Jason Gerecke 2a5e597c6b HID: wacom: Always increment hdev refcount within wacom_get_hdev_data ...

The wacom_get_hdev_data function is used to find and return a reference to
the "other half" of a Wacom device (i.e., the touch device associated with
a pen, or vice-versa). To ensure these references are properly accounted
for, the function is supposed to automatically increment the refcount before
returning. This was not done, however, for devices which have pen & touch
on different interfaces of the same USB device. This can lead to a WARNING
("refcount_t: underflow; use-after-free") when removing the module or device
as we call kref_put() more times than kref_get(). Triggering an "actual" use-
after-free would be difficult since both devices will disappear nearly-
simultaneously. To silence this warning and prevent the potential error, we
need to increment the refcount for all cases within wacom_get_hdev_data.

Fixes: 41372d5d40 ("HID: wacom: Augment 'oVid' and 'oPid' with heuristics for HID_GENERIC")
Cc: <stable@vger.kernel.org> # v4.9+
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

2017-10-02 11:45:29 +02:00

..

i2c-hid

HID: i2c-hid: allocate hid buffers for real worst case

2017-09-13 18:16:40 +02:00

intel-ish-hid

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

2017-07-10 09:22:48 -07:00

usbhid

HID: add multi-input quirk for IDC6680 touchscreen

2017-09-06 10:51:14 +02:00

hid-a4tech.c

HID: trivial devm conversion for special hid drivers

2013-07-31 10:12:28 +02:00

hid-accutouch.c

HID: Accutouch: Add driver for ELO Accutouch 2216 USB Touchscreens

2017-03-21 15:03:55 +01:00

hid-alps.c

Merge branches 'for-4.8/upstream-fixes', 'for-4.9/alps', 'for-4.9/hid-input', 'for-4.9/intel-ish', 'for-4.9/kye-uclogic-waltop-fixes', 'for-4.9/logitech', 'for-4.9/sony', 'for-4.9/upstream' and 'for-4.9/wacom' into for-linus

2016-10-07 09:59:48 +02:00

hid-apple.c

HID: apple: Use country code to detect ISO keyboards

2017-06-08 13:58:03 +02:00

hid-appleir.c

HID: hid-input: allow input_configured callback return errors

2015-11-05 09:51:50 -08:00

hid-asus.c

HID: asus: Add T100CHI bluetooth keyboard dock touchpad support

2017-08-08 10:05:23 +02:00

hid-aureal.c

HID: fix some indenting issues

2015-10-21 13:15:53 +02:00

hid-axff.c

HID: enable Mayflash USB Gamecube Adapter

2013-11-12 19:06:23 +01:00

hid-belkin.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-betopff.c

HID: betop: add drivers/hid/hid-betopff.c

2014-12-22 15:00:25 +01:00

hid-cherry.c

HID: fix a couple of off-by-ones

2014-08-21 10:43:28 -05:00

hid-chicony.c

HID: move Asus keyboard support from hid-chicony to hid-asus

2017-06-08 13:47:52 +02:00

hid-cmedia.c

HID: Support for CMedia CM6533 HID audio jack controls

2016-03-02 10:31:36 +01:00

hid-core.c

Merge branch 'for-4.14/driver-lock-removal' into for-linus

2017-09-05 11:08:52 +02:00

hid-corsair.c

HID: corsair: Add driver Scimitar Pro RGB gaming mouse 1b1c:1b3e support to hid-corsair

2017-03-21 14:46:15 +01:00

hid-cp2112.c

HID: cp2112: use proper hidraw name with minor number

2017-03-21 15:20:39 +01:00

hid-cypress.c

HID: hid-cypress: validate length of report

2017-01-06 16:06:43 +01:00

hid-debug.c

Merge branch 'for-4.12/asus' into for-linus

2017-05-02 11:02:41 +02:00

hid-dr.c

Revert "HID: dragonrise: fix HID Descriptor for 0x0006 PID"

