouse */
- HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07F) },
- { /* Logitech G303 Gaming Mouse */
- HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC080) },
- { /* Logitech G400 Gaming Mouse */
- HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07E) },
{ /* Logitech G403 Wireless Gaming Mouse over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC082) },
- { /* Logitech G403 Gaming Mouse */
- HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC083) },
- { /* Logitech G403 Hero Gaming Mouse over USB */
- HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08F) },
- { /* Logitech G502 Proteus Core Gaming Mouse */
- HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07D) },
- { /* Logitech G502 Proteus Spectrum Gaming Mouse over USB */
- HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC332) },
- { /* Logitech G502 Hero Gaming Mouse over USB */
- HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08B) },
{ /* Logitech G700 Gaming Mouse over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC06B) },
- { /* Logitech G700s Gaming Mouse over USB */
- HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07C) },
{ /* Logitech G703 Gaming Mouse over USB */
HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC087) },
{ /* Logitech G703 Hero Gaming Mouse over USB */
--
2.19.2
^ permalink raw reply related
* [PATCH 0/2] Fix support of a few Logitech devices broken in 5.3
From: Benjamin Tissoires @ 2019-08-13 13:38 UTC (permalink / raw)
To: Filipe Laíns, Jiri Kosina
Cc: linux-input, linux-kernel, Benjamin Tissoires
Hi Jiri,
another set of patches to send to Linus ASAP.
It turns out that we have been breaking devices, so this should
be sent before 5.3 final.
Cheers,
Benjamin
Benjamin Tissoires (2):
Revert "HID: logitech-hidpp: add USB PID for a few more supported
mice"
HID: logitech-hidpp: remove support for the G700 over USB
drivers/hid/hid-logitech-hidpp.c | 22 ----------------------
1 file changed, 22 deletions(-)
--
2.19.2
^ permalink raw reply
* Re: WARNING in usbtouch_reset_resume
From: Andrey Konovalov @ 2019-08-13 13:12 UTC (permalink / raw)
To: syzbot
Cc: allison, Dmitry Torokhov, Greg Kroah-Hartman, Kate Stewart,
linux-input, LKML, USB list, Michael Ellerman, rfontana,
Henrik Rydberg, syzkaller-bugs, Thomas Gleixner
In-Reply-To: <000000000000c8bea1058f5d6bf6@google.com>
On Mon, Aug 5, 2019 at 1:58 PM syzbot
<syzbot+91f7bbcce580376d784e@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver
> git tree: https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=1104baf8600000
> kernel config: https://syzkaller.appspot.com/x/.config?x=cfa2c18fb6a8068e
> dashboard link: https://syzkaller.appspot.com/bug?extid=91f7bbcce580376d784e
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14199a62600000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17d94aaa600000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+91f7bbcce580376d784e@syzkaller.appspotmail.com
>
> input: USB Touchscreen 0eef:0002 as
> /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.180/input/input5
> usb 1-1: reset high-speed USB device number 2 using dummy_hcd
> usb 1-1: Using ep0 maxpacket: 32
> ------------[ cut here ]------------
> DEBUG_LOCKS_WARN_ON(lock->magic != lock)
> WARNING: CPU: 0 PID: 12 at kernel/locking/mutex.c:912 __mutex_lock_common
> kernel/locking/mutex.c:912 [inline]
> WARNING: CPU: 0 PID: 12 at kernel/locking/mutex.c:912
> __mutex_lock+0xd31/0x1360 kernel/locking/mutex.c:1077
> Kernel panic - not syncing: panic_on_warn set ...
> CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.3.0-rc2+ #25
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Workqueue: usb_hub_wq hub_event
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0xca/0x13e lib/dump_stack.c:113
> panic+0x2a3/0x6da kernel/panic.c:219
> __warn.cold+0x20/0x4a kernel/panic.c:576
> report_bug+0x262/0x2a0 lib/bug.c:186
> fixup_bug arch/x86/kernel/traps.c:179 [inline]
> fixup_bug arch/x86/kernel/traps.c:174 [inline]
> do_error_trap+0x12b/0x1e0 arch/x86/kernel/traps.c:272
> do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:291
> invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1026
> RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:912 [inline]
> RIP: 0010:__mutex_lock+0xd31/0x1360 kernel/locking/mutex.c:1077
> Code: d2 0f 85 f6 05 00 00 44 8b 05 7b de 1c 02 45 85 c0 0f 85 0a f4 ff ff
> 48 c7 c6 c0 92 c6 85 48 c7 c7 60 90 c6 85 e8 f4 c4 a6 fb <0f> 0b e9 f0 f3
> ff ff 65 48 8b 1c 25 00 ef 01 00 be 08 00 00 00 48
> RSP: 0018:ffff8881da20f6b0 EFLAGS: 00010286
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: ffffffff8128a0fd RDI: ffffed103b441ec8
> RBP: ffff8881da20f820 R08: ffff8881da1f9800 R09: fffffbfff0d9ee35
> R10: fffffbfff0d9ee34 R11: ffffffff86cf71a3 R12: 0000000000000000
> R13: dffffc0000000000 R14: ffff8881d2e291c8 R15: ffff8881d2fba228
> usbtouch_reset_resume+0xb1/0x170
> drivers/input/touchscreen/usbtouchscreen.c:1611
> usb_resume_interface drivers/usb/core/driver.c:1242 [inline]
> usb_resume_interface.isra.0+0x184/0x390 drivers/usb/core/driver.c:1210
> usb_resume_both+0x26a/0x7b0 drivers/usb/core/driver.c:1412
> __rpm_callback+0x27e/0x3c0 drivers/base/power/runtime.c:355
> rpm_callback+0x18f/0x230 drivers/base/power/runtime.c:485
> rpm_resume+0x10f7/0x1870 drivers/base/power/runtime.c:849
> __pm_runtime_resume+0x103/0x180 drivers/base/power/runtime.c:1076
> pm_runtime_get_sync include/linux/pm_runtime.h:226 [inline]
> usb_autoresume_device+0x1e/0x60 drivers/usb/core/driver.c:1599
> usb_remote_wakeup+0x7b/0xb0 drivers/usb/core/hub.c:3603
> hub_port_connect_change drivers/usb/core/hub.c:5199 [inline]
> port_event drivers/usb/core/hub.c:5359 [inline]
> hub_event+0x246c/0x3640 drivers/usb/core/hub.c:5441
> process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
> worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> kthread+0x318/0x420 kernel/kthread.c:255
> ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> Kernel Offset: disabled
> Rebooting in 86400 seconds..
#syz dup: WARNING in usbtouch_open
>
>
> ---
> This bug is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this bug report. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> syzbot can test patches for this bug, for details see:
> https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply
* Re: INFO: trying to register non-static key in usbtouch_reset_resume
From: Andrey Konovalov @ 2019-08-13 13:11 UTC (permalink / raw)
To: syzbot
Cc: allison, Dmitry Torokhov, Greg Kroah-Hartman, linux-input, LKML,
USB list, Michael Ellerman, rfontana, Henrik Rydberg,
syzkaller-bugs, Thomas Gleixner
In-Reply-To: <000000000000773344058bbe0858@google.com>
On Thu, Jun 20, 2019 at 11:33 AM syzbot
<syzbot+933daad9be4e67ba91a9@syzkaller.appspotmail.com> wrote:
>
> syzbot has found a reproducer for the following crash on:
>
> HEAD commit: 9939f56e usb-fuzzer: main usb gadget fuzzer driver
> git tree: https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=100c063aa00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=df134eda130bb43a
> dashboard link: https://syzkaller.appspot.com/bug?extid=933daad9be4e67ba91a9
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=144fa5e6a00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13d12de6a00000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+933daad9be4e67ba91a9@syzkaller.appspotmail.com
>
> usb 1-1: reset low-speed USB device number 2 using dummy_hcd
> INFO: trying to register non-static key.
> the code is fine but needs lockdep annotation.
> turning off the locking correctness validator.
> CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.2.0-rc5+ #11
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Workqueue: usb_hub_wq hub_event
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0xca/0x13e lib/dump_stack.c:113
> assign_lock_key kernel/locking/lockdep.c:775 [inline]
> register_lock_class+0x11ae/0x1240 kernel/locking/lockdep.c:1084
> __lock_acquire+0x11d/0x5340 kernel/locking/lockdep.c:3674
> lock_acquire+0x100/0x2b0 kernel/locking/lockdep.c:4303
> __mutex_lock_common kernel/locking/mutex.c:926 [inline]
> __mutex_lock+0xf9/0x12b0 kernel/locking/mutex.c:1073
> usbtouch_reset_resume+0xb1/0x170
> drivers/input/touchscreen/usbtouchscreen.c:1611
> usb_resume_interface drivers/usb/core/driver.c:1242 [inline]
> usb_resume_interface.isra.0+0x184/0x390 drivers/usb/core/driver.c:1210
> usb_resume_both+0x23d/0x780 drivers/usb/core/driver.c:1412
> __rpm_callback+0x27e/0x3c0 drivers/base/power/runtime.c:355
> rpm_callback+0x18f/0x230 drivers/base/power/runtime.c:485
> rpm_resume+0x10c5/0x1840 drivers/base/power/runtime.c:849
> __pm_runtime_resume+0x103/0x180 drivers/base/power/runtime.c:1076
> pm_runtime_get_sync include/linux/pm_runtime.h:226 [inline]
> usb_autoresume_device+0x1e/0x60 drivers/usb/core/driver.c:1599
> usb_remote_wakeup+0x7b/0xb0 drivers/usb/core/hub.c:3601
> hub_port_connect_change drivers/usb/core/hub.c:5190 [inline]
> port_event drivers/usb/core/hub.c:5350 [inline]
> hub_event+0x23d7/0x3590 drivers/usb/core/hub.c:5432
> process_one_work+0x905/0x1570 kernel/workqueue.c:2269
> worker_thread+0x96/0xe20 kernel/workqueue.c:2415
> kthread+0x30b/0x410 kernel/kthread.c:255
> ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> dummy_hcd dummy_hcd.0: port status 0x00010100 has changes
> dummy_hcd dummy_hcd.0: port status 0x00010101 has changes
> dummy_hcd dummy_hcd.0: port status 0x00100303 has changes
> usb 1-1: reset low-speed USB device number 2 using dummy_hcd
> dummy_hcd dummy_hcd.0: port status 0x00100303 has changes
> usb usb1: dummy_bus_suspend
> usb usb1: dummy_bus_resume
> dummy_hcd dummy_hcd.0: port status 0x00010100 has changes
> dummy_hcd dummy_hcd.0: port status 0x00100303 has changes
> usb 1-1: reset low-speed USB device number 2 using dummy_hcd
> dummy_hcd dummy_hcd.0: port status 0x00100303 has changes
> usb usb1: dummy_bus_suspend
> usb usb1: dummy_bus_resume
> dummy_hcd dummy_hcd.0: port status 0x00010100 has changes
> dummy_hcd dummy_hcd.0: port status 0x00100303 has changes
> usb 1-1: reset low-speed USB device number 2 using dummy_hcd
> dummy_hcd dummy_hcd.0: port status 0x00100303 has changes
> usb usb1: dummy_bus_suspend
> usb usb1: dummy_bus_resume
> dummy_hcd dummy_hcd.0: port status 0x00010100 has changes
> dummy_hcd dummy_hcd.0: port status 0x00100303 has changes
> usb 1-1: reset low-speed USB device number 2 using dummy_hcd
> dummy_hcd dummy_hcd.0: port status 0x00100303 has changes
> usb usb1: dummy_bus_suspend
> usb usb1: dummy_bus_resume
> dummy_hcd dummy_hcd.0: port status 0x00010100 has changes
> dummy_hcd dummy_hcd.0: port status 0x00100303 has changes
> usb 1-1: reset low-speed USB device number 2 using dummy_hcd
> dummy_hcd dummy_hcd.0: port status 0x00100303 has changes
>
#syz dup: WARNING in usbtouch_open
^ permalink raw reply
* Re: [PATCH] HID: uhid: actually use the err number from userspace
From: David Rheinsberg @ 2019-08-13 10:49 UTC (permalink / raw)
To: Benjamin Tissoires; +Cc: Jiri Kosina, linux-input, linux-kernel
In-Reply-To: <20190812162105.13428-1-benjamin.tissoires@redhat.com>
Hey
On Mon, Aug 12, 2019 at 6:21 PM Benjamin Tissoires
<benjamin.tissoires@redhat.com> wrote:
>
> This can help debugging the situation
>
> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
> ---
>
> Hi,
>
> not entirely sure if we can use this in a such simple way.
