Commit 7287904c authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus-2023011801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid 

Pull HID fixes from Jiri Kosina:

 - fixes for potential empty list handling in HID core (Pietro Borrello)

 - fix for NULL pointer dereference in betop driver that could be
   triggered by malicious device (Pietro Borrello)

 - fixes for handling calibration data preventing division by zero in
   Playstation driver (Roderick Colenbrander)

 - fix for memory leak on error path in amd-sfh driver (Basavaraj
   Natikar)

 - other few assorted small fixes and device ID-specific handling

* tag 'for-linus-2023011801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: betop: check shape of output reports
  HID: playstation: sanity check DualSense calibration data.
  HID: playstation: sanity check DualShock4 calibration data.
  HID: uclogic: Add support for XP-PEN Deco 01 V2
  HID: revert CHERRY_MOUSE_000C quirk
  HID: check empty report_list in bigben_probe()
  HID: check empty report_list in hid_validate_values()
  HID: amd_sfh: Fix warning unwind goto
  HID: intel_ish-hid: Add check for ishtp_dma_tx_map
parents 7026172b 3782c0d6

drivers/hid/amd-sfh-hid/amd_sfh_client.c

+1 −1
Original line number Diff line number Diff line
@@ -282,7 +282,7 @@ int amd_sfh_hid_client_init(struct amd_mp2_dev *privdata) 
		}

		rc = mp2_ops->get_rep_desc(cl_idx, cl_data->report_descr[i]);

		if (rc)

			return rc;

			goto cleanup;

		mp2_ops->start(privdata, info);

		status = amd_sfh_wait_for_response

				(privdata, cl_data->sensor_idx[i], SENSOR_ENABLED);

drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c

+1 −1
Original line number Diff line number Diff line
@@ -160,7 +160,7 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata) 
		}

		rc = mp2_ops->get_rep_desc(cl_idx, cl_data->report_descr[i]);

		if (rc)

			return rc;

			goto cleanup;



		writel(0, privdata->mmio + AMD_P2C_MSG(0));

		mp2_ops->start(privdata, info);

drivers/hid/hid-betopff.c

+9 −8
Original line number Diff line number Diff line
@@ -60,7 +60,6 @@ static int betopff_init(struct hid_device *hid) 
	struct list_head *report_list =

			&hid->report_enum[HID_OUTPUT_REPORT].report_list;

	struct input_dev *dev;

	int field_count = 0;

	int error;

	int i, j;
@@ -86,19 +85,21 @@ static int betopff_init(struct hid_device *hid) 
	 * -----------------------------------------

	 * Do init them with default value.

	 */

	if (report->maxfield < 4) {

		hid_err(hid, "not enough fields in the report: %d\n",

				report->maxfield);

		return -ENODEV;

	}

	for (i = 0; i < report->maxfield; i++) {

		if (report->field[i]->report_count < 1) {

			hid_err(hid, "no values in the field\n");

			return -ENODEV;

		}

		for (j = 0; j < report->field[i]->report_count; j++) {

			report->field[i]->value[j] = 0x00;

			field_count++;

		}

	}



	if (field_count < 4) {

		hid_err(hid, "not enough fields in the report: %d\n",

				field_count);

		return -ENODEV;

	}



	betopff = kzalloc(sizeof(*betopff), GFP_KERNEL);

	if (!betopff)

		return -ENOMEM;

drivers/hid/hid-bigbenff.c

+5 −0
Original line number Diff line number Diff line
@@ -344,6 +344,11 @@ static int bigben_probe(struct hid_device *hid, 
	}



	report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;

	if (list_empty(report_list)) {

		hid_err(hid, "no output report found\n");

		error = -ENODEV;

		goto error_hw_stop;

	}

	bigben->report = list_entry(report_list->next,

		struct hid_report, list);

drivers/hid/hid-core.c

+2 −2
Original line number Diff line number Diff line
@@ -993,8 +993,8 @@ struct hid_report *hid_validate_values(struct hid_device *hid, 
		 * Validating on id 0 means we should examine the first

		 * report in the list.

		 */

		report = list_entry(

				hid->report_enum[type].report_list.next,

		report = list_first_entry_or_null(

				&hid->report_enum[type].report_list,

				struct hid_report, list);

	} else {

		report = hid->report_enum[type].report_id_hash[id];