Rodrigo Rivas Costa 7c3a5626fd HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device ...

commit a955358d54 upstream.

Doing `ioctl(HIDIOCGFEATURE)` in a tight loop on a hidraw device
and then disconnecting the device, or unloading the driver, can
cause a NULL pointer dereference.

When a hidraw device is destroyed it sets 0 to `dev->exist`.
Most functions check 'dev->exist' before doing its work, but
`hidraw_get_report()` was missing that check.

Cc: stable@vger.kernel.org
Signed-off-by: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-04-24 09:32:10 +02:00

..

i2c-hid

HID: i2c-hid: fix size check and type usage

2018-04-24 09:32:06 +02:00

usbhid

HID: usbhid: fix out-of-bounds bug

2017-10-18 09:20:41 +02:00

hid-a4tech.c

HID: trivial devm conversion for special hid drivers

2013-07-31 10:12:28 +02:00

hid-apple.c

HID: apple: Add support for the 2015 Macbook Pro

2015-07-27 15:43:46 -07:00

hid-appleir.c

HID: hid-input: allow input_configured callback return errors

2015-11-05 09:51:50 -08:00

hid-aureal.c

HID: fix some indenting issues

2015-10-21 13:15:53 +02:00

hid-axff.c

HID: enable Mayflash USB Gamecube Adapter

2013-11-12 19:06:23 +01:00

hid-belkin.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-betopff.c

HID: betop: add drivers/hid/hid-betopff.c

2014-12-22 15:00:25 +01:00

hid-cherry.c

HID: fix a couple of off-by-ones

2014-08-21 10:43:28 -05:00

hid-chicony.c

HID: chicony: Add support for another ASUS Zen AiO keyboard

2017-12-16 10:33:52 +01:00

hid-core.c

HID: core: Fix size as type u32

2018-04-24 09:32:07 +02:00

hid-corsair.c

HID: corsair: fix control-transfer error handling

2017-01-26 08:23:48 +01:00

hid-cp2112.c

HID: cp2112: fix byte order in SMBUS operations

2015-07-14 22:42:42 +02:00

hid-cypress.c

HID: hid-cypress: validate length of report

2017-01-15 13:41:36 +01:00

hid-debug.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2015-04-14 18:25:15 -07:00

hid-dr.c

HID: dragonrise: fix HID Descriptor for 0x0006 PID

2015-09-04 14:52:09 +02:00

hid-elecom.c

HID: fix some indenting issues

2015-10-21 13:15:53 +02:00

hid-elo.c

HID: elo: clear BTN_LEFT mapping

2018-03-22 09:23:27 +01:00

hid-emsff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-ezkey.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-gaff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-gembird.c

HID: gembird: add new driver to fix Gembird JPD-DualForce 2

2015-08-18 15:03:43 +02:00

hid-generic.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-gfrm.c

HID: hid-gfrm: avoid warning for input_configured API change

2015-11-05 10:15:35 -08:00

hid-gt683r.c

HID: gt683r: move mode attribute to led-class devices

2014-07-03 11:14:11 -07:00

hid-gyration.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-holtek-kbd.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-holtek-mouse.c

HID: Add Holtek USB ID 04d9:a0c2 ETEKCITY Scroll

2014-09-08 09:48:56 +02:00

hid-holtekff.c

HID: hid-holtekff: don't push static constants on stack for %*ph

2013-08-05 11:29:57 +02:00

hid-hyperv.c

HID: hyperv: match wait_for_completion_timeout return type

2015-01-26 14:25:41 +01:00

hid-icade.c

HID: icade: u16 which never < 0

2013-04-24 16:32:27 +02:00

hid-ids.h

usb: ldusb: add PIDs for new CASSY devices supported by this driver

2018-02-28 10:17:23 +01:00

hid-input.c

HID: Fix hid_report_len usage

2018-04-24 09:32:07 +02:00

hid-kensington.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-keytouch.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-kye.c

HID: kye: Fix report descriptor for Genius PenSketch M912

2015-02-17 13:13:45 +01:00

hid-lcpower.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-lenovo.c

HID: hid-input: allow input_configured callback return errors

2015-11-05 09:51:50 -08:00

hid-lg2ff.c

HID: logitech - lg2ff: Add IDs for Formula Vibration Feedback Wheel

2013-10-09 12:06:02 +02:00

hid-lg3ff.c

HID: LG: validate HID output report details

2013-09-13 15:12:39 +02:00

hid-lg4ff.c

HID: logitech: Add support for G29

2015-11-06 21:18:06 +01:00

hid-lg4ff.h

HID: hid-lg4ff: Remove double underscore prefix from numeric types

2015-05-07 16:27:07 +02:00

hid-lg.c

HID: lg: restrict filtering out of first interface to G29 only

2015-12-02 14:51:00 +01:00

hid-lg.h

HID: hid-lg4ff: Introduce a module parameter to disable automatic switch of compatibility mode