2016-10-10 10:52:01 +02:00

hid-elecom.c

HID: elecom: extend to fix the descriptor for DEFT trackballs

2017-05-11 10:49:14 +02:00

hid-elo.c

HID: elo: kill not flush the work

2016-06-01 14:08:17 +02:00

hid-emsff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-ezkey.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-gaff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-gembird.c

HID: gembird: add new driver to fix Gembird JPD-DualForce 2

2015-08-18 15:03:43 +02:00

hid-generic.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-gfrm.c

HID: hid-gfrm: avoid warning for input_configured API change

2015-11-05 10:15:35 -08:00

hid-gt683r.c

HID: use to_hid_device()

2015-12-28 13:41:44 +01:00

hid-gyration.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-holtek-kbd.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-holtek-mouse.c

HID: Add Holtek USB ID 04d9:a0c2 ETEKCITY Scroll

2014-09-08 09:48:56 +02:00

hid-holtekff.c

HID: hid-holtekff: don't push static constants on stack for %*ph

2013-08-05 11:29:57 +02:00

hid-hyperv.c

HID: hyperv: match wait_for_completion_timeout return type

2015-01-26 14:25:41 +01:00

hid-icade.c

HID: icade: u16 which never < 0

2013-04-24 16:32:27 +02:00

hid-ids.h

HID: multitouch: Support ALPS PTP stick with pid 0x120A

2017-09-06 11:05:34 +02:00

hid-input.c

HID: input: throttle battery uevents

2017-08-15 10:56:03 +02:00

hid-ite.c

HID: ite: Add hid-ite driver

2017-05-11 10:27:48 +02:00

hid-kensington.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-keytouch.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-kye.c

scripts/spelling.txt: add "comsume(r)" pattern and fix typo instances

2017-02-27 18:43:47 -08:00

hid-lcpower.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-led.c

HID: hid-led: fix issue with transfer buffer not being dma capable

2016-10-10 10:47:03 +02:00

hid-lenovo.c

HID: lenovo: Don't use stack variables for DMA buffers

2016-03-29 15:39:36 +02:00

hid-lg2ff.c

HID: logitech - lg2ff: Add IDs for Formula Vibration Feedback Wheel

2013-10-09 12:06:02 +02:00

hid-lg3ff.c

HID: LG: validate HID output report details

2013-09-13 15:12:39 +02:00

hid-lg4ff.c

HID: hid-logitech: Improve Wingman Formula Force GP support

2016-09-26 15:39:56 +02:00

hid-lg4ff.h

HID: hid-logitech: Add combined pedal support Logitech wheels

2016-09-26 15:39:54 +02:00

hid-lg.c

HID: hid-lg: Fix immediate disconnection of Logitech Rumblepad 2

2017-01-26 21:58:16 +01:00

hid-lg.h

HID: hid-lg4ff: Introduce a module parameter to disable automatic switch of compatibility mode

2015-02-18 21:14:54 +01:00

hid-lgff.c

HID: LG: validate HID output report details

2013-09-13 15:12:39 +02:00

hid-logitech-dj.c

HID: logitech-dj: allow devices to request full pairing information

2017-04-06 14:36:36 +02:00

hid-logitech-hidpp.c

HID: logitech-hidpp: constify attribute_group structures.

2017-08-03 13:38:30 +02:00

hid-magicmouse.c

Revert "HID: magicmouse: Set multi-touch keybits for Magic Mouse"

2017-06-20 10:38:17 +02:00

hid-mf.c

HID: hid-mf: add force feedback support for Mayflash DolphinBar and GameCube

2017-01-11 22:12:44 +01:00

hid-microsoft.c

HID: multitouch: enable Surface 3 Type Cover Pro to report multitouch data

2017-01-20 15:17:19 +01:00

hid-monterey.c

HID: fix a couple of off-by-ones

2014-08-21 10:43:28 -05:00

hid-multitouch.c

HID: multitouch: Support ALPS PTP stick with pid 0x120A

2017-09-06 11:05:34 +02:00

hid-nti.c

HID: Add quirk driver for NTI USB-SUN adapter

2017-03-06 13:16:33 +01:00

hid-ntrig.c

HID: ntrig: constify attribute_group structures.

