From patchwork Mon Aug 17 15:13:23 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 266402 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CE2DFC433DF for ; Mon, 17 Aug 2020 16:00:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 96B5C20748 for ; Mon, 17 Aug 2020 16:00:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597680038; bh=Wjh1zmTtqnm8XeYUSPfbp2YVMtHTpJQyH8Z6DM5I+dg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=NipaYZhE7QtMxvGGOs0Vwqsqbqfb1BcEXM0QxIzQaUEK5yqJEbwUynSsZFkEc9iPb F94ToSACKKh1x8LHPYctKwAPEVqEw5/rImFvwxfqims1eMyTMbmDgxBlDQ4zbFJjj8 TaDff2KfmB9jHCxj5PwAPy59xjualRLdWrGz96hM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731026AbgHQQAg (ORCPT ); Mon, 17 Aug 2020 12:00:36 -0400 Received: from mail.kernel.org ([198.145.29.99]:47584 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731006AbgHQQAT (ORCPT ); Mon, 17 Aug 2020 12:00:19 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C80F7207FF; Mon, 17 Aug 2020 16:00:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597680014; bh=Wjh1zmTtqnm8XeYUSPfbp2YVMtHTpJQyH8Z6DM5I+dg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=e3zHDeF7LpI/4ytlBR4w4eNAmIHuZzlKDQknjc+MFxZCaiCXwNL6xeCtE8HHhTukf vjztRLcGFMGoQ/rZcdqvLYV6pFvIMfn4Yt4oLRCFIMkvZXlWg86qb3dmCG64WAiztj 0dM3WJvobYgAqxccMTeMg6Sreks+cTMcKcajDIzs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Grant Likely , Darren Hart , Jiri Kosina , Benjamin Tissoires , Darren Hart , Jiri Kosina Subject: [PATCH 5.4 002/270] HID: input: Fix devices that return multiple bytes in battery report Date: Mon, 17 Aug 2020 17:13:23 +0200 Message-Id: <20200817143755.932777623@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200817143755.807583758@linuxfoundation.org> References: <20200817143755.807583758@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Grant Likely commit 4f57cace81438cc873a96f9f13f08298815c9b51 upstream. Some devices, particularly the 3DConnexion Spacemouse wireless 3D controllers, return more than just the battery capacity in the battery report. The Spacemouse devices return an additional byte with a device specific field. However, hidinput_query_battery_capacity() only requests a 2 byte transfer. When a spacemouse is connected via USB (direct wire, no wireless dongle) and it returns a 3 byte report instead of the assumed 2 byte battery report the larger transfer confuses and frightens the USB subsystem which chooses to ignore the transfer. Then after 2 seconds assume the device has stopped responding and reset it. This can be reproduced easily by using a wired connection with a wireless spacemouse. The Spacemouse will enter a loop of resetting every 2 seconds which can be observed in dmesg. This patch solves the problem by increasing the transfer request to 4 bytes instead of 2. The fix isn't particularly elegant, but it is simple and safe to backport to stable kernels. A further patch will follow to more elegantly handle battery reports that contain additional data. Signed-off-by: Grant Likely Cc: Darren Hart Cc: Jiri Kosina Cc: Benjamin Tissoires Cc: stable@vger.kernel.org Tested-by: Darren Hart Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman --- drivers/hid/hid-input.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/hid/hid-input.c +++ b/drivers/hid/hid-input.c @@ -350,13 +350,13 @@ static int hidinput_query_battery_capaci u8 *buf; int ret; - buf = kmalloc(2, GFP_KERNEL); + buf = kmalloc(4, GFP_KERNEL); if (!buf) return -ENOMEM; - ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 2, + ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 4, dev->battery_report_type, HID_REQ_GET_REPORT); - if (ret != 2) { + if (ret < 2) { kfree(buf); return -ENODATA; }