Commit ecfa6f34 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman Committed by Benjamin Tissoires
Browse files

HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them 



In commit 2ff5baa9 ("HID: appleir: Fix potential NULL dereference at
raw event handle"), we handle the fact that raw event callbacks
can happen even for a HID device that has not been "claimed" causing a
crash if a broken device were attempted to be connected to the system.

Fix up the remaining in-tree HID drivers that forgot to add this same
check to resolve the same issue.

Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <bentiss@kernel.org>
Cc: Bastien Nocera <hadess@hadess.net>
Cc: linux-input@vger.kernel.org
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_2000
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarBenjamin Tissoires <bentiss@kernel.org>
parent 2bad24c1

drivers/hid/hid-cmedia.c

+1 −1
Original line number Diff line number Diff line
@@ -99,7 +99,7 @@ static int cmhid_raw_event(struct hid_device *hid, struct hid_report *report, 
{

	struct cmhid *cm = hid_get_drvdata(hid);



	if (len != CM6533_JD_RAWEV_LEN)

	if (len != CM6533_JD_RAWEV_LEN || !(hid->claimed & HID_CLAIMED_INPUT))

		goto out;

	if (memcmp(data+CM6533_JD_SFX_OFFSET, ji_sfx, sizeof(ji_sfx)))

		goto out;

drivers/hid/hid-creative-sb0540.c

+1 −1
Original line number Diff line number Diff line
@@ -153,7 +153,7 @@ static int creative_sb0540_raw_event(struct hid_device *hid, 
	u64 code, main_code;

	int key;



	if (len != 6)

	if (len != 6 || !(hid->claimed & HID_CLAIMED_INPUT))

		return 0;



	/* From daemons/hw_hiddev.c sb0540_rec() in lirc */

drivers/hid/hid-zydacron.c

+1 −1
Original line number Diff line number Diff line
@@ -114,7 +114,7 @@ static int zc_raw_event(struct hid_device *hdev, struct hid_report *report, 
	unsigned key;

	unsigned short index;



	if (report->id == data[0]) {

	if (report->id == data[0] && (hdev->claimed & HID_CLAIMED_INPUT)) {



		/* break keys */

		for (index = 0; index < 4; index++) {