2017-08-03 13:38:30 +02:00

hid-ortek.c

HID: ortek: add one more buggy device

2017-07-24 17:38:21 +02:00

hid-penmount.c

HID: penmount: report only one button for PenMount 6000 USB touchscreen controller

2016-03-10 17:17:26 +01:00

hid-petalynx.c

HID: fix a couple of off-by-ones

2014-08-21 10:43:28 -05:00

hid-picolcd_backlight.c

HID: picoLCD: Deletion of unnecessary checks before three function calls

2015-06-29 14:51:12 +02:00

hid-picolcd_cir.c

[media] rc-main: assign driver type during allocation

2017-01-30 13:59:57 -02:00

hid-picolcd_core.c

HID: picolcd: be more verbose when reporting report size error

2014-08-27 23:27:10 +02:00

hid-picolcd_debugfs.c

HID: picoLCD: Spelling s/REPORT_WRTIE_MEMORY/REPORT_WRITE_MEMORY/

2017-03-24 15:45:04 +01:00

hid-picolcd_fb.c

drivers/hid/hid-picolcd_fb: avoid world-writable sysfs files.

2014-05-14 10:53:56 +09:30

hid-picolcd_lcd.c

HID: picoLCD: Deletion of unnecessary checks before three function calls

2015-06-29 14:51:12 +02:00

hid-picolcd_leds.c

HID: use to_hid_device()

2015-12-28 13:41:44 +01:00

hid-picolcd.h

Merge branches 'for-3.10/multitouch', 'for-3.10/roccat' and 'for-3.10/upstream' into for-linus

2013-04-30 10:19:07 +02:00

hid-pl.c

HID: pantherlord: validate output report details

2013-09-04 11:58:32 +02:00

hid-plantronics.c

HID: plantronics: Update to map volume up/down controls

2015-06-12 15:04:17 +02:00

hid-primax.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-prodikeys.c

HID: prodikeys: constify snd_rawmidi_ops structures

2017-08-15 11:02:45 +02:00

hid-retrode.c

HID: Add driver for Retrode2 joypad adapter

2017-06-22 14:44:11 +02:00

hid-rmi.c

HID: rmi: Make sure the HID device is opened on resume

2017-09-08 15:00:52 +02:00

hid-roccat-arvo.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-arvo.h

…

hid-roccat-common.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-common.h

HID: roccat: generalize some common code

2013-10-30 14:17:31 +01:00

hid-roccat-isku.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-isku.h

HID: roccat: add support for IskuFX

2013-03-14 11:50:49 +01:00

hid-roccat-kone.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-kone.h

HID: roccat: added media key support for Kone

2013-04-08 10:33:13 +02:00

hid-roccat-koneplus.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-koneplus.h

HID: roccat: fix wrong attr size for koneplus tcu

2012-11-18 22:58:28 +01:00

hid-roccat-konepure.c

HID: roccat: generalize some common code

2013-10-30 14:17:31 +01:00

hid-roccat-kovaplus.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-kovaplus.h

HID: roccat: deprecate some Kovaplus attributes

2012-11-12 15:30:29 +01:00

hid-roccat-lua.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-lua.h

HID: roccat: add support for Roccat Lua

2012-10-17 10:44:47 +02:00

hid-roccat-pyra.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-pyra.h

HID: roccat: deprecated some Pyra attributes

2012-11-12 15:30:28 +01:00

hid-roccat-ryos.c

HID: roccat: add support for Ryos MK keyboards

2013-10-30 14:17:31 +01:00

hid-roccat-savu.c

HID: roccat: generalize some common code

2013-10-30 14:17:31 +01:00

hid-roccat-savu.h

HID: roccat: generalize some common code

2013-10-30 14:17:31 +01:00

hid-roccat.c

sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>

2017-03-02 08:42:32 +01:00

hid-saitek.c

HID: Add a new Saitek mouse device ID (RAT 9)

