Skip to content

Commit

Permalink
HID: check for valid USB device for many HID drivers
Browse files Browse the repository at this point in the history
Many HID drivers assume that the HID device assigned to them is a USB
device as that was the only way HID devices used to be able to be
created in Linux.  However, with the additional ways that HID devices
can be created for many different bus types, that is no longer true, so
properly check that we have a USB device associated with the HID device
before allowing a driver that makes this assumption to claim it.

Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: Michael Zaidman <michael.zaidman@gmail.com>
Cc: Stefan Achatz <erazor_de@users.sourceforge.net>
Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Cc: linux-input@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
[bentiss: amended for thrustmater.c hunk to apply]
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211201183503.2373082-3-gregkh@linuxfoundation.org
  • Loading branch information
Greg Kroah-Hartman authored and Benjamin Tissoires committed Dec 2, 2021
1 parent 720ac46 commit 9302095
Show file tree
Hide file tree
Showing 23 changed files with 92 additions and 9 deletions.
3 changes: 3 additions & 0 deletions drivers/hid/hid-chicony.c
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,9 @@ static int ch_probe(struct hid_device *hdev, const struct hid_device_id *id)
{
int ret;

if (!hid_is_usb(hdev))
return -EINVAL;

hdev->quirks |= HID_QUIRK_INPUT_PER_APP;
ret = hid_parse(hdev);
if (ret) {
Expand Down
7 changes: 6 additions & 1 deletion drivers/hid/hid-corsair.c
Original file line number Diff line number Diff line change
Expand Up @@ -553,7 +553,12 @@ static int corsair_probe(struct hid_device *dev, const struct hid_device_id *id)
int ret;
unsigned long quirks = id->driver_data;
struct corsair_drvdata *drvdata;
struct usb_interface *usbif = to_usb_interface(dev->dev.parent);
struct usb_interface *usbif;

if (!hid_is_usb(dev))
return -EINVAL;

usbif = to_usb_interface(dev->dev.parent);

drvdata = devm_kzalloc(&dev->dev, sizeof(struct corsair_drvdata),
GFP_KERNEL);
Expand Down
2 changes: 1 addition & 1 deletion drivers/hid/hid-elan.c
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ struct elan_drvdata {

static int is_not_elan_touchpad(struct hid_device *hdev)
{
if (hdev->bus == BUS_USB) {
if (hid_is_usb(hdev)) {
struct usb_interface *intf = to_usb_interface(hdev->dev.parent);

return (intf->altsetting->desc.bInterfaceNumber !=
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-elo.c
Original file line number Diff line number Diff line change
Expand Up @@ -230,6 +230,9 @@ static int elo_probe(struct hid_device *hdev, const struct hid_device_id *id)
int ret;
struct usb_device *udev;

if (!hid_is_usb(hdev))
return -EINVAL;

priv = kzalloc(sizeof(*priv), GFP_KERNEL);
if (!priv)
return -ENOMEM;
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-ft260.c
Original file line number Diff line number Diff line change
Expand Up @@ -915,6 +915,9 @@ static int ft260_probe(struct hid_device *hdev, const struct hid_device_id *id)
struct ft260_get_chip_version_report version;
int ret;

if (!hid_is_usb(hdev))
return -EINVAL;

dev = devm_kzalloc(&hdev->dev, sizeof(*dev), GFP_KERNEL);
if (!dev)
return -ENOMEM;
Expand Down
9 changes: 7 additions & 2 deletions drivers/hid/hid-holtek-kbd.c
Original file line number Diff line number Diff line change
Expand Up @@ -140,12 +140,17 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type,
static int holtek_kbd_probe(struct hid_device *hdev,
const struct hid_device_id *id)
{
struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
int ret = hid_parse(hdev);
struct usb_interface *intf;
int ret;

if (!hid_is_usb(hdev))
return -EINVAL;

ret = hid_parse(hdev);
if (!ret)
ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);

intf = to_usb_interface(hdev->dev.parent);
if (!ret && intf->cur_altsetting->desc.bInterfaceNumber == 1) {
struct hid_input *hidinput;
list_for_each_entry(hidinput, &hdev->inputs, list) {
Expand Down
9 changes: 9 additions & 0 deletions drivers/hid/hid-holtek-mouse.c
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,14 @@ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
return rdesc;
}