2015-02-18 21:14:54 +01:00

hid-lgff.c

HID: LG: validate HID output report details

2013-09-13 15:12:39 +02:00

hid-logitech-dj.c

HID: logitech-dj: check report length

2014-12-17 08:50:12 +01:00

hid-logitech-hidpp.c

Merge branches 'for-4.3/upstream-fixes', 'for-4.4/corsair', 'for-4.4/dragonrise', 'for-4.4/i2c-hid', 'for-4.4/logitech', 'for-4.4/microsoft', 'for-4.4/multitouch', 'for-4.4/roccat-sysfs-deprecation', 'for-4.4/upstream' and 'for-4.4/wacom' into for-linus

2015-11-06 21:45:15 +01:00

hid-magicmouse.c

HID: hid-input: allow input_configured callback return errors

2015-11-05 09:51:50 -08:00

hid-microsoft.c

HID: Add new Microsoft Type Cover 3 product ID

2015-09-23 11:47:24 +02:00

hid-monterey.c

HID: fix a couple of off-by-ones

2014-08-21 10:43:28 -05:00

hid-multitouch.c

HID: Fix hid_report_len usage

2018-04-24 09:32:07 +02:00

hid-ntrig.c

HID: hid-input: allow input_configured callback return errors

2015-11-05 09:51:50 -08:00

hid-ortek.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-penmount.c

HID: add support for PenMount HID TouchScreen Driver

2014-09-04 11:23:51 +02:00

hid-petalynx.c

HID: fix a couple of off-by-ones

2014-08-21 10:43:28 -05:00

hid-picolcd_backlight.c

HID: picoLCD: Deletion of unnecessary checks before three function calls

2015-06-29 14:51:12 +02:00

hid-picolcd_cir.c

HID: picoLCD: Deletion of unnecessary checks before three function calls

2015-06-29 14:51:12 +02:00

hid-picolcd_core.c

HID: picolcd: be more verbose when reporting report size error

2014-08-27 23:27:10 +02:00

hid-picolcd_debugfs.c

HID: picolcd: remove unnecessary NULL test before debugfs_remove

2014-06-30 09:54:22 +02:00

hid-picolcd_fb.c

drivers/hid/hid-picolcd_fb: avoid world-writable sysfs files.

2014-05-14 10:53:56 +09:30

hid-picolcd_lcd.c

HID: picoLCD: Deletion of unnecessary checks before three function calls

2015-06-29 14:51:12 +02:00

hid-picolcd_leds.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-picolcd.h

Merge branches 'for-3.10/multitouch', 'for-3.10/roccat' and 'for-3.10/upstream' into for-linus

2013-04-30 10:19:07 +02:00

hid-pl.c

HID: pantherlord: validate output report details

2013-09-04 11:58:32 +02:00

hid-plantronics.c

HID: plantronics: Update to map volume up/down controls

2015-06-12 15:04:17 +02:00

hid-primax.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-prodikeys.c

HID: fix some indenting issues

2015-10-21 13:15:53 +02:00

hid-rmi.c

HID: Fix hid_report_len usage

2018-04-24 09:32:07 +02:00

hid-roccat-arvo.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

2013-09-06 09:30:36 -07:00

hid-roccat-arvo.h

HID: roccat: correction and cleanup of HID feature reports

2011-06-13 12:52:57 +02:00

hid-roccat-common.c

HID: roccat: generalize some common code

2013-10-30 14:17:31 +01:00

hid-roccat-common.h

HID: roccat: generalize some common code

2013-10-30 14:17:31 +01:00

hid-roccat-isku.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

2013-09-06 09:30:36 -07:00

hid-roccat-isku.h

HID: roccat: add support for IskuFX

2013-03-14 11:50:49 +01:00

hid-roccat-kone.c

HID: roccat: Fix code style issues

2014-10-29 14:56:30 +01:00

hid-roccat-kone.h

HID: roccat: added media key support for Kone

2013-04-08 10:33:13 +02:00

hid-roccat-koneplus.c

HID: roccat: Fix "cannot create duplicate filename" problems

2013-09-30 10:51:31 +02:00

hid-roccat-koneplus.h

HID: roccat: fix wrong attr size for koneplus tcu

2012-11-18 22:58:28 +01:00

hid-roccat-konepure.c

HID: roccat: generalize some common code

2013-10-30 14:17:31 +01:00

hid-roccat-kovaplus.c

HID: roccat: fix Coverity CID 141438

2013-11-04 10:55:20 +01:00

hid-roccat-kovaplus.h

HID: roccat: deprecate some Kovaplus attributes

2012-11-12 15:30:29 +01:00

hid-roccat-lua.c

HID: roccat: Drop cast

2014-06-27 00:33:44 +02:00

hid-roccat-lua.h

HID: roccat: add support for Roccat Lua

2012-10-17 10:44:47 +02:00

hid-roccat-pyra.c

HID: roccat: potential out of bounds in pyra_sysfs_write_settings()

2015-01-09 14:41:01 +01:00

hid-roccat-pyra.h

HID: roccat: deprecated some Pyra attributes

2012-11-12 15:30:28 +01:00

hid-roccat-ryos.c

HID: roccat: add support for Ryos MK keyboards

2013-10-30 14:17:31 +01:00

hid-roccat-savu.c

HID: roccat: generalize some common code

2013-10-30 14:17:31 +01:00

hid-roccat-savu.h

HID: roccat: generalize some common code

2013-10-30 14:17:31 +01:00

hid-roccat.c

HID: roccat: check cdev_add return value

2013-06-18 11:00:36 +02:00

hid-saitek.c

HID: saitek: mode button quirk for Mad Catz R.A.T.5

2015-09-04 14:44:44 +02:00

hid-samsung.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-sensor-custom.c

HID: sensor: Custom and Generic sensor support

2015-04-10 22:22:55 +02:00

hid-sensor-hub.c

Merge branches 'for-4.3/upstream-fixes', 'for-4.4/corsair', 'for-4.4/dragonrise', 'for-4.4/i2c-hid', 'for-4.4/logitech', 'for-4.4/microsoft', 'for-4.4/multitouch', 'for-4.4/roccat-sysfs-deprecation', 'for-4.4/upstream' and 'for-4.4/wacom' into for-linus

2015-11-06 21:45:15 +01:00

hid-sjoy.c

HID: sjoy: support Super Joy Box 4

2015-05-07 10:47:53 +02:00

hid-sony.c

HID: sony: do not bail out when the sixaxis refuses the output report

2016-08-16 09:30:48 +02:00

hid-speedlink.c

HID: Fix Speedlink VAD Cezanne support for some devices

2013-08-26 13:51:10 +02:00

hid-steelseries.c

HID: remove 2 unused usb.h includes

2015-02-27 00:36:23 +01:00

hid-sunplus.c

HID: fix a couple of off-by-ones

2014-08-21 10:43:28 -05:00

hid-thingm.c

Merge branches 'for-3.18/always-poll-quirk', 'for-3.18/logitech', 'for-3.18/picolcd', 'for-3.18/rmi', 'for-3.18/sony', 'for-3.18/uhid', 'for-3.18/upstream' and 'for-3.18/wacom' into for-linus

2014-10-06 23:34:40 +02:00

hid-tivo.c

HID: tivo: enable all buttons on the TiVo Slide Pro remote

2015-03-15 10:04:27 -04:00

hid-tmff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-topseed.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-twinhan.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-uclogic.c

HID: hid-input: allow input_configured callback return errors

2015-11-05 09:51:50 -08:00

hid-waltop.c

HID: Use module_hid_driver macro

2013-01-03 10:27:31 +01:00

hid-wiimote-core.c

HID: wiimote: replace hid_output_raw_report with hid_hw_output_report for output requests

2014-02-17 14:57:17 +01:00

hid-wiimote-debug.c

HID: wiimote: fix DRM debug-attr to correctly parse input

2013-06-03 11:07:06 +02:00

hid-wiimote-modules.c

power_supply: Change ownership from driver to core

2015-03-13 23:15:51 +01:00

hid-wiimote.h

power_supply: Change ownership from driver to core

2015-03-13 23:15:51 +01:00

hid-xinmo.c

HID: xinmo: fix for out of range for THT 2P arcade controller.

2017-12-25 14:22:12 +01:00

hid-zpff.c

HID: zeroplus: validate output report details

2013-09-13 15:11:34 +02:00

hid-zydacron.c

HID: trivial devm conversion for special hid drivers

2013-07-31 10:12:28 +02:00

hidraw.c

HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device

2018-04-24 09:32:10 +02:00

Kconfig

HID: chicony: Add support for another ASUS Zen AiO keyboard

2017-12-16 10:33:52 +01:00

Makefile

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

2015-11-07 12:49:27 -08:00

uhid.c

HID: uhid: fix timeout when probe races with IO

2016-08-20 18:09:19 +02:00

wacom_sys.c

HID: wacom: Call 'wacom_query_tablet_data' only after 'hid_hw_start'

2015-11-05 11:31:55 +01:00

wacom_wac.c

HID: wacom: Have wacom_tpc_irq guard against possible NULL dereference

2017-06-07 12:06:00 +02:00

wacom_wac.h

Merge branches 'for-4.3/upstream-fixes', 'for-4.4/corsair', 'for-4.4/dragonrise', 'for-4.4/i2c-hid', 'for-4.4/logitech', 'for-4.4/microsoft', 'for-4.4/multitouch', 'for-4.4/roccat-sysfs-deprecation', 'for-4.4/upstream' and 'for-4.4/wacom' into for-linus

2015-11-06 21:45:15 +01:00

wacom.h

HID: wacom: Add support for Express Key Remote.

2015-08-28 20:43:20 +02:00