Vladis Dronov 13054abbaa HID: debug: fix the ring buffer implementation ...

Ring buffer implementation in hid_debug_event() and hid_debug_events_read()
is strange allowing lost or corrupted data. After commit 717adfdaf147
("HID: debug: check length before copy_to_user()") it is possible to enter
an infinite loop in hid_debug_events_read() by providing 0 as count, this
locks up a system. Fix this by rewriting the ring buffer implementation
with kfifo and simplify the code.

This fixes CVE-2019-3819.

v2: fix an execution logic and add a comment
v3: use __set_current_state() instead of set_current_state()

Link: https://bugzilla.redhat.com/show_bug.cgi?id=1669187
Cc: stable@vger.kernel.org # v4.18+
Fixes: cd667ce24796 ("HID: use debugfs for events/reports dumping")
Fixes: 717adfdaf147 ("HID: debug: check length before copy_to_user()")
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>

2019-01-29 12:09:11 +01:00

..

i2c-hid

HID: i2c-hid: Disable runtime PM on Goodix touchpad

2019-01-14 12:17:51 +01:00

intel-ish-hid

Merge branches 'for-4.20/upstream-fixes', 'for-4.21/core', 'for-4.21/hid-asus', 'for-4.21/hid-core', 'for-4.21/hid-cougar', 'for-4.21/hidraw', 'for-4.21/highres-wheel' and 'for-4.21/ish' into for-linus

2019-01-03 12:50:28 +01:00

usbhid

HID: hiddev: fix potential Spectre v1

2018-10-26 17:06:24 +02:00

hid-a4tech.c

HID: trivial devm conversion for special hid drivers

2013-07-31 10:12:28 +02:00

hid-accutouch.c

HID: Accutouch: Add driver for ELO Accutouch 2216 USB Touchscreens

2017-03-21 15:03:55 +01:00

hid-alps.c

HID: alps: allow incoming reports when only the trackstick is opened

2018-10-26 17:27:13 +02:00

hid-apple.c

HID: add support for Apple Magic Keyboards

2018-08-28 13:52:50 +02:00

hid-appleir.c

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

hid-asus.c

HID: asus: Add support for the ASUS T101HA keyboard dock

2018-12-17 11:10:39 +01:00

hid-aureal.c

HID: fix some indenting issues

2015-10-21 13:15:53 +02:00

hid-axff.c

HID: enable Mayflash USB Gamecube Adapter

2013-11-12 19:06:23 +01:00

hid-belkin.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-betopff.c

HID: betop: add drivers/hid/hid-betopff.c

2014-12-22 15:00:25 +01:00

hid-bigbenff.c

HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad

2018-09-24 11:49:32 +02:00

hid-cherry.c

HID: fix a couple of off-by-ones

2014-08-21 10:43:28 -05:00

hid-chicony.c

HID: move Asus keyboard support from hid-chicony to hid-asus

2017-06-08 13:47:52 +02:00

hid-cmedia.c

HID: Support for CMedia CM6533 HID audio jack controls

2016-03-02 10:31:36 +01:00

hid-core.c

HID: core: simplify active collection tracking

2019-01-16 14:29:48 +01:00

hid-corsair.c

HID: corsair: Add K70 Vengeance and K70 RAPIDFIRE to

2018-02-16 13:38:16 +01:00

hid-cougar.c

HID: cougar: Add support for Cougar 700K Gaming Keyboard

2018-11-21 14:41:43 +01:00

hid-cp2112.c

gpio: Pass a flag to gpiochip_request_own_desc()

2018-12-14 14:24:33 +01:00

hid-cypress.c

HID: hid-cypress: validate length of report

2017-01-06 16:06:43 +01:00

hid-debug.c

HID: debug: fix the ring buffer implementation

2019-01-29 12:09:11 +01:00

hid-dr.c

Revert "HID: dragonrise: fix HID Descriptor for 0x0006 PID"

2016-10-10 10:52:01 +02:00

hid-elan.c

HID: elan: fix spelling mistake "registred" -> "registered"

