HID: check for valid USB device for many HID drivers

Many HID drivers assume that the HID device assigned to them is a USB
device as that was the only way HID devices used to be able to be
created i

HID: check for valid USB device for many HID drivers

Many HID drivers assume that the HID device assigned to them is a USB
device as that was the only way HID devices used to be able to be
created in Linux. However, with the additional ways that HID devices
can be created for many different bus types, that is no longer true, so
properly check that we have a USB device associated with the HID device
before allowing a driver that makes this assumption to claim it.

Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: Michael Zaidman <michael.zaidman@gmail.com>
Cc: Stefan Achatz <erazor_de@users.sourceforge.net>
Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Cc: linux-input@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
[bentiss: amended for thrustmater.c hunk to apply]
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211201183503.2373082-3-gregkh@linuxfoundation.org

show more ...

HID: check for valid USB device for many HID drivers

commit 93020953d0fa7035fd036ad87a47ae2b7aa4ae33 upstream.

Many HID drivers assume that the HID device assigned to them is a USB
device as that w

HID: check for valid USB device for many HID drivers

commit 93020953d0fa7035fd036ad87a47ae2b7aa4ae33 upstream.

Many HID drivers assume that the HID device assigned to them is a USB
device as that was the only way HID devices used to be able to be
created in Linux. However, with the additional ways that HID devices
can be created for many different bus types, that is no longer true, so
properly check that we have a USB device associated with the HID device
before allowing a driver that makes this assumption to claim it.

Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: Michael Zaidman <michael.zaidman@gmail.com>
Cc: Stefan Achatz <erazor_de@users.sourceforge.net>
Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Cc: linux-input@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
[bentiss: amended for thrustmater.c hunk to apply]
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211201183503.2373082-3-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

HID: logitech-dj: Handle newer quad/bt2.0 receivers in HID proxy mode

The Dinovo Edge and Dinovo Mini keyboards with builtin touchpad come with
a different version of the quad/bt2.0 combo receivers

HID: logitech-dj: Handle newer quad/bt2.0 receivers in HID proxy mode

The Dinovo Edge and Dinovo Mini keyboards with builtin touchpad come with
a different version of the quad/bt2.0 combo receivers shipped with the
MX5000 and MX5500 keyboards. These receivers are compatible with one
another, e.g. the Dinovo Edge keyboard can be paired with the MX5000
receiver.

Like the MX5x00 receivers in HID proxy mode these receivers present
themselves as a hub with multiple USB-HID devices, one for the keyboard
and one for the mouse.

Where they differ is that the mouse USB-device has 2 input reports for
reporting mice events. It has the exact same INPUT(2) report as the
MX5x00 receivers, but it also has a second INPUT(5) mouse report which
is different; and when the Dinovo receivers are paired with the Dinovo
keyboards the second INPUT(5) mouse report is actually used for events
on the builtin touchpad.

Add support for handling the Dinovo quad/bluetooth-2.0 combo receivers
in HID proxy mode to logitech-dj, like we already do for the similar
MX5000 and MX5500 receivers.

This adds battery monitoring functionality (through logitech-hidpp) and
fixes the Phone (Fn + F1) and "[A]" - "[D]" (Fn + F9 - F12) hotkeys not
working on the Dinovo Edge.

Note these receivers present themselves as a hub with 2 separate USB
devices for the keyboard and mouse; and the logitech-dj code needs to
bind to both devices (just as with the MX5x00 receivers).

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: logitech: Fix general protection fault caused by Logitech driver

The syzbot fuzzer found a general protection fault in the HID subsystem:

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be

HID: logitech: Fix general protection fault caused by Logitech driver

The syzbot fuzzer found a general protection fault in the HID subsystem:

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
CPU: 0 PID: 3715 Comm: syz-executor.3 Not tainted 5.2.0-rc6+ #15
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__pm_runtime_resume+0x49/0x180 drivers/base/power/runtime.c:1069
Code: ed 74 d5 fe 45 85 ed 0f 85 9a 00 00 00 e8 6f 73 d5 fe 48 8d bd c1 02
00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48
89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 fe 00 00 00
RSP: 0018:ffff8881d99d78e0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000020 RCX: ffffc90003f3f000
RDX: 0000000416d8686d RSI: ffffffff82676841 RDI: 00000020b6c3436a
RBP: 00000020b6c340a9 R08: ffff8881c6d64800 R09: fffffbfff0e84c25
R10: ffff8881d99d7940 R11: ffffffff87426127 R12: 0000000000000004
R13: 0000000000000000 R14: ffff8881d9b94000 R15: ffffffff897f9048
FS: 00007f047f542700(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30f21000 CR3: 00000001ca032000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
pm_runtime_get_sync include/linux/pm_runtime.h:226 [inline]
usb_autopm_get_interface+0x1b/0x50 drivers/usb/core/driver.c:1707
usbhid_power+0x7c/0xe0 drivers/hid/usbhid/hid-core.c:1234
hid_hw_power include/linux/hid.h:1038 [inline]
hidraw_open+0x20d/0x740 drivers/hid/hidraw.c:282
chrdev_open+0x219/0x5c0 fs/char_dev.c:413
do_dentry_open+0x497/0x1040 fs/open.c:778
do_last fs/namei.c:3416 [inline]
path_openat+0x1430/0x3ff0 fs/namei.c:3533
do_filp_open+0x1a1/0x280 fs/namei.c:3563
do_sys_open+0x3c0/0x580 fs/open.c:1070
do_syscall_64+0xb7/0x560 arch/x86/entry/common.c:301
entry_SYSCALL_64_after_hwframe+0x49/0xbe

It turns out the fault was caused by a bug in the HID Logitech driver,
which violates the requirement that every pathway calling
hid_hw_start() must also call hid_hw_stop(). This patch fixes the bug
by making sure the requirement is met.

Reported-and-tested-by: syzbot+3cbe5cd105d2ad56a1df@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

Based on 1 normalized pattern(s):

this program is free software you can redistribute it and or modify
it under the terms of th

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

Based on 1 normalized pattern(s):

this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license as published by
the free software foundation either version 2 of the license or at
your option any later version

extracted by the scancode license scanner the SPDX license identifier

GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 3029 file(s).

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Allison Randal <allison@lohutok.net>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070032.746973796@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

HID: logitech-dj: Add usb-id for the 27MHz MX3000 receiver

Testing has shown that, as expected, the MX3000 receiver is fully
compatible with the existing 27MHz receiver support in hid-logitech-dj.c.

HID: logitech-dj: Add usb-id for the 27MHz MX3000 receiver

Testing has shown that, as expected, the MX3000 receiver is fully
compatible with the existing 27MHz receiver support in hid-logitech-dj.c.

After this the only, presumably also compatible, receiver id left in
hid-lg.c is the USB_DEVICE_ID_S510_RECEIVER / 0xc50c id. If we can get
someone to confirm that this receiver works with the dj 27Mhz support too,
then the handling of the LG_RDESC and LG_WIRELESS quirks can be removed
from hid-lg.c.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: logitech-dj: add support for 27 MHz receivers

Most Logitech wireless keyboard and mice using the 27 MHz are hidpp10
devices, add support to logitech-dj for their receivers.

Doing so leads to 2

HID: logitech-dj: add support for 27 MHz receivers

Most Logitech wireless keyboard and mice using the 27 MHz are hidpp10
devices, add support to logitech-dj for their receivers.

Doing so leads to 2 improvements:

1) All these devices share the same USB product-id for their receiver,
making it impossible to properly map some special keys / buttons
which differ from device to device. Adding support to logitech-dj to
see these as hidpp10 devices allows us to get the actual device-id
from the keyboard / mouse.

2) It enables battery-monitoring of these devices

This patch uses a new HID group for 27Mhz devices, since the logitech-hidpp
code needs to be able to differentiate them from other devices instantiated
by the logitech-dj code.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>

show more ...

HID: fix Logitech WingMan Formula GP joined axes

The Logitech WingMan Formula GP by default presents a combined
accelerate/brake axis, so this patch assigns it to hid-logitech in order to
benefit fr

HID: fix Logitech WingMan Formula GP joined axes

The Logitech WingMan Formula GP by default presents a combined
accelerate/brake axis, so this patch assigns it to hid-logitech in order to
benefit from the axis-splitting logic in lg4ff. There is also a fixed
report descriptor for the resulting report.

