From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5700C433E1 for ; Mon, 17 Aug 2020 15:20:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BC245207DE for ; Mon, 17 Aug 2020 15:20:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597677644; bh=Wjh1zmTtqnm8XeYUSPfbp2YVMtHTpJQyH8Z6DM5I+dg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=aY54d8tZFe38VBF5PshqDxwotZ2UTEjO0QQOkSQFaqNZjK7TD5e1Vdgu3VNVVqq9D M/BK2hBCNvhRyPe5PZwebeiv5YnTQ3gwD7FcJFsQtn0Rf4+4VAlKfNJ47fCcP5IhHt ruP/Nx2+ecSk1LemH/WALLFKeX1/BtWKS2fvYC94= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729280AbgHQPUZ (ORCPT ); Mon, 17 Aug 2020 11:20:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:40534 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729207AbgHQPTB (ORCPT ); Mon, 17 Aug 2020 11:19:01 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 6D8002065C; Mon, 17 Aug 2020 15:19:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597677540; bh=Wjh1zmTtqnm8XeYUSPfbp2YVMtHTpJQyH8Z6DM5I+dg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GJ6KPeBLi93Ykfls0G+eyvFlPYxwD1TFddLmLUaQsjMyCQwMngjz6awTAe95d7HRC xc1+HvIRTPeEWQC8ncbiA4WsYT85Kzy6QpATubE+B5clvqPn5Or25UN16OJ+hmM7qI EcgcKhOh16IlgFwhVT7PUuzCLcOORc2VXknW/5Og= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Grant Likely , Darren Hart , Jiri Kosina , Benjamin Tissoires , Darren Hart , Jiri Kosina Subject: [PATCH 5.8 004/464] HID: input: Fix devices that return multiple bytes in battery report Date: Mon, 17 Aug 2020 17:09:17 +0200 Message-Id: <20200817143833.954014117@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200817143833.737102804@linuxfoundation.org> References: <20200817143833.737102804@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Grant Likely commit 4f57cace81438cc873a96f9f13f08298815c9b51 upstream. Some devices, particularly the 3DConnexion Spacemouse wireless 3D controllers, return more than just the battery capacity in the battery report. The Spacemouse devices return an additional byte with a device specific field. However, hidinput_query_battery_capacity() only requests a 2 byte transfer. When a spacemouse is connected via USB (direct wire, no wireless dongle) and it returns a 3 byte report instead of the assumed 2 byte battery report the larger transfer confuses and frightens the USB subsystem which chooses to ignore the transfer. Then after 2 seconds assume the device has stopped responding and reset it. This can be reproduced easily by using a wired connection with a wireless spacemouse. The Spacemouse will enter a loop of resetting every 2 seconds which can be observed in dmesg. This patch solves the problem by increasing the transfer request to 4 bytes instead of 2. The fix isn't particularly elegant, but it is simple and safe to backport to stable kernels. A further patch will follow to more elegantly handle battery reports that contain additional data. Signed-off-by: Grant Likely Cc: Darren Hart Cc: Jiri Kosina Cc: Benjamin Tissoires Cc: stable@vger.kernel.org Tested-by: Darren Hart Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman --- drivers/hid/hid-input.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/hid/hid-input.c +++ b/drivers/hid/hid-input.c @@ -350,13 +350,13 @@ static int hidinput_query_battery_capaci u8 *buf; int ret; - buf = kmalloc(2, GFP_KERNEL); + buf = kmalloc(4, GFP_KERNEL); if (!buf) return -ENOMEM; - ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 2, + ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 4, dev->battery_report_type, HID_REQ_GET_REPORT); - if (ret != 2) { + if (ret < 2) { kfree(buf); return -ENODATA; }