aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/hid/hidraw.c (follow)
AgeCommit message (Collapse)AuthorFilesLines
2010-10-20HID: hidraw: fix window in hidraw_releaseJiri Slaby1-4/+10
There is a window between hidraw_table check and its dereference. In that window, the device may be unplugged and removed form the system and we will then dereference NULL. Lock that place properly so that either we get NULL and jump out or we can work with real pointer. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2010-10-15llseek: automatically add .llseek fopArnd Bergmann1-0/+1
All file_operations should get a .llseek operation so we can make nonseekable_open the default for future file operations without a .llseek pointer. The three cases that we can automatically detect are no_llseek, seq_lseek and default_llseek. For cases where we can we can automatically prove that the file offset is always ignored, we use noop_llseek, which maintains the current behavior of not returning an error from a seek. New drivers should normally not use noop_llseek but instead use no_llseek and call nonseekable_open at open time. Existing drivers can be converted to do the same when the maintainer knows for certain that no user code relies on calling seek on the device file. The generated code is often incorrectly indented and right now contains comments that clarify for each added line why a specific variant was chosen. In the version that gets submitted upstream, the comments will be gone and I will manually fix the indentation, because there does not seem to be a way to do that using coccinelle. Some amount of new code is currently sitting in linux-next that should get the same modifications, which I will do at the end of the merge window. Many thanks to Julia Lawall for helping me learn to write a semantic patch that does all this. ===== begin semantic patch ===== // This adds an llseek= method to all file operations, // as a preparation for making no_llseek the default. // // The rules are // - use no_llseek explicitly if we do nonseekable_open // - use seq_lseek for sequential files // - use default_llseek if we know we access f_pos // - use noop_llseek if we know we don't access f_pos, // but we still want to allow users to call lseek // @ open1 exists @ identifier nested_open; @@ nested_open(...) { <+... nonseekable_open(...) ...+> } @ open exists@ identifier open_f; identifier i, f; identifier open1.nested_open; @@ int open_f(struct inode *i, struct file *f) { <+... ( nonseekable_open(...) | nested_open(...) ) ...+> } @ read disable optional_qualifier exists @ identifier read_f; identifier f, p, s, off; type ssize_t, size_t, loff_t; expression E; identifier func; @@ ssize_t read_f(struct file *f, char *p, size_t s, loff_t *off) { <+... ( *off = E | *off += E | func(..., off, ...) | E = *off ) ...+> } @ read_no_fpos disable optional_qualifier exists @ identifier read_f; identifier f, p, s, off; type ssize_t, size_t, loff_t; @@ ssize_t read_f(struct file *f, char *p, size_t s, loff_t *off) { ... when != off } @ write @ identifier write_f; identifier f, p, s, off; type ssize_t, size_t, loff_t; expression E; identifier func; @@ ssize_t write_f(struct file *f, const char *p, size_t s, loff_t *off) { <+... ( *off = E | *off += E | func(..., off, ...) | E = *off ) ...+> } @ write_no_fpos @ identifier write_f; identifier f, p, s, off; type ssize_t, size_t, loff_t; @@ ssize_t write_f(struct file *f, const char *p, size_t s, loff_t *off) { ... when != off } @ fops0 @ identifier fops; @@ struct file_operations fops = { ... }; @ has_llseek depends on fops0 @ identifier fops0.fops; identifier llseek_f; @@ struct file_operations fops = { ... .llseek = llseek_f, ... }; @ has_read depends on fops0 @ identifier fops0.fops; identifier read_f; @@ struct file_operations fops = { ... .read = read_f, ... }; @ has_write depends on fops0 @ identifier fops0.fops; identifier write_f; @@ struct file_operations fops = { ... .write = write_f, ... }; @ has_open depends on fops0 @ identifier fops0.fops; identifier open_f; @@ struct file_operations fops = { ... .open = open_f, ... }; // use no_llseek if we call nonseekable_open //////////////////////////////////////////// @ nonseekable1 depends on !has_llseek && has_open @ identifier fops0.fops; identifier nso ~= "nonseekable_open"; @@ struct file_operations fops = { ... .open = nso, ... +.llseek = no_llseek, /* nonseekable */ }; @ nonseekable2 depends on !has_llseek @ identifier fops0.fops; identifier open.open_f; @@ struct file_operations fops = { ... .open = open_f, ... +.llseek = no_llseek, /* open uses nonseekable */ }; // use seq_lseek for sequential files ///////////////////////////////////// @ seq depends on !has_llseek @ identifier fops0.fops; identifier sr ~= "seq_read"; @@ struct file_operations fops = { ... .read = sr, ... +.llseek = seq_lseek, /* we have seq_read */ }; // use default_llseek if there is a readdir /////////////////////////////////////////// @ fops1 depends on !