Before trying to use CDC union descriptor, try to validate whether that it
is sane by checking that intf->altsetting->extra is big enough and that
descriptor bLength is not too big and not too small.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
attribute_groups are not supposed to change at runtime. All functions
working with attribute_groups provided by <linux/sysfs.h> work with const
attribute_group. So mark the non-const structs as const.
File size before:
text data bss dec hex filename
13547 1600 0 15147 3b2b drivers/input/misc/ims-pcu.o
File size After adding 'const':
text data bss dec hex filename
13675 1472 0 15147 3b2b drivers/input/misc/ims-pcu.o
Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack control-interface endpoints.
Fixes: 628329d524 ("Input: add IMS Passenger Control Unit driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Cc: stable@vger.kernel.org # 3.10
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
A malicious device missing interface can make the driver oops.
Add sanity checking.
Signed-off-by: Oliver Neukum <ONeukum@suse.com>
CC: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Let's initialize atomic_t variables keeping track of number of various
devices created so far with -1 in order to avoid extra subtraction
operation.
Signed-off-by: Aniroop Mathur <aniroop.mathur@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Coverity pointed out that at return point error is always 0 so the
conditional is not needed.
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
In case allocation via usb_alloc_coherent() fails in ims_pcu_buffers_alloc(),
the function jumps to the exit path without initializing local variable
'error' that is used as return value. Detected by Coverity - CID 1016531.
Signed-off-by: Christian Engelmayer <cengelma@gmx.at>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
New version of the PCU firmware supports two new commands:
- IMS_PCU_CMD_OFN_SET_CONFIG which allows to write data to the
registers of one finger navigation(OFN) chip present on the device
- IMS_PCU_CMD_OFN_GET_CONFIG which allows to read data form the
registers of said chip.
This commit adds two helper functions to use those commands and sysfs
attributes to use them. It also exposes some OFN configuration
parameters via sysfs.
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
We first create backlight and then input devices so we should destroy them
in opposite order when handling errors.
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The PCU is a device installed in the armrest of a plane seat and
is connected to IMS Rave Entertainment System. It has a set of control
buttons (Volume Up/Down, Attendant, Lights, etc) on one side and
gamepad-like controls on the other side.
Originally the device was handled from userspace and because of that
it presents itself on USB bus as a CDC-ACM modem device that however
can not make calls. However the custom handling is not as convenient
as using standard input subsystem facilities. If it was pure input
device it would be possible to continue using userspace solution
(moving it over to uinput), but the device also has backlighted keys
which can not be supported via uinput.
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
