Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Alan Stern 3a002e4029 HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections ... commit 64f2657b579343cf923aa933f08074e6258eb07b upstream. A report in 2019 by the syzbot fuzzer was found to be connected to two errors in the HID core associated with Resolution Multipliers. One of the errors was fixed by commit ea427a222d8b ("HID: core: Fix deadloop in hid_apply_multiplier."), but the other has not been fixed. This error arises because hid_apply_multipler() assumes that every Resolution Multiplier control is contained in a Logical Collection, i.e., there's no way the routine can ever set multiplier_collection to NULL. This is in spite of the fact that the function starts with a big comment saying: * "The Resolution Multiplier control must be contained in the same * Logical Collection as the control(s) to which it is to be applied. ... * If no Logical Collection is * defined, the Resolution Multiplier is associated with all * controls in the report." * HID Usage Table, v1.12, Section 4.3.1, p30 * * Thus, search from the current collection upwards until we find a * logical collection... The comment and the code overlook the possibility that none of the collections found may be a Logical Collection. The fix is to set the multiplier_collection pointer to NULL if the collection found isn't a Logical Collection. Reported-by: syzbot+ec5f884c4a135aa0dbb9@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000109c040597dc5843@google.com/ Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Cc: Peter Hutterer <peter.hutterer@who-t.net> Fixes: 5a4abb36f3 ("HID: core: process the Resolution Multiplier") Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-03-13 12:43:01 +01:00
..
i2c-hid	HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up	2024-05-02 16:18:37 +02:00
intel-ish-hid	hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma	2024-11-08 16:20:47 +01:00
usbhid
hid-a4tech.c
hid-accutouch.c
hid-alps.c	HID: alps: Declare U1_UNICORN_LEGACY support	2022-08-25 11:17:57 +02:00
hid-apple.c	HID: apple: Add 2021 magic keyboard FN key mapping	2024-02-23 08:25:05 +01:00
hid-appleir.c
hid-asus.c	HID: hid-asus: add const to read-only outgoing usb buffer	2023-12-20 15:41:23 +01:00
hid-aureal.c
hid-axff.c
hid-belkin.c
hid-betopff.c	HID: betop: check shape of output reports	2023-02-06 07:52:39 +01:00
hid-bigbenff.c	hid: bigben_probe(): validate report count	2023-03-11 16:43:49 +01:00
hid-cherry.c
hid-chicony.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-cmedia.c
hid-core.c	HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections	2025-03-13 12:43:01 +01:00
hid-corsair.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-cougar.c	HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup	2024-09-12 11:03:54 +02:00
hid-cp2112.c	hid: cp2112: Fix duplicate workqueue initialization	2023-11-20 10:30:12 +01:00
hid-creative-sb0540.c
hid-cypress.c
hid-debug.c	HID: fix HID device resource race between HID core and debugging support	2023-12-08 08:44:23 +01:00
hid-dr.c
hid-elan.c	HID: elan: Fix potential double free in elan_input_configured	2022-06-14 18:11:33 +02:00
hid-elecom.c
hid-elo.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-emsff.c
hid-ezkey.c
hid-gaff.c
hid-gembird.c
hid-generic.c
hid-gfrm.c
hid-google-hammer.c	HID: google: add jewel USB id	2023-06-09 10:28:59 +02:00
hid-gt683r.c
hid-gyration.c
hid-holtek-kbd.c	HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event	2023-10-25 11:53:23 +02:00
hid-holtek-mouse.c	HID: holtek: fix mouse probing	2021-12-29 12:23:33 +01:00
hid-holtekff.c
hid-hyperv.c	HID: hyperv: fix possible memory leak in mousevsc_probe()	2022-11-25 17:42:04 +01:00
hid-icade.c
hid-ids.h	HID: plantronics: Workaround for an unexcepted opposite volume key	2024-11-08 16:20:46 +01:00
hid-input.c	HID: Add Mapping for System Microphone Mute	2023-03-11 16:43:56 +01:00
hid-ite.c	HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10	2023-01-18 11:40:48 +01:00
hid-jabra.c
hid-kensington.c