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier readdir_e; @@ // any other fop is used that changes pos struct file_operations fops = { ... .readdir = readdir_e, ... +.llseek = default_llseek, /* readdir is present */ }; // use default_llseek if at least one of read/write touches f_pos ///////////////////////////////////////////////////////////////// @ fops2 depends on !fops1 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier read.read_f; @@ // read fops use offset struct file_operations fops = { ... .read = read_f, ... +.llseek = default_llseek, /* read accesses f_pos */ }; @ fops3 depends on !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier write.write_f; @@ // write fops use offset struct file_operations fops = { ... .write = write_f, ... + .llseek = default_llseek, /* write accesses f_pos */ }; // Use noop_llseek if neither read nor write accesses f_pos /////////////////////////////////////////////////////////// @ fops4 depends on !fops1 && !fops2 && !fops3 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier read_no_fpos.read_f; identifier write_no_fpos.write_f; @@ // write fops use offset struct file_operations fops = { ... .write = write_f, .read = read_f, ... +.llseek = noop_llseek, /* read and write both use no f_pos */ }; @ depends on has_write && !has_read && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier write_no_fpos.write_f; @@ struct file_operations fops = { ... .write = write_f, ... +.llseek = noop_llseek, /* write uses no f_pos */ }; @ depends on has_read && !has_write && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier read_no_fpos.read_f; @@ struct file_operations fops = { ... .read = read_f, ... +.llseek = noop_llseek, /* read uses no f_pos */ }; @ depends on !has_read && !has_write && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; @@ struct file_operations fops = { ... +.llseek = noop_llseek, /* no read or write fn */ }; ===== End semantic patch ===== Signed-off-by: Arnd Bergmann <arnd@arndb.de> Cc: Julia Lawall <julia@diku.dk> Cc: Christoph Hellwig <hch@infradead.org>
2010-10-06HID: hidraw, fix a NULL pointer dereference in hidraw_writeAntonio Ospite1-0/+6
BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 IP: [<ffffffffa0f0a625>] hidraw_write+0x3b/0x116 [hid] [...] This is reproducible by disconnecting the device while userspace writes to dev node in a loop and doesn't check return values in order to exit the loop. Signed-off-by: Antonio Ospite <ospite@studenti.unina.it> Cc: stable@kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2010-10-06HID: hidraw, fix a NULL pointer dereference in hidraw_ioctlAntonio Ospite1-0/+5
BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 IP: [<ffffffffa02c66b4>] hidraw_ioctl+0xfc/0x32c [hid] [...] This is reproducible by disconnecting the device while userspace does ioctl in a loop and doesn't check return values in order to exit the loop. Signed-off-by: Antonio Ospite <ospite@studenti.unina.it> Cc: stable@kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2010-05-25HID: remove unused variable from hidraw_readStefan Achatz1-2/+0
Removed unused variable from hidraw_read. Signed-off-by: Stefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2010-05-19Merge branches 'upstream-fixes', 'bkl-removal', 'debugfs-fixes' and 'hid-suspend' into for-linusJiri Kosina1-22/+26
2010-05-19Merge branch 'upstream' into for-linusJiri Kosina1-1/+1
Conflicts: drivers/hid/hid-wacom.c
2010-05-11HID: hidraw: fix indentationAntonio Ospite1-1/+1
Signed-off-by: Antonio Ospite <ospite@studenti.unina.it> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2010-03-30include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.hTejun Heo1-0/+1
