Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

Pull HID fixes from Jiri Kosina:

- regression fix for generic Wacom devices, from Jason Gerecke

- DMA-on-stack fixes for hid-corsair driver, from Johan Hovold

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: wacom: Fix sibling detection regression
HID: corsair: fix control-transfer error handling
HID: corsair: fix DMA buffers on stack

+63 -23
+45 -15
drivers/hid/hid-corsair.c
··· 148 148 struct usb_interface *usbif = to_usb_interface(dev->parent); 149 149 struct usb_device *usbdev = interface_to_usbdev(usbif); 150 150 int brightness; 151 - char data[8]; 151 + char *data; 152 + 153 + data = kmalloc(8, GFP_KERNEL); 154 + if (!data) 155 + return -ENOMEM; 152 156 153 157 ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 154 158 K90_REQUEST_STATUS, 155 159 USB_DIR_IN | USB_TYPE_VENDOR | 156 160 USB_RECIP_DEVICE, 0, 0, data, 8, 157 161 USB_CTRL_SET_TIMEOUT); 158 - if (ret < 0) { 162 + if (ret < 5) { 159 163 dev_warn(dev, "Failed to get K90 initial state (error %d).\n", 160 164 ret); 161 - return -EIO; 165 + ret = -EIO; 166 + goto out; 162 167 } 163 168 brightness = data[4]; 164 169 if (brightness < 0 || brightness > 3) { 165 170 dev_warn(dev, 166 171 "Read invalid backlight brightness: %02hhx.\n", 167 172 data[4]); 168 - return -EIO; 173 + ret = -EIO; 174 + goto out; 169 175 } 170 - return brightness; 176 + ret = brightness; 177 + out: 178 + kfree(data); 179 + 180 + return ret; 171 181 } 172 182 173 183 static enum led_brightness k90_record_led_get(struct led_classdev *led_cdev) ··· 263 253 struct usb_interface *usbif = to_usb_interface(dev->parent); 264 254 struct usb_device *usbdev = interface_to_usbdev(usbif); 265 255 const char *macro_mode; 266 - char data[8]; 256 + char *data; 257 + 258 + data = kmalloc(2, GFP_KERNEL); 259 + if (!data) 260 + return -ENOMEM; 267 261 268 262 ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 269 263 K90_REQUEST_GET_MODE, 270 264 USB_DIR_IN | USB_TYPE_VENDOR | 271 265 USB_RECIP_DEVICE, 0, 0, data, 2, 272 266 USB_CTRL_SET_TIMEOUT); 273 - if (ret < 0) { 267 + if (ret < 1) { 274 268 dev_warn(dev, "Failed to get K90 initial mode (error %d).\n", 275 269 ret); 276 - return -EIO; 270 + ret = -EIO; 271 + goto out; 277 272 } 278 273 279 274 switch (data[0]) { ··· 292 277 default: 293 278 dev_warn(dev, "K90 in unknown mode: %02hhx.\n", 294 279 data[0]); 295 - return -EIO; 280 + ret = -EIO; 281 + goto out; 296 282 } 297 283 298 - return snprintf(buf, PAGE_SIZE, "%s\n", macro_mode); 284 + ret = snprintf(buf, PAGE_SIZE, "%s\n", macro_mode); 285 + out: 286 + kfree(data); 287 + 288 + return ret; 299 289 } 300 290 301 291 static ssize_t k90_store_macro_mode(struct device *dev, ··· 340 320 struct usb_interface *usbif = to_usb_interface(dev->parent); 341 321 struct usb_device *usbdev = interface_to_usbdev(usbif); 342 322 int current_profile; 343 - char data[8]; 323 + char *data; 324 + 325 + data = kmalloc(8, GFP_KERNEL); 326 + if (!data) 327 + return -ENOMEM; 344 328 345 329 ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 346 330 K90_REQUEST_STATUS, 347 331 USB_DIR_IN | USB_TYPE_VENDOR | 348 332 USB_RECIP_DEVICE, 0, 0, data, 8, 349 333 USB_CTRL_SET_TIMEOUT); 350 - if (ret < 0) { 334 + if (ret < 8) { 351 335 dev_warn(dev, "Failed to get K90 initial state (error %d).\n", 352 336 ret); 353 - return -EIO; 337 + ret = -EIO; 338 + goto out; 354 339 } 355 340 current_profile = data[7]; 356 341 if (current_profile < 1 || current_profile > 3) { 357 342 dev_warn(dev, "Read invalid current profile: %02hhx.\n", 358 343 data[7]); 359 - return -EIO; 344 + ret = -EIO; 345 + goto out; 360 346 } 361 347 362 - return snprintf(buf, PAGE_SIZE, "%d\n", current_profile); 348 + ret = snprintf(buf, PAGE_SIZE, "%d\n", current_profile); 349 + out: 350 + kfree(data); 351 + 352 + return ret; 363 353 } 364 354 365 355 static ssize_t k90_store_current_profile(struct device *dev,
+8 -8
drivers/hid/wacom_sys.c
··· 740 740 return retval; 741 741 } 742 742 743 + if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) 744 + wacom_wac->shared->touch = hdev; 745 + else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN) 746 + wacom_wac->shared->pen = hdev; 747 + 743 748 out: 744 749 mutex_unlock(&wacom_udev_list_lock); 745 750 return retval; ··· 2041 2036 if (error) 2042 2037 goto fail; 2043 2038 2044 - error = wacom_add_shared_data(hdev); 2045 - if (error) 2046 - goto fail; 2047 - 2048 2039 /* 2049 2040 * Bamboo Pad has a generic hid handling for the Pen, and we switch it 2050 2041 * into debug mode for the touch part. ··· 2081 2080 2082 2081 wacom_update_name(wacom, wireless ? " (WL)" : ""); 2083 2082 2084 - if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) 2085 - wacom_wac->shared->touch = hdev; 2086 - else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN) 2087 - wacom_wac->shared->pen = hdev; 2083 + error = wacom_add_shared_data(hdev); 2084 + if (error) 2085 + goto fail; 2088 2086 2089 2087 if (!(features->device_type & WACOM_DEVICETYPE_WL_MONITOR) && 2090 2088 (features->quirks & WACOM_QUIRK_BATTERY)) {
+10
drivers/hid/wacom_wac.c
··· 2187 2187 2188 2188 wacom_report_events(hdev, report); 2189 2189 2190 + /* 2191 + * Non-input reports may be sent prior to the device being 2192 + * completely initialized. Since only their events need 2193 + * to be processed, exit after 'wacom_report_events' has 2194 + * been called to prevent potential crashes in the report- 2195 + * processing functions. 2196 + */ 2197 + if (report->type != HID_INPUT_REPORT) 2198 + return; 2199 + 2190 2200 if (WACOM_PAD_FIELD(field)) { 2191 2201 wacom_wac_pad_battery_report(hdev, report); 2192 2202 if (wacom->wacom_wac.pad_input)