static int holtek_mouse_probe(struct hid_device *hdev,
const struct hid_device_id *id)
{
if (!hid_is_usb(hdev))
return -EINVAL;
return 0;
}

static const struct hid_device_id holtek_mouse_devices[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067) },
Expand All @@ -83,6 +91,7 @@ static struct hid_driver holtek_mouse_driver = {
.name = "holtek_mouse",
.id_table = holtek_mouse_devices,
.report_fixup = holtek_mouse_report_fixup,
.probe = holtek_mouse_probe,
};

module_hid_driver(holtek_mouse_driver);
Expand Down
10 changes: 8 additions & 2 deletions drivers/hid/hid-lg.c
Original file line number Diff line number Diff line change
Expand Up @@ -749,12 +749,18 @@ static int lg_raw_event(struct hid_device *hdev, struct hid_report *report,

static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id)
{
struct usb_interface *iface = to_usb_interface(hdev->dev.parent);
__u8 iface_num = iface->cur_altsetting->desc.bInterfaceNumber;
struct usb_interface *iface;
__u8 iface_num;
unsigned int connect_mask = HID_CONNECT_DEFAULT;
struct lg_drv_data *drv_data;
int ret;

if (!hid_is_usb(hdev))
return -EINVAL;

iface = to_usb_interface(hdev->dev.parent);
iface_num = iface->cur_altsetting->desc.bInterfaceNumber;

/* G29 only work with the 1st interface */
if ((hdev->product == USB_DEVICE_ID_LOGITECH_G29_WHEEL) &&
(iface_num != 0)) {
Expand Down
10 changes: 8 additions & 2 deletions drivers/hid/hid-prodikeys.c
Original file line number Diff line number Diff line change
Expand Up @@ -798,12 +798,18 @@ static int pk_raw_event(struct hid_device *hdev, struct hid_report *report,
static int pk_probe(struct hid_device *hdev, const struct hid_device_id *id)
{
int ret;
struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
unsigned short ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
struct usb_interface *intf;
unsigned short ifnum;
unsigned long quirks = id->driver_data;
struct pk_device *pk;
struct pcmidi_snd *pm = NULL;

if (!hid_is_usb(hdev))
return -EINVAL;

intf = to_usb_interface(hdev->dev.parent);
ifnum = intf->cur_altsetting->desc.bInterfaceNumber;

pk = kzalloc(sizeof(*pk), GFP_KERNEL);
if (pk == NULL) {
hid_err(hdev, "can't alloc descriptor\n");
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-roccat-arvo.c
Original file line number Diff line number Diff line change
Expand Up @@ -344,6 +344,9 @@ static int arvo_probe(struct hid_device *hdev,
{
int retval;

if (!hid_is_usb(hdev))
return -EINVAL;

retval = hid_parse(hdev);
if (retval) {
hid_err(hdev, "parse failed\n");
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-roccat-isku.c
Original file line number Diff line number Diff line change
Expand Up @@ -324,6 +324,9 @@ static int isku_probe(struct hid_device *hdev,
{
int retval;

if (!hid_is_usb(hdev))
return -EINVAL;

retval = hid_parse(hdev);
if (retval) {
hid_err(hdev, "parse failed\n");
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-roccat-kone.c
Original file line number Diff line number Diff line change
Expand Up @@ -749,6 +749,9 @@ static int kone_probe(struct hid_device *hdev, const struct hid_device_id *id)
{
int retval;

if (!hid_is_usb(hdev))
return -EINVAL;

retval = hid_parse(hdev);
if (retval) {
hid_err(hdev, "parse failed\n");
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-roccat-koneplus.c
Original file line number Diff line number Diff line change
Expand Up @@ -431,6 +431,9 @@ static int koneplus_probe(struct hid_device *hdev,
{
int retval;

if (!hid_is_usb(hdev))
return -EINVAL;