percpu.h is included by sched.h and module.h and thus ends up being included when building most .c files. percpu.h includes slab.h which in turn includes gfp.h making everything defined by the two files universally available and complicating inclusion dependencies. percpu.h -> slab.h dependency is about to be removed. Prepare for this change by updating users of gfp and slab facilities include those headers directly instead of assuming availability. As this conversion needs to touch large number of source files, the following script is used as the basis of conversion. http://userweb.kernel.org/~tj/misc/slabh-sweep.py The script does the followings. * Scan files for gfp and slab usages and update includes such that only the necessary includes are there. ie. if only gfp is used, gfp.h, if slab is used, slab.h. * When the script inserts a new include, it looks at the include blocks and try to put the new include such that its order conforms to its surrounding. It's put in the include block which contains core kernel includes, in the same order that the rest are ordered - alphabetical, Christmas tree, rev-Xmas-tree or at the end if there doesn't seem to be any matching order. * If the script can't find a place to put a new include (mostly because the file doesn't have fitting include block), it prints out an error message indicating which .h file needs to be added to the file. The conversion was done in the following steps. 1. The initial automatic conversion of all .c files updated slightly over 4000 files, deleting around 700 includes and adding ~480 gfp.h and ~3000 slab.h inclusions. The script emitted errors for ~400 files. 2. Each error was manually checked. Some didn't need the inclusion, some needed manual addition while adding it to implementation .h or embedding .c file was more appropriate for others. This step added inclusions to around 150 files. 3. The script was run again and the output was compared to the edits from #2 to make sure no file was left behind. 4. Several build tests were done and a couple of problems were fixed. e.g. lib/decompress_*.c used malloc/free() wrappers around slab APIs requiring slab.h to be added manually. 5. The script was run on all .h files but without automatically editing them as sprinkling gfp.h and slab.h inclusions around .h files could easily lead to inclusion dependency hell. Most gfp.h inclusion directives were ignored as stuff from gfp.h was usually wildly available and often used in preprocessor macros. Each slab.h inclusion directive was examined and added manually as necessary. 6. percpu.h was updated not to include slab.h. 7. Build test were done on the following configurations and failures were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my distributed build env didn't work with gcov compiles) and a few more options had to be turned off depending on archs to make things build (like ipr on powerpc/64 which failed due to missing writeq). * x86 and x86_64 UP and SMP allmodconfig and a custom test config. * powerpc and powerpc64 SMP allmodconfig * sparc and sparc64 SMP allmodconfig * ia64 SMP allmodconfig * s390 SMP allmodconfig * alpha SMP allmodconfig * um on x86_64 SMP allmodconfig 8. percpu.h modifications were reverted so that it could be applied as a separate patch and serve as bisection point. Given the fact that I had only a couple of failures from tests on step 6, I'm fairly confident about the coverage of this conversion patch. If there is a breakage, it's likely to be something in one of the arch headers which should be easily discoverable easily on most builds of the specific arch. Signed-off-by: Tejun Heo <tj@kernel.org> Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org> Cc: Ingo Molnar <mingo@redhat.com> Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-25HID: remove excessive _EMERG messages from hidrawJiri Kosina1-6/+1
We don't need to shout loudly when device gets disconnected while hidraw node has been open, as this is properly handled in disconnect() and protected by minors_lock already. Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2010-03-25HID: remove BKL from hidrawJiri Kosina1-16/+25
Remove BKL from hidraw, which is possible through fixing the locking of minors_lock mutex properly -- it is now used to guard all accessess to hidraw_table[], preventing it to becoming NULL unexpectedly by unregistering the device. Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2010-02-03HID: make raw reports possible for both feature and output reportsJiri Kosina1-1/+1
In commit 2da31939a42 ("Bluetooth: Implement raw output support for HIDP layer"), support for Bluetooth hid_output_raw_report was added, but it pushes the data to the intr socket instead of the ctrl one. This has been fixed by 6bf8268f9a91f1 ("Bluetooth: Use the control channel for raw HID reports") Still, it is necessary to distinguish whether the report in question should be either FEATURE or OUTPUT. For this, we have to extend the generic HID API, so that hid_output_raw_report() callback provides means to specify this value so that it can be passed down to lower level hardware drivers (currently Bluetooth and USB). Based on original patch by Bastien Nocera <hadess@hadess.net> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2009-10-13Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hidLinus Torvalds1-3/+2
