iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,117,387 Commits 104 Branches 1,843 Tags 5.7 GiB
fa9db655d0
Commit Graph

6 Commits

Author SHA1 Message Date
Dongliang Mu
fc4ef9d572 HID: bigben: fix slab-out-of-bounds Write in bigben_probe 
There is a slab-out-of-bounds Write bug in hid-bigbenff driver.
The problem is the driver assumes the device must have an input but
some malicious devices violate this assumption.

Fix this by checking hid_device's input is non-empty before its usage.

Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
 2022-05-06 10:46:36 +02:00
Benjamin Tissoires
918aa1ef10 HID: bigbenff: prevent null pointer dereference 
When emulating the device through uhid, there is a chance we don't have
output reports and so report_field is null.

Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20211202095334.14399-3-benjamin.tissoires@redhat.com
 2021-12-02 15:36:18 +01:00
Hanno Zulla
4eb1b01de5 HID: hid-bigbenff: fix race condition for scheduled work during removal 
It's possible that there is scheduled work left while the device is
already being removed, which can cause a kernel crash. Adding a flag
will avoid this.

Signed-off-by: Hanno Zulla <kontakt@hanno.de>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
 2020-02-18 14:43:51 +01:00
Hanno Zulla
976a54d0f4 HID: hid-bigbenff: call hid_hw_stop() in case of error 
It's required to call hid_hw_stop() once hid_hw_start() was called
previously, so error cases need to handle this. Also, hid_hw_close() is
not necessary during removal.

Signed-off-by: Hanno Zulla <kontakt@hanno.de>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
 2020-02-18 14:43:48 +01:00
Hanno Zulla
789a2c2503 HID: hid-bigbenff: fix general protection fault caused by double kfree 
The struct *bigben was allocated via devm_kzalloc() and then used as a
parameter in input_ff_create_memless(). This caused a double kfree
during removal of the device, since both the managed resource API and
ml_ff_destroy() in drivers/input/ff-memless.c would call kfree() on it.

Signed-off-by: Hanno Zulla <kontakt@hanno.de>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
 2020-02-18 14:43:45 +01:00
Hanno Zulla
256a90ed9e HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad 
This is a driver to fix input mapping and add LED & force feedback
support for the "BigBen Interactive Kid-friendly Wired Controller
PS3OFMINIPAD SONY" gamepad with USB id 146b:0902. It was originally
sold as a PS3 accessory and makes a very nice gamepad for Retropie.

Signed-off-by: Hanno Zulla <kontakt@hanno.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
 2018-09-24 11:49:32 +02:00