Signed-off-by: Jarrad Whitaker <jarrad.whitaker@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: hid-lg: make array cbuf static const to shink object code size

Don't populate array cbuf on the stack, instead make it static.
Makes the object code smaller by over 110 bytes:

Before:
text

HID: hid-lg: make array cbuf static const to shink object code size

Don't populate array cbuf on the stack, instead make it static.
Makes the object code smaller by over 110 bytes:

Before:
text data bss dec hex filename
15096 3504 128 18728 4928 drivers/hid/hid-lg.o

After:
text data bss dec hex filename
14884 3600 128 18612 48b4 drivers/hid/hid-lg.o

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: hid-lg: Fix immediate disconnection of Logitech Rumblepad 2

With NOGET quirk Logitech F510 is now fully workable in dinput mode including
rumble effects (according to fftest).

Bugzilla: https:

HID: hid-lg: Fix immediate disconnection of Logitech Rumblepad 2

With NOGET quirk Logitech F510 is now fully workable in dinput mode including
rumble effects (according to fftest).

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=117091

[jkosina@suse.cz: fix patch format]
Signed-off-by: Ardinartsev Nikita <ardinar23@gmail.com>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: lg: make transfer buffers DMA capable

Kernel v4.9 strictly enforces DMA capable buffers, so we need to remove
buffers allocated on the stack.

[jkosina@suse.cz: fix up second usage of hid_hw_ra

HID: lg: make transfer buffers DMA capable

Kernel v4.9 strictly enforces DMA capable buffers, so we need to remove
buffers allocated on the stack.

[jkosina@suse.cz: fix up second usage of hid_hw_raw_request(), spotted by
0day build bot]
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: hid-logitech: Improve Wingman Formula Force GP support

Move ForceFeedback support for the Formula Force GP into hid-lgff4
and re-write HID descriptor, thus allowing combined pedals or not
as us

HID: hid-logitech: Improve Wingman Formula Force GP support

Move ForceFeedback support for the Formula Force GP into hid-lgff4
and re-write HID descriptor, thus allowing combined pedals or not
as user desires.

Signed-off-by: Simon Wood <simon@mungewell.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: hid-logitech: Rewrite of descriptor for all DF wheels

Rewrite the HID descriptor for _all_ Driving Force wheels (real
or emulated) so that they can report separate Accelerator and
Brake axis.

HID: hid-logitech: Rewrite of descriptor for all DF wheels

Rewrite the HID descriptor for _all_ Driving Force wheels (real
or emulated) so that they can report separate Accelerator and
Brake axis.

If the user wants a combined accel/brake axis, they can use the
'combined pedals' feature.

$ echo 1 > /sys/bus/hid/devices/<device-id>/combine_pedals

Signed-off-by: Simon Wood <simon@mungewell.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: hid-logitech: Add combined pedal support Logitech wheels

Add support for reporting a combined accelerator/brake axis for wheels
which contain combined data in their HID stream.

This includes D

HID: hid-logitech: Add combined pedal support Logitech wheels

Add support for reporting a combined accelerator/brake axis for wheels
which contain combined data in their HID stream.

This includes DF, MOMO, MOMO2 and DFP.

Signed-off-by: Simon Wood <simon@mungewell.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: lg: fix a typo in descriptors comments s/Joystik/Joystick/

Signed-off-by: Antonio Ospite <ao2@ao2.it>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

HID: lg: restrict filtering out of first interface to G29 only

Looks like 29fae1c85 ("HID: logitech: Add support for G29") was a little
bit aggressive and broke other devices.

Fixes: https://bugzil

HID: lg: restrict filtering out of first interface to G29 only

Looks like 29fae1c85 ("HID: logitech: Add support for G29") was a little
bit aggressive and broke other devices.

Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=108121

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: logitech: Add support for G29

At present the G29 is mis-identified as a DFGT, this patch ensures
that the wheel is correctly detected and allows setting the LEDs and
turning range via the '/sys

HID: logitech: Add support for G29

At present the G29 is mis-identified as a DFGT, this patch ensures
that the wheel is correctly detected and allows setting the LEDs and
turning range via the '/sys' interface.

