rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add report fixup for Genius Gila mouse from Benjamin Tissoires (rhbz 959721)

This commit is contained in:
Josh Boyer 2013-07-05 09:17:32 -04:00
parent 15eecb868a
commit b9f0d980bc
2 changed files with 105 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

98
HID-kye-Add-report-fixup-for-Genius-Gila-Gaming-mouse.patch Normal file
View File

@ -0,0 +1,98 @@
From 3685c18e17f12438d0a83331c1b6a5b00fade7a1 Mon Sep 17 00:00:00 2001
From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Date: Tue, 02 Jul 2013 16:10:09 +0000
Subject: HID: kye: Add report fixup for Genius Gila Gaming mouse
Genius Gila Gaming Mouse presents an obviously wrong report descriptor.
the Consumer control (report ID 3) is the following:
0x05, 0x0c, // Usage Page (Consumer Devices) 105
0x09, 0x01, // Usage (Consumer Control) 107
0xa1, 0x01, // Collection (Application) 109
0x85, 0x03, // Report ID (3) 111
0x19, 0x00, // Usage Minimum (0) 113
0x2a, 0xff, 0x7f, // Usage Maximum (32767) 115
0x15, 0x00, // Logical Minimum (0) 118
0x26, 0xff, 0x7f, // Logical Maximum (32767) 120
0x75, 0x10, // Report Size (16) 123
0x95, 0x03, // Report Count (3) 125
0x81, 0x00, // Input (Data,Arr,Abs) 127
0x75, 0x08, // Report Size (8) 129
0x95, 0x01, // Report Count (1) 131
0x81, 0x01, // Input (Cnst,Arr,Abs) 133
0xc0, // End Collection 135
So the first input whithin this report has a count of 3 but a usage range
of 32768. So this value is obviously wrong as it should not be greater than
the report count.
Fixes:
https://bugzilla.redhat.com/show_bug.cgi?id=959721
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
---
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 8f616bd..27aa7c7 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1589,6 +1589,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) },
{ HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
{ HID_USB_DEVICE(USB_VENDOR_ID_KEYTOUCH, USB_DEVICE_ID_KEYTOUCH_IEC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) },
{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_I405X) },
{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 3da75dd..b2b692e 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -474,6 +474,7 @@
#define USB_VENDOR_ID_KYE 0x0458
#define USB_DEVICE_ID_KYE_ERGO_525V 0x0087
+#define USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE 0x0138
#define USB_DEVICE_ID_KYE_GPEN_560 0x5003
#define USB_DEVICE_ID_KYE_EASYPEN_I405X 0x5010
#define USB_DEVICE_ID_KYE_MOUSEPEN_I608X 0x5011
diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
index 6af90db..1e2ee2aa 100644
--- a/drivers/hid/hid-kye.c
+++ b/drivers/hid/hid-kye.c
@@ -314,6 +314,25 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
*rsize = sizeof(easypen_m610x_rdesc_fixed);
}
break;
+ case USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE:
+ /*
+ * the fixup that need to be done:
+ * - change Usage Maximum in the Comsumer Control
+ * (report ID 3) to a reasonable value
+ */
+ if (*rsize >= 135 &&
+ /* Usage Page (Consumer Devices) */
+ rdesc[104] == 0x05 && rdesc[105] == 0x0c &&
+ /* Usage (Consumer Control) */
+ rdesc[106] == 0x09 && rdesc[107] == 0x01 &&
+ /* Usage Maximum > 12287 */
+ rdesc[114] == 0x2a && rdesc[116] > 0x2f) {
+ hid_info(hdev,
+ "fixing up Genius Gila Gaming Mouse "
+ "report descriptor\n");
+ rdesc[116] = 0x2f;
+ }
+ break;
}
return rdesc;
}
@@ -407,6 +426,8 @@ static const struct hid_device_id kye_devices[] = {
USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
{ HID_USB_DEVICE(USB_VENDOR_ID_KYE,
USB_DEVICE_ID_KYE_EASYPEN_M610X) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+ USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
{ }
};
MODULE_DEVICE_TABLE(hid, kye_devices);
--
cgit v0.9.2

7
kernel.spec
View File

@ -805,6 +805,9 @@ Patch25060: ipv6-ip6_sk_dst_check-must-not-assume-ipv6-dst.patch
#rhbz 976789 980643
Patch25062: vhost-net-fix-use-after-free-in-vhost_net_flush.patch
#rhbz 959721
Patch25063: HID-kye-Add-report-fixup-for-Genius-Gila-Gaming-mouse.patch
# END OF PATCH DEFINITIONS
%endif
@ -1547,6 +1550,9 @@ ApplyPatch ipv6-ip6_sk_dst_check-must-not-assume-ipv6-dst.patch
#rhbz 976789 980643
ApplyPatch vhost-net-fix-use-after-free-in-vhost_net_flush.patch
#rhbz 959721
ApplyPatch HID-kye-Add-report-fixup-for-Genius-Gila-Gaming-mouse.patch
# END OF PATCH APPLICATIONS
%endif
@ -2393,6 +2399,7 @@ fi
# || ||
%changelog
* Fri Jul 05 2013 Josh Boyer <jwboyer@redhat.com>
- Add report fixup for Genius Gila mouse from Benjamin Tissoires (rhbz 959721)
- Add vhost-net use-after-free fix (rhbz 976789 980643)
- Add fix for timer issue in bridge code (rhbz 980254)
- CVE-2013-2232 ipv6: using ipv4 vs ipv6 structure during routing lookup in sendmsg (rhbz 981552 981564)