2018-10-09 13:32:06 +02:00

hid-elecom.c

HID: elecom: add support for EX-G M-XT4DRBK trackball

2018-03-06 15:15:47 +01:00

hid-elo.c

HID: elo: clear BTN_LEFT mapping

2017-11-24 14:40:23 +01:00

hid-emsff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-ezkey.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-gaff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-gembird.c

HID: gembird: add new driver to fix Gembird JPD-DualForce 2

2015-08-18 15:03:43 +02:00

hid-generic.c

HID: generic: create one input report per application type

2018-04-26 14:17:31 +02:00

hid-gfrm.c

HID: generic: create one input report per application type

2018-04-26 14:17:31 +02:00

hid-google-hammer.c

HID: google: drop superfluous const before SIMPLE_DEV_PM_OPS()

2018-10-09 10:43:39 +02:00

hid-gt683r.c

HID: use to_hid_device()

2015-12-28 13:41:44 +01:00

hid-gyration.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-holtek-kbd.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-holtek-mouse.c

HID: Add Holtek USB ID 04d9:a0c2 ETEKCITY Scroll

2014-09-08 09:48:56 +02:00

hid-holtekff.c

HID: holtekff: move MODULE_* parameters out of #ifdef block

2017-12-01 09:31:36 +01:00

hid-hyperv.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2018-12-04 08:47:04 -08:00

hid-icade.c

HID: icade: u16 which never < 0

2013-04-24 16:32:27 +02:00

hid-ids.h

HID: i2c-hid: Disable runtime PM on Goodix touchpad

2019-01-14 12:17:51 +01:00

hid-input.c

HID: input: use the Resolution Multiplier for high-resolution scrolling

2018-12-07 16:27:13 +01:00

hid-ite.c

HID: ite: Add USB id match for another ITE based keyboard rfkill key quirk

2018-11-30 14:12:07 +01:00

hid-jabra.c

HID: Add special driver for Jabra devices

2017-11-21 12:54:58 +01:00

hid-kensington.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-keytouch.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-kye.c

scripts/spelling.txt: add "comsume(r)" pattern and fix typo instances

2017-02-27 18:43:47 -08:00

hid-lcpower.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-led.c

HID: hid-led: fix issue with transfer buffer not being dma capable

2016-10-10 10:47:03 +02:00

hid-lenovo.c

HID: lenovo: Add checks to fix of_led_classdev_register

2019-01-03 11:30:08 +01:00

hid-lg2ff.c

HID: logitech - lg2ff: Add IDs for Formula Vibration Feedback Wheel

2013-10-09 12:06:02 +02:00

hid-lg3ff.c

HID: LG: validate HID output report details

2013-09-13 15:12:39 +02:00

hid-lg4ff.c

HID: hid-logitech: remove redundant assignment to pointer value

2017-10-19 13:52:38 +02:00

hid-lg4ff.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

hid-lg.c

HID: hid-lg: make array cbuf static const to shink object code size

2017-09-06 10:58:54 +02:00

hid-lg.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

hid-lgff.c

HID: LG: validate HID output report details

2013-09-13 15:12:39 +02:00

hid-logitech-dj.c

HID: logitech-dj: allow devices to request full pairing information

2017-04-06 14:36:36 +02:00

hid-logitech-hidpp.c

HID: logitech: Use LDJ_DEVICE macro for existing Logitech mice

2018-12-07 16:27:16 +01:00

hid-magicmouse.c

HID: magicmouse: add support for Apple Magic Trackpad 2

2018-10-03 10:57:58 +02:00

hid-mf.c

HID: hid-mf: add force feedback support for Mayflash DolphinBar and GameCube

2017-01-11 22:12:44 +01:00

hid-microsoft.c

HID: microsoft: Add rumble support for Xbox One S controller

2018-09-05 10:19:43 +02:00

hid-monterey.c

HID: fix a couple of off-by-ones

2014-08-21 10:43:28 -05:00

hid-multitouch.c

HID: multitouch: Add pointstick support for Cirque Touchpad

2018-11-19 16:26:59 +01:00

hid-nti.c

HID: Add quirk driver for NTI USB-SUN adapter

2017-03-06 13:16:33 +01:00

hid-ntrig.c

HID: hid-ntrig: add error handling for sysfs_create_group

2018-06-25 15:16:11 +02:00

hid-ortek.c

HID: ortek: add one more buggy device

2017-07-24 17:38:21 +02:00

hid-penmount.c

HID: penmount: report only one button for PenMount 6000 USB touchscreen controller