This wheel can also emulate other types of Logitech wheels.

Signed-off-by: Simon Wood <simon@mungewell.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: hid-lg: Add USBID for Logitech G29 Wheel

Since this wheel is now available, and the USBID is listed on their website,
this patch adds it to allow the hid-lg4ff force feedback driver to find it.

HID: hid-lg: Add USBID for Logitech G29 Wheel

Since this wheel is now available, and the USBID is listed on their website,
this patch adds it to allow the hid-lg4ff force feedback driver to find it.

I do not have this wheel to test with, but this should at least get it working
in emulation mode.

Note: There is probably more work required for adjust HID descriptor and handle
switching between emulation and native modes.

Signed-off-by: Simon Wood <simon@mungewell.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>

show more ...

HID: hid-lg: Only one of LG_FF flags can be set for a given device

Only one of LG_FF flags can be set for a given device.

Signed-off-by: Michal Malý <madcatxster@devoid-pointer.net>
Signed-off-by:

HID: hid-lg: Only one of LG_FF flags can be set for a given device

Only one of LG_FF flags can be set for a given device.

Signed-off-by: Michal Malý <madcatxster@devoid-pointer.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: hid-lg4ff: Stop the hid device from lg4ff

Stop the hid device from lg4ff. Originally hid-lg was responsible for
stopping of the device.

Signed-off-by: Michal Malý <madcatxster@devoid-pointer.n

HID: hid-lg4ff: Stop the hid device from lg4ff

Stop the hid device from lg4ff. Originally hid-lg was responsible for
stopping of the device.

Signed-off-by: Michal Malý <madcatxster@devoid-pointer.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: hid-lg: Check return values from lg[N]ff_init()

Check return values from lg[N]ff_init(). hid-lg did not check return values from
the lg[N]_init() functions, possibly trying to work with a devic

HID: hid-lg: Check return values from lg[N]ff_init()

Check return values from lg[N]ff_init(). hid-lg did not check return values from
the lg[N]_init() functions, possibly trying to work with a device whose
initialization has failed.

Signed-off-by: Michal Malý <madcatxster@devoid-pointer.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: make timeout HZ independent

wait_event_interruptible_timeout() expects a timeout in jiffies so the
numeric constant becomes HZ dependent - put it through msecs_to_jiffies()
to make it HZ indepe

HID: make timeout HZ independent

wait_event_interruptible_timeout() expects a timeout in jiffies so the
numeric constant becomes HZ dependent - put it through msecs_to_jiffies()
to make it HZ independent.

Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: hid-lg4ff: Introduce a module parameter to disable automatic switch of compatibility mode

Introduce a module parameter to disable automatic switch of Logitech gaming
wheels from compatibility t

HID: hid-lg4ff: Introduce a module parameter to disable automatic switch of compatibility mode

Introduce a module parameter to disable automatic switch of Logitech gaming
wheels from compatibility to native mode. This only applies to multimode wheels.

Signed-off-by: Michal Malý <madcatxster@devoid-pointer.net>
Tested-by: Simon Wood <simon@mungewell.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: fix a couple of off-by-ones

There are a few very theoretical off-by-one bugs in report descriptor size
checking when performing a pre-parsing fixup. Fix those.

Cc: stable@vger.kernel.org
Repor

HID: fix a couple of off-by-ones

There are a few very theoretical off-by-one bugs in report descriptor size
checking when performing a pre-parsing fixup. Fix those.

Cc: stable@vger.kernel.org
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...

HID: replace hid_output_raw_report with hid_hw_raw_request for feature requests

ret = hid_output_raw_report(A, B, C, HID_FEATURE_REPORT);
is equivalent to
ret = hid_hw_raw_request(A, B[0], B, C,

HID: replace hid_output_raw_report with hid_hw_raw_request for feature requests

ret = hid_output_raw_report(A, B, C, HID_FEATURE_REPORT);
is equivalent to
ret = hid_hw_raw_request(A, B[0], B, C, HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
whatever the transport layer is.

So use the new API where available

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

show more ...