From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AB9A4C433E4 for ; Mon, 17 Aug 2020 16:46:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 87AFE206FA for ; Mon, 17 Aug 2020 16:46:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597682805; bh=Wjh1zmTtqnm8XeYUSPfbp2YVMtHTpJQyH8Z6DM5I+dg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=CQs7vvDIqCHY7mE70P1ndH2gVbi8n4gftsoVO6uJddBZL+WzPQWdBsjKNlRwOWr4V deH7so8emUO9sqtWR9xQ55gVRPWGOVnkA1G5ZVaiUt3FTMY8d79s9GX8ankkHHemPs N+aca4dimPuOd0zuexkqqtj5ydT+ERTuqEGs2aAA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731172AbgHQQql (ORCPT ); Mon, 17 Aug 2020 12:46:41 -0400 Received: from mail.kernel.org ([198.145.29.99]:47584 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731006AbgHQQAT (ORCPT ); Mon, 17 Aug 2020 12:00:19 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C80F7207FF; Mon, 17 Aug 2020 16:00:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597680014; bh=Wjh1zmTtqnm8XeYUSPfbp2YVMtHTpJQyH8Z6DM5I+dg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=e3zHDeF7LpI/4ytlBR4w4eNAmIHuZzlKDQknjc+MFxZCaiCXwNL6xeCtE8HHhTukf vjztRLcGFMGoQ/rZcdqvLYV6pFvIMfn4Yt4oLRCFIMkvZXlWg86qb3dmCG64WAiztj 0dM3WJvobYgAqxccMTeMg6Sreks+cTMcKcajDIzs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Grant Likely , Darren Hart , Jiri Kosina , Benjamin Tissoires , Darren Hart , Jiri Kosina Subject: [PATCH 5.4 002/270] HID: input: Fix devices that return multiple bytes in battery report Date: Mon, 17 Aug 2020 17:13:23 +0200 Message-Id: <20200817143755.932777623@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200817143755.807583758@linuxfoundation.org> References: <20200817143755.807583758@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Grant Likely commit 4f57cace81438cc873a96f9f13f08298815c9b51 upstream. Some devices, particularly the 3DConnexion Spacemouse wireless 3D controllers, return more than just the battery capacity in the battery report. The Spacemouse devices return an additional byte with a device specific field. However, hidinput_query_battery_capacity() only requests a 2 byte transfer. When a spacemouse is connected via USB (direct wire, no wireless dongle) and it returns a 3 byte report instead of the assumed 2 byte battery report the larger transfer confuses and frightens the USB subsystem which chooses to ignore the transfer. Then after 2 seconds assume the device has stopped responding and reset it. This can be reproduced easily by using a wired connection with a wireless spacemouse. The Spacemouse will enter a loop of resetting every 2 seconds which can be observed in dmesg. This patch solves the problem by increasing the transfer request to 4 bytes instead of 2. The fix isn't particularly elegant, but it is simple and safe to backport to stable kernels. A further patch will follow to more elegantly handle battery reports that contain additional data. Signed-off-by: Grant Likely Cc: Darren Hart Cc: Jiri Kosina Cc: Benjamin Tissoires Cc: stable@vger.kernel.org Tested-by: Darren Hart Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman --- drivers/hid/hid-input.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/hid/hid-input.c +++ b/drivers/hid/hid-input.c @@ -350,13 +350,13 @@ static int hidinput_query_battery_capaci u8 *buf; int ret; - buf = kmalloc(2, GFP_KERNEL); + buf = kmalloc(4, GFP_KERNEL); if (!buf) return -ENOMEM; - ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 2, + ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 4, dev->battery_report_type, HID_REQ_GET_REPORT); - if (ret != 2) { + if (ret < 2) { kfree(buf); return -ENODATA; }