hid-keytouch.c
hid-kye.c
hid-lcpower.c
hid-led.c	HID: hid-led: fix maximum brightness for Dream Cheeky	2022-06-14 18:11:33 +02:00
hid-lenovo.c
hid-lg.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-lg.h
hid-lg2ff.c
hid-lg3ff.c
hid-lg4ff.c	HID: hid-lg4ff: Add check for empty lbuf	2022-12-14 11:30:43 +01:00
hid-lg4ff.h
hid-lgff.c
hid-logitech-dj.c	HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()	2024-07-05 09:08:16 +02:00
hid-logitech-hidpp.c	HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect	2023-10-25 11:53:17 +02:00
hid-macally.c
hid-magicmouse.c	HID: magicmouse: Do not set BTN_MOUSE on double report	2022-10-29 10:20:35 +02:00
hid-maltron.c
hid-mf.c
hid-microsoft.c	HID: microsoft: Add rumble support to latest xbox controllers	2024-09-04 13:15:01 +02:00
hid-monterey.c
hid-multitouch.c	HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad	2024-11-17 14:58:53 +01:00
hid-nti.c
hid-ntrig.c
hid-ortek.c
hid-penmount.c
hid-petalynx.c
hid-picolcd.h
hid-picolcd_backlight.c
hid-picolcd_cir.c
hid-picolcd_core.c
hid-picolcd_debugfs.c
hid-picolcd_fb.c
hid-picolcd_lcd.c
hid-picolcd_leds.c
hid-pl.c
hid-plantronics.c	HID: plantronics: Workaround for an unexcepted opposite volume key	2024-11-08 16:20:46 +01:00
hid-primax.c
hid-prodikeys.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-quirks.c	HID: apple: Add support for the 2021 Magic Keyboard	2024-02-23 08:25:05 +01:00
hid-redragon.c
hid-retrode.c
hid-rmi.c
hid-roccat-arvo.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-roccat-arvo.h
hid-roccat-common.c
hid-roccat-common.h
hid-roccat-isku.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-roccat-isku.h
hid-roccat-kone.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-roccat-kone.h
hid-roccat-koneplus.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-roccat-koneplus.h
hid-roccat-konepure.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-roccat-kovaplus.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-roccat-kovaplus.h
hid-roccat-lua.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-roccat-lua.h
hid-roccat-pyra.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-roccat-pyra.h
hid-roccat-ryos.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-roccat-savu.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-roccat-savu.h
hid-roccat.c	HID: roccat: Fix use-after-free in roccat_read()	2022-10-26 13:22:57 +02:00
hid-saitek.c	HID: saitek: add madcatz variant of MMO7 mouse device ID	2022-11-10 17:57:53 +01:00
hid-samsung.c	HID: check for valid USB device for many HID drivers	2021-12-14 14:48:59 +01:00
hid-sensor-custom.c	HID: hid-sensor-custom: set fixed size for custom attributes	2023-01-18 11:41:04 +01:00
hid-sensor-hub.c
hid-sjoy.c
hid-sony.c
hid-speedlink.c
hid-steam.c	HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report	2022-09-05 10:27:45 +02:00
hid-steelseries.c
hid-sunplus.c
hid-tivo.c
hid-tmff.c
hid-topseed.c
hid-twinhan.c
hid-u2fzero.c
hid-uclogic-core.c	HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk	2023-01-18 11:40:48 +01:00
hid-uclogic-params.c	HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad	2022-01-27 09:19:36 +01:00
hid-uclogic-params.h
hid-uclogic-rdesc.c
hid-uclogic-rdesc.h
hid-udraw-ps3.c
hid-viewsonic.c
hid-waltop.c
hid-wiimote-core.c
hid-wiimote-debug.c
hid-wiimote-modules.c
hid-wiimote.h
hid-xinmo.c
hid-zpff.c
hid-zydacron.c
hidraw.c	HID: hidraw: fix memory leak in hidraw_release()	2022-09-05 10:27:45 +02:00
Kconfig	HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option	2022-01-05 12:37:43 +01:00
Makefile
uhid.c	HID: uhid: Over-ride the default maximum data buffer value with our own	2023-03-22 13:28:10 +01:00
wacom.h	HID: wacom: remove the battery when the EKR is off	2023-09-23 10:59:37 +02:00
wacom_sys.c	HID: wacom: fix when get product name maybe null pointer	2024-12-14 19:44:48 +01:00
wacom_wac.c	HID: wacom: Interpret tilt data from Intuos Pro BT as signed values	2024-12-14 19:44:38 +01:00
wacom_wac.h	HID: wacom: remove the battery when the EKR is off	2023-09-23 10:59:37 +02:00