2016-03-10 17:17:26 +01:00

hid-petalynx.c

HID: fix a couple of off-by-ones

2014-08-21 10:43:28 -05:00

hid-picolcd_backlight.c

HID: picoLCD: Deletion of unnecessary checks before three function calls

2015-06-29 14:51:12 +02:00

hid-picolcd_cir.c

media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macros

2018-10-04 14:22:27 -04:00

hid-picolcd_core.c

HID: picolcd: be more verbose when reporting report size error

2014-08-27 23:27:10 +02:00

hid-picolcd_debugfs.c

HID: picoLCD: Spelling s/REPORT_WRTIE_MEMORY/REPORT_WRITE_MEMORY/

2017-03-24 15:45:04 +01:00

hid-picolcd_fb.c

treewide: kmalloc() -> kmalloc_array()

2018-06-12 16:19:22 -07:00

hid-picolcd_lcd.c

HID: picoLCD: Deletion of unnecessary checks before three function calls

2015-06-29 14:51:12 +02:00

hid-picolcd_leds.c

HID: use to_hid_device()

2015-12-28 13:41:44 +01:00

hid-picolcd.h

Merge branches 'for-3.10/multitouch', 'for-3.10/roccat' and 'for-3.10/upstream' into for-linus

2013-04-30 10:19:07 +02:00

hid-pl.c

HID: pantherlord: validate output report details

2013-09-04 11:58:32 +02:00

hid-plantronics.c

HID: hid-plantronics: Re-resend Update to map button for PTT products

2018-05-16 11:06:40 +02:00

hid-primax.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-prodikeys.c

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

hid-quirks.c

HID: quirks: fix RetroUSB.com devices

2018-12-07 14:12:34 +01:00

hid-redragon.c

HID: redragon: fix num lock and caps lock LEDs

2018-06-25 15:23:40 +02:00

hid-retrode.c

HID: Add driver for Retrode2 joypad adapter

2017-06-22 14:44:11 +02:00

hid-rmi.c

HID: rmi: use HID_QUIRK_NO_INPUT_SYNC

2018-05-30 08:55:33 +02:00

hid-roccat-arvo.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-arvo.h

…

hid-roccat-common.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-common.h

HID: roccat: generalize some common code

2013-10-30 14:17:31 +01:00

hid-roccat-isku.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-isku.h

HID: roccat: add support for IskuFX

2013-03-14 11:50:49 +01:00

hid-roccat-kone.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-kone.h

HID: roccat: added media key support for Kone

2013-04-08 10:33:13 +02:00

hid-roccat-koneplus.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-koneplus.h

HID: roccat: fix wrong attr size for koneplus tcu

2012-11-18 22:58:28 +01:00

hid-roccat-konepure.c

HID: roccat: generalize some common code

2013-10-30 14:17:31 +01:00

hid-roccat-kovaplus.c

HID: roccat: prevent an out of bounds read in kovaplus_profile_activated()

2018-01-23 15:46:58 +01:00

hid-roccat-kovaplus.h

HID: roccat: deprecate some Kovaplus attributes

2012-11-12 15:30:29 +01:00

hid-roccat-lua.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-lua.h

HID: roccat: add support for Roccat Lua

2012-10-17 10:44:47 +02:00

hid-roccat-pyra.c

HID: use kobj_to_dev()