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: fix possible deadlock in hidraw_read HID: fix kerneldoc comment for hid_input_report() HID: add __init/__exit macros to twinhan.c
2009-10-12HID: fix possible deadlock in hidraw_readJiri Kosina1-3/+2
If the loop in hidraw_read() loops more than once, then we might end up trying to acquire already locked mutex, casuing a deadlock. Reported-by: iceberg <iceberg@ispras.ru> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2009-10-04headers: remove sched.h from poll.hAlexey Dobriyan1-0/+1
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-06-04HID: hidraw -- fix comment about accepted devicesJiri Kosina1-4/+1
hidraw accepts any devices, no matter if the device has already been claimed by other HID driver (hid-input, hidraw), and this is intended to stay. Fix up the comment to reflect reality. Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2009-04-07HID: hidraw -- fix missing unlocks in unlocked_ioctlDan Carpenter1-4/+8
There were 2 places that returned directly instead of releasing their locks. I sent a fix for this file earlier but ended up missing these spots. I think what happened is that I have improved my checker script since then... Or maybe I just screwed up. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2009-03-25HID: autosuspend support for USB HIDOliver Neukum1-3/+14
This uses the USB busy mechanism for aggessive autosuspend of USB HID devices. It autosuspends all opened devices supporting remote wakeup after a timeout unless - output is being done to the device - a key is being held down (remote wakeup isn't triggered upon key release) - LED(s) are lit - hiddev is opened As in the current driver closed devices will be autosuspended even if they don't support remote wakeup. The patch is quite large because output to devices is done in hard interrupt context meaning a lot a queuing and locking had to be touched. The LED stuff has been solved by means of a simple counter. Additions to the generic HID code could be avoided. In addition it now covers hidraw. It contains an embryonic version of an API to let the generic HID code tell the lower levels which capabilities with respect to power management are needed. Signed-off-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2009-02-17HID: unlock properly on error paths in hidraw_ioctl()Dan Carpenter1-5/+9
We can't return immediately because lock_kernel() is held. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2009-01-04Merge branch 'upstream-fixes' into for-nextJiri Kosina1-1/+1
Conflicts: drivers/hid/hid-ids.h
2009-01-04HID: fix reference count leak hidrawOliver Neukum1-1/+1
The hidraw subsystem has a bug that prevents the close syscall from ever reaching the low level driver, leading to a resource leak. Fix by replacing postdecrement with predecrement. Signed-off-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2009-01-04HID: set proper dev.parent in hidrawJiri Kosina1-1/+1
We need to properly set parent of the hidraw device (which is the corresponding physical device itself) in order to hidraw devices not end up under virtual device tree. Reported-by: Kay Sievers <kay.sievers@vrfy.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2009-01-04HID: add phys and name ioctls to hidrawJiri Kosina1-0/+28
The hiddev interface provides ioctl() calls which can be used to obtain phys and raw name of the underlying device. Add the corresponding support also into hidraw. Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2008-11-13HID: fix locking in hidraw_open()Oliver Neukum1-14/+16
As open needs to sleep hidraw was wrong to call it with a spinlock held. Furthermore, open can of course fail which needs to be handled. Signed-off-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2008-10-23HID: fix lock imbalance in hidrawJiri Slaby1-0/+1
Add omitted unlock_kernel() to hidraw_ioctl(). Added in 979c407e3b89b606e810fa494ef316896eadbfad (HID: Push down BKL into ioctl handler in hidraw). Corresponing sparse warning: drivers/hid/hidraw.c:267:9: warning: context imbalance in 'hidraw_ioctl': wrong count at exit drivers/hid/hidraw.c:267:9: context 'kernel_lock': wanted 0, got 1 Signed-off-by: Jiri Slaby <jirislaby@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2008-10-17HID: fix hidraw_exit section mismatchJiri Slaby1-1/+1
