Commit bfb01957 authored by Jiri Kosina's avatar Jiri Kosina
Browse files

Merge branch 'for-6.17/core' into for-linus 

- hardening of HID core parser against conversion to 0 bits in s32ton()
  by buggy/malicious devices (Alan Stern)
parents 069e79a0 a6b87bfc

drivers/hid/hid-core.c

+8 −4
Original line number Diff line number Diff line
@@ -66,8 +66,12 @@ static s32 snto32(__u32 value, unsigned int n) 


static u32 s32ton(__s32 value, unsigned int n)

{

	s32 a = value >> (n - 1);

	s32 a;



	if (!value || !n)

		return 0;



	a = value >> (n - 1);

	if (a && a != -1)

		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;

	return value & ((1 << n) - 1);
@@ -659,9 +663,9 @@ static int hid_parser_main(struct hid_parser *parser, struct hid_item *item) 
	default:

		if (item->tag >= HID_MAIN_ITEM_TAG_RESERVED_MIN &&

			item->tag <= HID_MAIN_ITEM_TAG_RESERVED_MAX)

			hid_warn(parser->device, "reserved main item tag 0x%x\n", item->tag);

			hid_warn_ratelimited(parser->device, "reserved main item tag 0x%x\n", item->tag);

		else

			hid_warn(parser->device, "unknown main item tag 0x%x\n", item->tag);

			hid_warn_ratelimited(parser->device, "unknown main item tag 0x%x\n", item->tag);

		ret = 0;

	}
@@ -2806,7 +2810,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *a, 
{

	struct hid_device *hdev = container_of(dev, struct hid_device, dev);



	return scnprintf(buf, PAGE_SIZE, "hid:b%04Xg%04Xv%08Xp%08X\n",

	return sysfs_emit(buf, "hid:b%04Xg%04Xv%08Xp%08X\n",

			 hdev->bus, hdev->group, hdev->vendor, hdev->product);

}

static DEVICE_ATTR_RO(modalias);

drivers/hid/hid-debug.c

+1 −1
Original line number Diff line number Diff line
@@ -3726,7 +3726,7 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, 
			 */

			if (!list->hdev || !list->hdev->debug) {

				ret = -EIO;

				set_current_state(TASK_RUNNING);

				__set_current_state(TASK_RUNNING);

				goto out;

			}

drivers/hid/hid-lg4ff.c

+3 −3
Original line number Diff line number Diff line
@@ -956,7 +956,7 @@ static ssize_t lg4ff_combine_show(struct device *dev, struct device_attribute *a 
		return 0;

	}



	count = scnprintf(buf, PAGE_SIZE, "%u\n", entry->wdata.combine);

	count = sysfs_emit(buf, "%u\n", entry->wdata.combine);

	return count;

}
@@ -1009,7 +1009,7 @@ static ssize_t lg4ff_range_show(struct device *dev, struct device_attribute *att 
		return 0;

	}



	count = scnprintf(buf, PAGE_SIZE, "%u\n", entry->wdata.range);

	count = sysfs_emit(buf, "%u\n", entry->wdata.range);

	return count;

}
@@ -1073,7 +1073,7 @@ static ssize_t lg4ff_real_id_show(struct device *dev, struct device_attribute *a 
		return 0;

	}



	count = scnprintf(buf, PAGE_SIZE, "%s: %s\n", entry->wdata.real_tag, entry->wdata.real_name);

	count = sysfs_emit(buf, "%s: %s\n", entry->wdata.real_tag, entry->wdata.real_name);

	return count;

}

include/linux/hid.h

+7 −1
Original line number Diff line number Diff line
@@ -1216,7 +1216,11 @@ static inline void hid_hw_wait(struct hid_device *hdev) 
/**

 * hid_report_len - calculate the report length

 *

 * @report: the report we want to know the length

 * @report: the report whose length we want to know

 *

 * The length counts the report ID byte, but only if the ID is nonzero

 * and therefore is included in the report.  Reports whose ID is zero

 * never include an ID byte.

 */

static inline u32 hid_report_len(struct hid_report *report)

{
@@ -1239,6 +1243,8 @@ void hid_quirks_exit(__u16 bus); 
	dev_notice(&(hid)->dev, fmt, ##__VA_ARGS__)

#define hid_warn(hid, fmt, ...)				\

	dev_warn(&(hid)->dev, fmt, ##__VA_ARGS__)

#define hid_warn_ratelimited(hid, fmt, ...)				\

	dev_warn_ratelimited(&(hid)->dev, fmt, ##__VA_ARGS__)

#define hid_info(hid, fmt, ...)				\

	dev_info(&(hid)->dev, fmt, ##__VA_ARGS__)

#define hid_dbg(hid, fmt, ...)				\