Commit Graph

12 Commits

Author SHA1 Message Date
Pavel Skripkin
fc3ef2e329 HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts
Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe() bug.
The root case is in missing validation check of actual number of endpoints.

Code should not blindly access usb_host_interface::endpoint array, since
it may contain less endpoints than code expects.

Fix it by adding missing validaion check and print an error if
number of endpoints do not match expected number

Fixes: c49c336378 ("HID: support for initialization of some Thrustmaster wheels")
Reported-and-tested-by: syzbot+35eebd505e97d315d01c@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-21 09:15:10 +01:00
Michael Hübner
0a5a587501 HID: Add support for open wheel and no attachment to T300
Different add ons to the wheel base report different models. Having
no wheel mounted to the base and using the open wheel attachment is
added here.

Signed-off-by: Michael Hübner <michaelh.95@t-online.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 17:09:33 +01:00
Greg Kroah-Hartman
93020953d0 HID: check for valid USB device for many HID drivers
Many HID drivers assume that the HID device assigned to them is a USB
device as that was the only way HID devices used to be able to be
created in Linux.  However, with the additional ways that HID devices
can be created for many different bus types, that is no longer true, so
properly check that we have a USB device associated with the HID device
before allowing a driver that makes this assumption to claim it.

Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: Michael Zaidman <michael.zaidman@gmail.com>
Cc: Stefan Achatz <erazor_de@users.sourceforge.net>
Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Cc: linux-input@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
[bentiss: amended for thrustmater.c hunk to apply]
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211201183503.2373082-3-gregkh@linuxfoundation.org
2021-12-02 15:36:18 +01:00
Vihas Mak
fa48020c9f HID: thrustmaster: fix sparse warnings
Changed 0 to NULL to fix following sparse warnings:

    drivers/hid/hid-thrustmaster.c:208:43: warning: Using plain integer as NULL pointer
    drivers/hid/hid-thrustmaster.c:241:17: warning: Using plain integer as NULL pointer
    drivers/hid/hid-thrustmaster.c:275:37: warning: Using plain integer as NULL pointer

Signed-off-by: Vihas Mak <makvihas@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2021-11-19 15:53:31 +01:00
Evgeny Novikov
c3800eed22 HID: thrustmaster: Fix memory leak in thrustmaster_interrupts()
thrustmaster_interrupts() does not free memory for send_buf when
usb_interrupt_msg() fails. This is fixed by the given patch.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2021-08-20 14:24:57 +02:00
Evgeny Novikov
df3a97bdbc HID: thrustmaster: Fix memory leak in remove
thrustmaster_remove() does not release memory for
tm_wheel->change_request. This is fixed by the patch.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2021-08-20 14:24:57 +02:00
Evgeny Novikov
d0f1d5ae23 HID: thrustmaster: Fix memory leaks in probe
When thrustmaster_probe() handles errors of usb_submit_urb() it does not
free allocated resources and fails. The patch fixes that.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2021-08-20 14:24:56 +02:00
Yang Yingliang
3b770932ee HID: thrustmaster: Switch to kmemdup() when allocate change_request
Use kmemdup() helper instead of open-coding to
simplify the code when allocate change_request.

Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2021-06-25 14:11:01 +02:00
Wei Yongjun
ed1ab6ff21 HID: thrustmaster: fix return value check in thrustmaster_probe()
Fix the return value check which testing the wrong variable
in thrustmaster_probe().

Fixes: c49c336378 ("HID: support for initialization of some Thrustmaster wheels")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2021-05-05 14:26:38 +02:00
Lee Jones
e9bb37ff35 HID: hid-thrustmaster: Demote a bunch of kernel-doc abuses
Fixes the following W=1 kernel build warning(s):

 drivers/hid/hid-thrustmaster.c:23: warning: Incorrect use of kernel-doc format:  * These interrupts are used to prevent a nasty crash when initializing the
 drivers/hid/hid-thrustmaster.c:26: warning: cannot understand function prototype: 'const u8 setup_0[] = '
 drivers/hid/hid-thrustmaster.c:49: warning: cannot understand function prototype: 'struct tm_wheel_info '
 drivers/hid/hid-thrustmaster.c:62: warning: wrong kernel-doc identifier on line:
 drivers/hid/hid-thrustmaster.c:84: warning: cannot understand function prototype: 'struct __packed tm_wheel_response '
 drivers/hid/hid-thrustmaster.c:143: warning: wrong kernel-doc identifier on line:
 drivers/hid/hid-thrustmaster.c:202: warning: Function parameter or member 'urb' not described in 'thrustmaster_model_handler'
 drivers/hid/hid-thrustmaster.c:202: warning: expecting prototype for Called by the USB subsystem when the wheel responses to our request(). Prototype was for thrustmaster_model_handler() instead
 drivers/hid/hid-thrustmaster.c:265: warning: wrong kernel-doc identifier on line:

Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Cc: Dario Pagani <dario.pagani.146+linuxk@gmail.com>
Cc: Kim Kuparinen <kimi.h.kuparinen@gmail.com>
Cc: linux-input@vger.kernel.org
Cc: linux-stm32@st-md-mailman.stormreply.com
Cc: linux-arm-kernel@lists.infradead.org
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
2021-04-07 17:53:13 +02:00
kernel test robot
66ff89946e HID: fix memdup.cocci warnings
drivers/hid/hid-thrustmaster.c:300:27-34: WARNING opportunity for kmemdup

 Use kmemdup rather than duplicating its implementation

Generated by: scripts/coccinelle/api/memdup.cocci

Fixes: c49c336378 ("HID: support for initialization of some Thrustmaster wheels")
CC: Dario Pagani <dario.pagani.146@gmail.com>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: kernel test robot <lkp@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2021-03-30 09:44:31 +02:00
Dario Pagani
c49c336378 HID: support for initialization of some Thrustmaster wheels
Add support for proper initialization of some Thrustmaster wheels that
appear like a "Thrustmaster FFB Wheel" (044f:b65d) to the host. When the
device is connected a special usb request is sent, this request makes the
wheel disconnect and reappear to the host as the "real wheel".
For example: a T150 will re-appear as 044f:b677 and a T300 as 044f:b66e

[jkosina@suse.cz: renamed driver to hid-thrustmaster]
Link: https://github.com/scarburato/hid-tminit
Signed-off-by: Dario Pagani <dario.pagani.146@gmail.com>
Co-developed-by: Kim Kuparinen <kimi.h.kuparinen@gmail.com>
Signed-off-by: Kim Kuparinen <kimi.h.kuparinen@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2021-03-19 14:21:53 +01:00