Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e6d64ce0 authored by Jiri Kosina's avatar Jiri Kosina
Browse files

Merge branch 'for-5.3/upstream-fixes' into for-linus 



- syzbot memory corruption fixes for hidraw, Prodikeys, Logitech and Sony
  drivers from Alan Stern and Roderick Colenbrander
- error handling fix for Logitech unifying receivers from Hans de Goede

Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parents fcf887e7 98375b86

drivers/hid/hid-lg.c

+6 −4
Original line number Diff line number Diff line
@@ -818,7 +818,7 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id) 


		if (!buf) {

			ret = -ENOMEM;

			goto err_free;

			goto err_stop;

		}



		ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(cbuf),
@@ -850,9 +850,12 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id) 
		ret = lg4ff_init(hdev);



	if (ret)

		goto err_free;

		goto err_stop;



	return 0;



err_stop:

	hid_hw_stop(hdev);

err_free:

	kfree(drv_data);

	return ret;
@@ -863,7 +866,6 @@ static void lg_remove(struct hid_device *hdev) 
	struct lg_drv_data *drv_data = hid_get_drvdata(hdev);

	if (drv_data->quirks & LG_FF4)

		lg4ff_deinit(hdev);

	else

	hid_hw_stop(hdev);

	kfree(drv_data);

}

drivers/hid/hid-lg4ff.c

+0 −1
Original line number Diff line number Diff line
@@ -1477,7 +1477,6 @@ int lg4ff_deinit(struct hid_device *hid) 
		}

	}

#endif

	hid_hw_stop(hid);

	drv_data->device_props = NULL;



	kfree(entry);

drivers/hid/hid-logitech-dj.c

+5 −5
Original line number Diff line number Diff line
@@ -1734,14 +1734,14 @@ static int logi_dj_probe(struct hid_device *hdev, 
		if (retval < 0) {

			hid_err(hdev, "%s: logi_dj_recv_query_paired_devices error:%d\n",

				__func__, retval);

			goto logi_dj_recv_query_paired_devices_failed;

			/*

			 * This can happen with a KVM, let the probe succeed,

			 * logi_dj_recv_queue_unknown_work will retry later.

			 */

		}

	}



	return retval;



logi_dj_recv_query_paired_devices_failed:

	hid_hw_close(hdev);

	return 0;



llopen_failed:

switch_to_dj_mode_fail:

drivers/hid/hid-prodikeys.c

+10 −2
Original line number Diff line number Diff line
@@ -551,10 +551,14 @@ static void pcmidi_setup_extra_keys( 


static int pcmidi_set_operational(struct pcmidi_snd *pm)

{

	int rc;



	if (pm->ifnum != 1)

		return 0; /* only set up ONCE for interace 1 */



	pcmidi_get_output_report(pm);

	rc = pcmidi_get_output_report(pm);

	if (rc < 0)

		return rc;

	pcmidi_submit_output_report(pm, 0xc1);

	return 0;

}
@@ -683,7 +687,11 @@ static int pcmidi_snd_initialise(struct pcmidi_snd *pm) 
	spin_lock_init(&pm->rawmidi_in_lock);



	init_sustain_timers(pm);

	pcmidi_set_operational(pm);

	err = pcmidi_set_operational(pm);

	if (err < 0) {

		pk_error("failed to find output report\n");

		goto fail_register;

	}



	/* register it */

	err = snd_card_register(card);

drivers/hid/hid-sony.c

+1 −1
Original line number Diff line number Diff line
@@ -2811,7 +2811,6 @@ static int sony_input_configured(struct hid_device *hdev, 
	sony_cancel_work_sync(sc);

	sony_remove_dev_list(sc);

	sony_release_device_id(sc);

	hid_hw_stop(hdev);

	return ret;

}
@@ -2876,6 +2875,7 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id) 
	 */

	if (!(hdev->claimed & HID_CLAIMED_INPUT)) {

		hid_err(hdev, "failed to claim input\n");

		hid_hw_stop(hdev);

		return -ENODEV;

	}