retval = hid_parse(hdev);
if (retval) {
hid_err(hdev, "parse failed\n");
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-roccat-konepure.c
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,9 @@ static int konepure_probe(struct hid_device *hdev,
{
int retval;

if (!hid_is_usb(hdev))
return -EINVAL;

retval = hid_parse(hdev);
if (retval) {
hid_err(hdev, "parse failed\n");
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-roccat-kovaplus.c
Original file line number Diff line number Diff line change
Expand Up @@ -501,6 +501,9 @@ static int kovaplus_probe(struct hid_device *hdev,
{
int retval;

if (!hid_is_usb(hdev))
return -EINVAL;

retval = hid_parse(hdev);
if (retval) {
hid_err(hdev, "parse failed\n");
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-roccat-lua.c
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,9 @@ static int lua_probe(struct hid_device *hdev,
{
int retval;

if (!hid_is_usb(hdev))
return -EINVAL;

retval = hid_parse(hdev);
if (retval) {
hid_err(hdev, "parse failed\n");
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-roccat-pyra.c
Original file line number Diff line number Diff line change
Expand Up @@ -449,6 +449,9 @@ static int pyra_probe(struct hid_device *hdev, const struct hid_device_id *id)
{
int retval;

if (!hid_is_usb(hdev))
return -EINVAL;

retval = hid_parse(hdev);
if (retval) {
hid_err(hdev, "parse failed\n");
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-roccat-ryos.c
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,9 @@ static int ryos_probe(struct hid_device *hdev,
{
int retval;

if (!hid_is_usb(hdev))
return -EINVAL;

retval = hid_parse(hdev);
if (retval) {
hid_err(hdev, "parse failed\n");
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-roccat-savu.c
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,9 @@ static int savu_probe(struct hid_device *hdev,
{
int retval;

if (!hid_is_usb(hdev))
return -EINVAL;

retval = hid_parse(hdev);
if (retval) {
hid_err(hdev, "parse failed\n");
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-samsung.c
Original file line number Diff line number Diff line change
Expand Up @@ -152,6 +152,9 @@ static int samsung_probe(struct hid_device *hdev,
int ret;
unsigned int cmask = HID_CONNECT_DEFAULT;

if (!hid_is_usb(hdev))
return -EINVAL;

ret = hid_parse(hdev);
if (ret) {
hid_err(hdev, "parse failed\n");
Expand Down
6 changes: 5 additions & 1 deletion drivers/hid/hid-sony.c
Original file line number Diff line number Diff line change
Expand Up @@ -3000,7 +3000,6 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
sc->quirks = quirks;
hid_set_drvdata(hdev, sc);
sc->hdev = hdev;
usbdev = to_usb_device(sc->hdev->dev.parent->parent);

ret = hid_parse(hdev);
if (ret) {
Expand Down Expand Up @@ -3043,6 +3042,11 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
}

if (sc->quirks & (GHL_GUITAR_PS3WIIU | GHL_GUITAR_PS4)) {
if (!hid_is_usb(hdev))
return -EINVAL;

usbdev = to_usb_device(sc->hdev->dev.parent->parent);

sc->ghl_urb = usb_alloc_urb(0, GFP_ATOMIC);
if (!sc->ghl_urb)
return -ENOMEM;
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-thrustmaster.c
Original file line number Diff line number Diff line change
Expand Up @@ -274,6 +274,9 @@ static int thrustmaster_probe(struct hid_device *hdev, const struct hid_device_i
int ret = 0;
struct tm_wheel *tm_wheel = NULL;

if (!hid_is_usb(hdev))
return -EINVAL;

ret = hid_parse(hdev);
if (ret) {
hid_err(hdev, "parse failed with error %d\n", ret);
Expand Down
3 changes: 3 additions & 0 deletions drivers/hid/hid-uclogic-core.c
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,9 @@ static int uclogic_probe(struct hid_device *hdev,
struct uclogic_drvdata *drvdata = NULL;
bool params_initialized = false;

if (!hid_is_usb(hdev))
return -EINVAL;

/*
* libinput requires the pad interface to be on a different node
* than the pen, so use QUIRK_MULTI_INPUT for all tablets.
Expand Down

0 comments on commit 9302095

Please sign in to comment.