HID: thrustmaster: fix memory leak in thrustmaster_interrupts()

In thrustmaster_interrupts(), the allocated send_buf is not
freed if the usb_check_int_endpoints() check fails, leading
to a memory le

HID: thrustmaster: fix memory leak in thrustmaster_interrupts()

In thrustmaster_interrupts(), the allocated send_buf is not
freed if the usb_check_int_endpoints() check fails, leading
to a memory leak.

Fix this by ensuring send_buf is freed before returning in
the error path.

Fixes: 50420d7c79c3 ("HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check")
Signed-off-by: Qasim Ijaz <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

show more ...

HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints()

Syzbot[1] has detected a stack-out-of-bounds read of the ep_addr array from
hid-thrustmaster driver. This array is pa

HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints()

Syzbot[1] has detected a stack-out-of-bounds read of the ep_addr array from
hid-thrustmaster driver. This array is passed to usb_check_int_endpoints
function from usb.c core driver, which executes a for loop that iterates
over the elements of the passed array. Not finding a null element at the end of
the array, it tries to read the next, non-existent element, crashing the kernel.

To fix this, a 0 element was added at the end of the array to break the for
loop.

[1] https://syzkaller.appspot.com/bug?extid=9c9179ac46169c56c1ad

Reported-by: [email protected]
Fixes: 50420d7c79c3 ("HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check")
Signed-off-by: Túlio Fernandes <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

show more ...

HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check

syzbot has found a type mismatch between a USB pipe and the transfer
endpoint, which is triggered by the hid-thrustm

HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check

syzbot has found a type mismatch between a USB pipe and the transfer
endpoint, which is triggered by the hid-thrustmaster driver[1].
There is a number of similar, already fixed issues [2].
In this case as in others, implementing check for endpoint type fixes the issue.

[1] https://syzkaller.appspot.com/bug?extid=040e8b3db6a96908d470
[2] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622

Fixes: c49c33637802 ("HID: support for initialization of some Thrustmaster wheels")
Reported-by: [email protected]
Tested-by: [email protected]
Signed-off-by: Karol Przybylski <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

show more ...

HID: thrustmaster: Add sparco wheel and fix array length

Add device id for the Sparco R383 Mod wheel.

Fix wheel info array length to match actual wheel count present in the array.

Signed-off-by: M

HID: thrustmaster: Add sparco wheel and fix array length

Add device id for the Sparco R383 Mod wheel.

Fix wheel info array length to match actual wheel count present in the array.

Signed-off-by: Michael Hübner <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

show more ...

HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts

Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe() bug.
The root case is in missing validation check of actual number o

HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts

Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe() bug.
The root case is in missing validation check of actual number of endpoints.

Code should not blindly access usb_host_interface::endpoint array, since
it may contain less endpoints than code expects.

Fix it by adding missing validaion check and print an error if
number of endpoints do not match expected number

Fixes: c49c33637802 ("HID: support for initialization of some Thrustmaster wheels")
Reported-and-tested-by: [email protected]
Signed-off-by: Pavel Skripkin <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

show more ...

HID: Add support for open wheel and no attachment to T300

Different add ons to the wheel base report different models. Having
no wheel mounted to the base and using the open wheel attachment is
adde

HID: Add support for open wheel and no attachment to T300

Different add ons to the wheel base report different models. Having
no wheel mounted to the base and using the open wheel attachment is
added here.

Signed-off-by: Michael Hübner <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

show more ...

HID: check for valid USB device for many HID drivers

Many HID drivers assume that the HID device assigned to them is a USB
device as that was the only way HID devices used to be able to be
created i

HID: check for valid USB device for many HID drivers

Many HID drivers assume that the HID device assigned to them is a USB
device as that was the only way HID devices used to be able to be
created in Linux. However, with the additional ways that HID devices
can be created for many different bus types, that is no longer true, so
properly check that we have a USB device associated with the HID device
before allowing a driver that makes this assumption to claim it.

Cc: Jiri Kosina <[email protected]>
Cc: Benjamin Tissoires <[email protected]>
Cc: Michael Zaidman <[email protected]>
Cc: Stefan Achatz <[email protected]>
Cc: Maxime Coquelin <[email protected]>
Cc: Alexandre Torgue <[email protected]>
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Tested-by: Benjamin Tissoires <[email protected]>
[bentiss: amended for thrustmater.c hunk to apply]
Signed-off-by: Benjamin Tissoires <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

show more ...

HID: thrustmaster: fix sparse warnings

Changed 0 to NULL to fix following sparse warnings:

drivers/hid/hid-thrustmaster.c:208:43: warning: Using plain integer as NULL pointer
drivers/hid/hi

HID: thrustmaster: fix sparse warnings

Changed 0 to NULL to fix following sparse warnings:

drivers/hid/hid-thrustmaster.c:208:43: warning: Using plain integer as NULL pointer
drivers/hid/hid-thrustmaster.c:241:17: warning: Using plain integer as NULL pointer
drivers/hid/hid-thrustmaster.c:275:37: warning: Using plain integer as NULL pointer

Signed-off-by: Vihas Mak <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

show more ...

HID: thrustmaster: Fix memory leak in thrustmaster_interrupts()

thrustmaster_interrupts() does not free memory for send_buf when
usb_interrupt_msg() fails. This is fixed by the given patch.

Found b

HID: thrustmaster: Fix memory leak in thrustmaster_interrupts()

thrustmaster_interrupts() does not free memory for send_buf when
usb_interrupt_msg() fails. This is fixed by the given patch.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

show more ...

HID: thrustmaster: Fix memory leak in remove

thrustmaster_remove() does not release memory for
tm_wheel->change_request. This is fixed by the patch.

Found by Linux Driver Verification project (linu

HID: thrustmaster: Fix memory leak in remove

thrustmaster_remove() does not release memory for
tm_wheel->change_request. This is fixed by the patch.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

show more ...

HID: thrustmaster: Fix memory leaks in probe

When thrustmaster_probe() handles errors of usb_submit_urb() it does not
free allocated resources and fails. The patch fixes that.

Found by Linux Driver

HID: thrustmaster: Fix memory leaks in probe

When thrustmaster_probe() handles errors of usb_submit_urb() it does not
free allocated resources and fails. The patch fixes that.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

show more ...

HID: thrustmaster: Switch to kmemdup() when allocate change_request

Use kmemdup() helper instead of open-coding to
simplify the code when allocate change_request.

Signed-off-by: Yang Yingliang <yan

HID: thrustmaster: Switch to kmemdup() when allocate change_request

Use kmemdup() helper instead of open-coding to
simplify the code when allocate change_request.

Signed-off-by: Yang Yingliang <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

show more ...

HID: thrustmaster: fix return value check in thrustmaster_probe()

Fix the return value check which testing the wrong variable
in thrustmaster_probe().

Fixes: c49c33637802 ("HID: support for initial

HID: thrustmaster: fix return value check in thrustmaster_probe()

Fix the return value check which testing the wrong variable
in thrustmaster_probe().

Fixes: c49c33637802 ("HID: support for initialization of some Thrustmaster wheels")
Reported-by: Hulk Robot <[email protected]>
Signed-off-by: Wei Yongjun <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

show more ...

HID: hid-thrustmaster: Demote a bunch of kernel-doc abuses

Fixes the following W=1 kernel build warning(s):

drivers/hid/hid-thrustmaster.c:23: warning: Incorrect use of kernel-doc format: * These

HID: hid-thrustmaster: Demote a bunch of kernel-doc abuses

Fixes the following W=1 kernel build warning(s):

drivers/hid/hid-thrustmaster.c:23: warning: Incorrect use of kernel-doc format: * These interrupts are used to prevent a nasty crash when initializing the
drivers/hid/hid-thrustmaster.c:26: warning: cannot understand function prototype: 'const u8 setup_0[] = '
drivers/hid/hid-thrustmaster.c:49: warning: cannot understand function prototype: 'struct tm_wheel_info '
drivers/hid/hid-thrustmaster.c:62: warning: wrong kernel-doc identifier on line:
drivers/hid/hid-thrustmaster.c:84: warning: cannot understand function prototype: 'struct __packed tm_wheel_response '
drivers/hid/hid-thrustmaster.c:143: warning: wrong kernel-doc identifier on line:
drivers/hid/hid-thrustmaster.c:202: warning: Function parameter or member 'urb' not described in 'thrustmaster_model_handler'
drivers/hid/hid-thrustmaster.c:202: warning: expecting prototype for Called by the USB subsystem when the wheel responses to our request(). Prototype was for thrustmaster_model_handler() instead
drivers/hid/hid-thrustmaster.c:265: warning: wrong kernel-doc identifier on line:

Cc: Jiri Kosina <[email protected]>
Cc: Benjamin Tissoires <[email protected]>
Cc: Maxime Coquelin <[email protected]>
Cc: Alexandre Torgue <[email protected]>
Cc: Dario Pagani <[email protected]>
Cc: Kim Kuparinen <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Lee Jones <[email protected]>
Signed-off-by: Benjamin Tissoires <[email protected]>

show more ...

HID: fix memdup.cocci warnings

drivers/hid/hid-thrustmaster.c:300:27-34: WARNING opportunity for kmemdup

Use kmemdup rather than duplicating its implementation

Generated by: scripts/coccinelle/ap

HID: fix memdup.cocci warnings

drivers/hid/hid-thrustmaster.c:300:27-34: WARNING opportunity for kmemdup

Use kmemdup rather than duplicating its implementation

Generated by: scripts/coccinelle/api/memdup.cocci

Fixes: c49c33637802 ("HID: support for initialization of some Thrustmaster wheels")
CC: Dario Pagani <[email protected]>
Reported-by: kernel test robot <[email protected]>
Signed-off-by: kernel test robot <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

show more ...

HID: support for initialization of some Thrustmaster wheels

Add support for proper initialization of some Thrustmaster wheels that
appear like a "Thrustmaster FFB Wheel" (044f:b65d) to the host. Whe

HID: support for initialization of some Thrustmaster wheels

Add support for proper initialization of some Thrustmaster wheels that
appear like a "Thrustmaster FFB Wheel" (044f:b65d) to the host. When the
device is connected a special usb request is sent, this request makes the
wheel disconnect and reappear to the host as the "real wheel".
For example: a T150 will re-appear as 044f:b677 and a T300 as 044f:b66e

[[email protected]: renamed driver to hid-thrustmaster]
Link: https://github.com/scarburato/hid-tminit
Signed-off-by: Dario Pagani <[email protected]>
Co-developed-by: Kim Kuparinen <[email protected]>
Signed-off-by: Kim Kuparinen <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

show more ...