hidraw_exit() marked as __exit is called from __init function from HID core. Remove the section placement from that function. Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Jiri Slaby <jirislaby@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2008-10-16device create: misc: convert device_create_drvdata to device_createGreg Kroah-Hartman1-3/+2
Now that device_create() has been audited, rename things back to the original call to be sane. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-10-14HID: fix incorrent length condition in hidraw_write()Jiri Kosina1-1/+1
The bound check on the buffer length if (count > HID_MIN_BUFFER_SIZE) is of course incorrent, the proper check is if (count > HID_MAX_BUFFER_SIZE) Fix it. Reported-by: Jerry Ryle <jerry@mindtribe.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2008-10-14HID: hid, make parsing event drivenJiri Slaby1-3/+3
Next step for complete hid bus, this patch includes: - call parser either from probe or from hid-core if there is no probe. - add ll_driver structure and centralize some stuff there (open, close...) - split and merge usb_hid_configure and hid_probe into several functions to allow hooks/fixes between them Signed-off-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2008-07-23Merge branches 'upstream' and 'upstream-fixes' into for-linusJiri Kosina1-0/+2
2008-07-23HID: fix memory leak in hidraw_releaseJiri Kosina1-0/+2
hidraw_release() forgot to free the linked list structure, causing memory leak. Reported-by: Juan Marcos Diez Esteban <juan_m_diez@yahoo.es> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2008-07-23HID: Push down BKL into ioctl handler in hidrawAlan Cox1-22/+24
In this case I simply wrapped it as code review suggests the locking already terminally broken and I didn't want to make it first. See added comment Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2008-07-21device create: hid: convert device_create to device_create_drvdataGreg Kroah-Hartman1-2/+3
device_create() is race-prone, so use the race-free device_create_drvdata() instead as device_create() is going away. Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-06-20HID: cdev lock_kernel() pushdownJonathan Corbet1-0/+3
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2007-10-19Use helpers to obtain task pid in printksPavel Emelyanov1-2/+2
The task_struct->pid member is going to be deprecated, so start using the helpers (task_pid_nr/task_pid_vnr/task_pid_nr_ns) in the kernel. The first thing to start with is the pid, printed to dmesg - in this case we may safely use task_pid_nr(). Besides, printks produce more (much more) than a half of all the explicit pid usage. [akpm@linux-foundation.org: git-drm went and changed lots of stuff] Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Cc: Dave Airlie <airlied@linux.ie> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-15HID: fix HIDIOCGRDESC memory access in hidrawJiri Kosina1-3/+9
Fix bogus copying of data into userspace when HIDIOCGRDESC is issued. HID-transport layer makes sure that dev->hid->rdesc is not larger than HID_MAX_DESCRIPTOR_SIZE. Noticed-by: Al Viro <viro@ftp.linux.org.uk> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-14HID: hidraw_connect() memleak fixMariusz Kozlowski1-4/+10
It looks like hidraw_connect() is leaking memory in case of failure. Also it should return -ENOMEM when kzalloc fails. Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2007-10-14HID: add hidraw interfaceJiri Kosina1-0/+395
hidraw is an interface that is going to obsolete hiddev one day. Many userland applications are using libusb instead of using kernel-provided hiddev interface. This is caused by various reasons - the HID parser in kernel doesn't handle all the HID hardware on the planet properly, some devices might require its own specific quirks/drivers, etc. hiddev interface tries to do its best to parse all the received reports properly, and presents only parsed usages into userspace. This is however often not enough, and that's the reason why many userland applications just don't use hiddev at all, and rather use libusb to read raw USB events and process them on their own. Another drawback of hiddev is that it is USB-specific. hidraw interface provides userspace readers with really raw HID reports, no matter what the low-level transport layer is (USB/BT), and gives the userland applications all the freedom to process the HID reports in a way they wish to. Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.