A HID device could send a malicious output report that would cause the
steelseries HID driver to write beyond the output report allocation
during initialization, causing a heap overflow:
[ 167.981534] usb 1-1: New USB device found, idVendor=1038, idProduct=1410
...
[ 182.050547] BUG kmalloc-256 (Tainted: G W ): Redzone overwritten
CVE-2013-2891
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Fixes 'undefined reference' issue when hid-steelseries is built in,
but led-class is a module.
--
drivers/built-in.o: In function `steelseries_srws1_remove':
hid-steelseries.c:(.text+0x3b97a1): undefined reference to `led_classdev_unregister'
drivers/built-in.o: In function `steelseries_srws1_probe':
hid-steelseries.c:(.text+0x3b9c51): undefined reference to `led_classdev_register'
hid-steelseries.c:(.text+0x3b9ce5): undefined reference to `led_classdev_register'
hid-steelseries.c:(.text+0x3b9d4b): undefined reference to `led_classdev_unregister'
--
Patch allows LED control when led-class is built in, or both hid-steelseries
_and_ led-class are both modules.
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Simon Wood <simon@mungewell.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This allows the hid drivers to be independent from the transport layer.
The patch was constructed by replacing all occurences of
usbhid_submit_report() by its hid_hw_request() counterpart.
Then, drivers not requiring USB_HID anymore have their USB_HID
dependency cleaned in the Kconfig file.
Finally, few drivers still depends on USB_HID. Many of them
are requiring the io wait callback. They are found in the next patch.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
For the sensor-hub part:
Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The last field of the driver_data->leds[] array is used to store the
special toggle for setting all leds simultaneously, so we need to allocate
appropriate number of led_classdev pointers.
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
We usually group drivers on a per-vendor basis, implementing device-specific
deviations from the standard in vendor-specific driver.
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Kees Cook