2016-08-02 16:45:17 +02:00

hid-samsung.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-sensor-custom.c

Merge branch 'for-4.14/ish' into for-linus

2017-09-05 11:10:13 +02:00

hid-sensor-hub.c

HID: hid-sensor-hub: Force logical minimum to 1 for power and report state

2017-08-09 22:15:59 +02:00

hid-sjoy.c

HID: sjoy: support Super Joy Box 4

2015-05-07 10:47:53 +02:00

hid-sony.c

Merge branch 'for-4.12/sony' into for-linus

2017-05-02 11:02:24 +02:00

hid-speedlink.c

HID: Fix Speedlink VAD Cezanne support for some devices

2013-08-26 13:51:10 +02:00

hid-steelseries.c

HID: use to_hid_device()

2015-12-28 13:41:44 +01:00

hid-sunplus.c

HID: fix a couple of off-by-ones

2014-08-21 10:43:28 -05:00

hid-tivo.c

HID: tivo: enable all buttons on the TiVo Slide Pro remote

2015-03-15 10:04:27 -04:00

hid-tmff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-topseed.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-twinhan.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-uclogic.c

HID: uclogic: add support for Ugee Tablet EX07S

2017-04-06 14:50:11 +02:00

hid-udraw-ps3.c

HID: udraw-ps3: accel_limits is local to the driver

2016-11-15 14:23:17 +01:00

hid-waltop.c

HID: Remove broken links to tablet descriptions

2016-09-19 14:32:21 +02:00

hid-wiimote-core.c

HID: wiimote: replace hid_output_raw_report with hid_hw_output_report for output requests

2014-02-17 14:57:17 +01:00

hid-wiimote-debug.c

HID: wiimote: fix DRM debug-attr to correctly parse input

2013-06-03 11:07:06 +02:00

hid-wiimote-modules.c

HID: wiimote: Fix wiimote mp scale linearization

2016-03-18 17:31:38 +01:00

hid-wiimote.h

HID: use to_hid_device()

2015-12-28 13:41:44 +01:00

hid-xinmo.c

HID: xinmo: fix for out of range for THT 2P arcade controller.

2017-03-24 15:43:03 +01:00

hid-zpff.c

HID: zeroplus: validate output report details

2013-09-13 15:11:34 +02:00

hid-zydacron.c

HID: trivial devm conversion for special hid drivers

2013-07-31 10:12:28 +02:00

hidraw.c

sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>

2017-03-02 08:42:32 +01:00

Kconfig

HID: wacom: add USB_HID dependency

2017-08-01 11:22:21 +02:00

Makefile

Merge branches 'for-4.13/multitouch', 'for-4.13/retrode', 'for-4.13/transport-open-close-consolidation', 'for-4.13/upstream' and 'for-4.13/wacom' into for-linus

2017-07-10 11:11:25 +02:00

uhid.c

HID: introduce hid_is_using_ll_driver

2017-07-27 15:14:28 +02:00

wacom_sys.c

HID: wacom: Always increment hdev refcount within wacom_get_hdev_data

2017-10-02 11:45:29 +02:00

wacom_wac.c

HID: wacom: generic: Clear ABS_MISC when tool leaves proximity

2017-09-13 19:14:48 +02:00

wacom_wac.h

HID: wacom: generic: Refactor generic battery handling

2017-05-05 21:46:10 +02:00

wacom.h

HID: wacom: Add ability to provide explicit battery status info

2017-05-05 21:46:10 +02:00