2015-12-28 13:41:51 +01:00

hid-roccat-pyra.h

HID: roccat: deprecated some Pyra attributes

2012-11-12 15:30:28 +01:00

hid-roccat-ryos.c

HID: roccat: add support for Ryos MK keyboards

2013-10-30 14:17:31 +01:00

hid-roccat-savu.c

HID: roccat: generalize some common code

2013-10-30 14:17:31 +01:00

hid-roccat-savu.h

HID: roccat: generalize some common code

2013-10-30 14:17:31 +01:00

hid-roccat.c

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11 14:34:03 -08:00

hid-saitek.c

HID: hid-saitek: Add device ID for RAT 7 Contagion

2018-08-30 10:58:44 +02:00

hid-samsung.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-sensor-custom.c

iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed numbers

2018-11-16 11:42:12 +00:00

hid-sensor-hub.c

iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed numbers

2018-11-16 11:42:12 +00:00

hid-sjoy.c

HID: sjoy: support Super Joy Box 4

2015-05-07 10:47:53 +02:00

hid-sony.c

HID: hid-sony.c: Use devm_ api to simplify sc->output_report_dmabuf

2018-07-09 15:14:08 +02:00

hid-speedlink.c

HID: Fix Speedlink VAD Cezanne support for some devices

2013-08-26 13:51:10 +02:00

hid-steam.c

HID: steam: remove input device when a hid client is running.

2018-11-19 16:19:51 +01:00

hid-steelseries.c

HID: use to_hid_device()

2015-12-28 13:41:44 +01:00

hid-sunplus.c

HID: fix a couple of off-by-ones

2014-08-21 10:43:28 -05:00

hid-tivo.c

HID: tivo: enable all buttons on the TiVo Slide Pro remote

2015-03-15 10:04:27 -04:00

hid-tmff.c

HID: Add ID 044f:b605 ThrustMaster, Inc. force feedback Racing Wheel

2017-11-07 10:04:46 +01:00

hid-topseed.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-twinhan.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-uclogic.c

HID: core: remove the need for HID_QUIRK_NO_EMPTY_INPUT

2018-03-23 15:44:57 +01:00

hid-udraw-ps3.c

HID: udraw-ps3: accel_limits is local to the driver

2016-11-15 14:23:17 +01:00

hid-waltop.c

HID: Remove broken links to tablet descriptions

2016-09-19 14:32:21 +02:00

hid-wiimote-core.c

HID: wiimote: add support for Guitar-Hero devices

2018-06-25 15:26:06 +02:00

hid-wiimote-debug.c

HID: wiimote: fix DRM debug-attr to correctly parse input

2013-06-03 11:07:06 +02:00

hid-wiimote-modules.c

HID: wiimote: add support for Guitar-Hero devices

2018-06-25 15:26:06 +02:00

hid-wiimote.h

HID: wiimote: add support for Guitar-Hero devices

2018-06-25 15:26:06 +02:00

hid-xinmo.c

HID: xinmo: fix for out of range for THT 2P arcade controller.

2017-03-24 15:43:03 +01:00

hid-zpff.c

HID: zeroplus: validate output report details

2013-09-13 15:11:34 +02:00

hid-zydacron.c

HID: trivial devm conversion for special hid drivers

2013-07-31 10:12:28 +02:00

hidraw.c

HID: hidraw: enforce minors_lock locking via lockdep

2018-11-12 12:44:03 +01:00

Kconfig

platform-drivers-x86 for v4.20-1

2018-11-01 08:42:21 -07:00

Makefile

HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad

2018-09-24 11:49:32 +02:00

uhid.c

Revert "HID: uhid: use strlcpy() instead of strncpy()"

2018-11-19 14:32:27 +01:00

wacom_sys.c

Merge branch 'for-4.19/wacom' into for-linus

2018-08-20 18:12:42 +02:00

wacom_wac.c

HID: wacom: Work around HID descriptor bug in DTK-2451 and DTH-2452

2018-10-11 14:32:01 +02:00

wacom_wac.h

HID: wacom: generic: add the "Report Valid" usage

2018-03-07 15:21:44 +01:00

wacom.h

HID: wacom: Add ability to provide explicit battery status info

2017-05-05 21:46:10 +02:00