>
> However, this is useful to mimic device behaviour from userspace.
>
> Cheers,
> Benjamin
>
> drivers/hid/uhid.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
> index fa0cc0899827..2fa32e7fc733 100644
> --- a/drivers/hid/uhid.c
> +++ b/drivers/hid/uhid.c
> @@ -284,7 +284,7 @@ static int uhid_hid_set_report(struct hid_device *hid, unsigned char rnum,
> goto unlock;
>
> if (uhid->report_buf.u.set_report_reply.err)
> - ret = -EIO;
> + ret = -uhid->report_buf.u.set_report_reply.err;
I am generally in favor of this. But:
1) can you do this for both set_report *and* get_report?
2) I think you have to filter some of the error codes. For instance,
if you return one of the -ERESTARTSYS codes, this might cause the
syscall to restart (if auto-restart is enabled on this context). At
the same time, this is not *that* bad. It might even be useful for the
userspace driver to trigger an EINTR. At least we should be aware of
this. So maybe filters are not necessary.. Mhhh. Comments?
Thanks
David
> else
> ret = count;
>
> --
> 2.19.2
>
^ permalink raw reply
* Re: [PATCH] Input: cros_ec_keyb: Add back missing mask for event_type
From: Nicolas Boichat @ 2019-08-13 9:47 UTC (permalink / raw)
To: Fei Shao
Cc: linux-arm Mailing List, Dmitry Torokhov, Benson Leung,
Enric Balletbo i Serra, Guenter Roeck, Ting Shen, Brian Norris,
open list:HID CORE LAYER, lkml
In-Reply-To: <20190813093821.74158-1-fshao@chromium.org>
On Tue, Aug 13, 2019 at 5:38 PM Fei Shao <fshao@chromium.org> wrote:
>
> In the previous patch we didn't mask out event_type in case statement,
> so switches are always picked instead of buttons, which results in
> ChromeOS devices misbehaving when power button is pressed.
> This patch adds back the missing mask.
>
> Fixes: d096aa3eb604 ("Input: cros_ec_keyb: mask out extra flags in event_type")
> Signed-off-by: Fei Shao <fshao@chromium.org>
Reviewed-by: Nicolas Boichat <drinkcat@chromium.org>
> ---
> drivers/input/keyboard/cros_ec_keyb.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
> index 38cb6d82d8fe..bef7bee6f05e 100644
> --- a/drivers/input/keyboard/cros_ec_keyb.c
> +++ b/drivers/input/keyboard/cros_ec_keyb.c
> @@ -226,6 +226,8 @@ static int cros_ec_keyb_work(struct notifier_block *nb,
> {
> struct cros_ec_keyb *ckdev = container_of(nb, struct cros_ec_keyb,
> notifier);
> + uint8_t mkbp_event_type = ckdev->ec->event_data.event_type &
> + EC_MKBP_EVENT_TYPE_MASK;
> u32 val;
> unsigned int ev_type;
>
> @@ -237,7 +239,7 @@ static int cros_ec_keyb_work(struct notifier_block *nb,
> if (queued_during_suspend && !device_may_wakeup(ckdev->dev))
> return NOTIFY_OK;
>
> - switch (ckdev->ec->event_data.event_type & EC_MKBP_EVENT_TYPE_MASK) {
> + switch (mkbp_event_type) {
> case EC_MKBP_EVENT_KEY_MATRIX:
> pm_wakeup_event(ckdev->dev, 0);
>
> @@ -264,7 +266,7 @@ static int cros_ec_keyb_work(struct notifier_block *nb,
> case EC_MKBP_EVENT_SWITCH:
> pm_wakeup_event(ckdev->dev, 0);
>
> - if (ckdev->ec->event_data.event_type == EC_MKBP_EVENT_BUTTON) {
> + if (mkbp_event_type == EC_MKBP_EVENT_BUTTON) {
> val = get_unaligned_le32(
> &ckdev->ec->event_data.data.buttons);
> ev_type = EV_KEY;
> --
> 2.23.0.rc1.153.gdeed80330f-goog
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox