Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 331415ff authored by Kees Cook's avatar Kees Cook Committed by Jiri Kosina
Browse files

HID: provide a helper for validating hid reports 



Many drivers need to validate the characteristics of their HID report
during initialization to avoid misusing the reports. This adds a common
helper to perform validation of the report exisitng, the field existing,
and the expected number of values within the field.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Reviewed-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent b04c99e3

drivers/hid/hid-core.c

+58 −0
Original line number Diff line number Diff line
@@ -801,6 +801,64 @@ int hid_parse_report(struct hid_device *hid, __u8 *start, unsigned size) 
}

EXPORT_SYMBOL_GPL(hid_parse_report);



static const char * const hid_report_names[] = {

	"HID_INPUT_REPORT",

	"HID_OUTPUT_REPORT",

	"HID_FEATURE_REPORT",

};

/**

 * hid_validate_values - validate existing device report's value indexes

 *

 * @device: hid device

 * @type: which report type to examine

 * @id: which report ID to examine (0 for first)

 * @field_index: which report field to examine

 * @report_counts: expected number of values

 *

 * Validate the number of values in a given field of a given report, after

 * parsing.

 */

struct hid_report *hid_validate_values(struct hid_device *hid,

				       unsigned int type, unsigned int id,

				       unsigned int field_index,

				       unsigned int report_counts)

{

	struct hid_report *report;



	if (type > HID_FEATURE_REPORT) {

		hid_err(hid, "invalid HID report type %u\n", type);

		return NULL;

	}



	if (id >= HID_MAX_IDS) {

		hid_err(hid, "invalid HID report id %u\n", id);

		return NULL;

	}



	/*

	 * Explicitly not using hid_get_report() here since it depends on

	 * ->numbered being checked, which may not always be the case when

	 * drivers go to access report values.

	 */

	report = hid->report_enum[type].report_id_hash[id];

	if (!report) {

		hid_err(hid, "missing %s %u\n", hid_report_names[type], id);

		return NULL;

	}

	if (report->maxfield <= field_index) {

		hid_err(hid, "not enough fields in %s %u\n",

			hid_report_names[type], id);

		return NULL;

	}

	if (report->field[field_index]->report_count < report_counts) {

		hid_err(hid, "not enough values in %s %u field %u\n",

			hid_report_names[type], id, field_index);

		return NULL;

	}

	return report;

}

EXPORT_SYMBOL_GPL(hid_validate_values);



/**

 * hid_open_report - open a driver-specific device report

 *

include/linux/hid.h

+4 −0
Original line number Diff line number Diff line
@@ -756,6 +756,10 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags); 
struct hid_device *hid_allocate_device(void);

struct hid_report *hid_register_report(struct hid_device *device, unsigned type, unsigned id);

int hid_parse_report(struct hid_device *hid, __u8 *start, unsigned size);

struct hid_report *hid_validate_values(struct hid_device *hid,

				       unsigned int type, unsigned int id,

				       unsigned int field_index,

				       unsigned int report_counts);

int hid_open_report(struct hid_device *device);

int hid_check_keys_pressed(struct hid_device *hid);

int hid_connect(struct hid_device *hid, unsigned int connect_mask);