diff --git a/HID-kye-Add-report-fixup-for-Genius-Gila-Gaming-mouse.patch b/HID-kye-Add-report-fixup-for-Genius-Gila-Gaming-mouse.patch new file mode 100644 index 0000000..6913eb5 --- /dev/null +++ b/HID-kye-Add-report-fixup-for-Genius-Gila-Gaming-mouse.patch @@ -0,0 +1,98 @@ +From 3685c18e17f12438d0a83331c1b6a5b00fade7a1 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Tue, 02 Jul 2013 16:10:09 +0000 +Subject: HID: kye: Add report fixup for Genius Gila Gaming mouse + +Genius Gila Gaming Mouse presents an obviously wrong report descriptor. +the Consumer control (report ID 3) is the following: +0x05, 0x0c, // Usage Page (Consumer Devices) 105 +0x09, 0x01, // Usage (Consumer Control) 107 +0xa1, 0x01, // Collection (Application) 109 +0x85, 0x03, // Report ID (3) 111 +0x19, 0x00, // Usage Minimum (0) 113 +0x2a, 0xff, 0x7f, // Usage Maximum (32767) 115 +0x15, 0x00, // Logical Minimum (0) 118 +0x26, 0xff, 0x7f, // Logical Maximum (32767) 120 +0x75, 0x10, // Report Size (16) 123 +0x95, 0x03, // Report Count (3) 125 +0x81, 0x00, // Input (Data,Arr,Abs) 127 +0x75, 0x08, // Report Size (8) 129 +0x95, 0x01, // Report Count (1) 131 +0x81, 0x01, // Input (Cnst,Arr,Abs) 133 +0xc0, // End Collection 135 + +So the first input whithin this report has a count of 3 but a usage range +of 32768. So this value is obviously wrong as it should not be greater than +the report count. + +Fixes: +https://bugzilla.redhat.com/show_bug.cgi?id=959721 + +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +--- +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 8f616bd..27aa7c7 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1589,6 +1589,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) }, + { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) }, + { HID_USB_DEVICE(USB_VENDOR_ID_KEYTOUCH, USB_DEVICE_ID_KEYTOUCH_IEC) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) }, + { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) }, + { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_I405X) }, + { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X) }, +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 3da75dd..b2b692e 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -474,6 +474,7 @@ + + #define USB_VENDOR_ID_KYE 0x0458 + #define USB_DEVICE_ID_KYE_ERGO_525V 0x0087 ++#define USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE 0x0138 + #define USB_DEVICE_ID_KYE_GPEN_560 0x5003 + #define USB_DEVICE_ID_KYE_EASYPEN_I405X 0x5010 + #define USB_DEVICE_ID_KYE_MOUSEPEN_I608X 0x5011 +diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c +index 6af90db..1e2ee2aa 100644 +--- a/drivers/hid/hid-kye.c ++++ b/drivers/hid/hid-kye.c +@@ -314,6 +314,25 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc, + *rsize = sizeof(easypen_m610x_rdesc_fixed); + } + break; ++ case USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE: ++ /* ++ * the fixup that need to be done: ++ * - change Usage Maximum in the Comsumer Control ++ * (report ID 3) to a reasonable value ++ */ ++ if (*rsize >= 135 && ++ /* Usage Page (Consumer Devices) */ ++ rdesc[104] == 0x05 && rdesc[105] == 0x0c && ++ /* Usage (Consumer Control) */ ++ rdesc[106] == 0x09 && rdesc[107] == 0x01 && ++ /* Usage Maximum > 12287 */ ++ rdesc[114] == 0x2a && rdesc[116] > 0x2f) { ++ hid_info(hdev, ++ "fixing up Genius Gila Gaming Mouse " ++ "report descriptor\n"); ++ rdesc[116] = 0x2f; ++ } ++ break; + } + return rdesc; + } +@@ -407,6 +426,8 @@ static const struct hid_device_id kye_devices[] = { + USB_DEVICE_ID_KYE_MOUSEPEN_I608X) }, + { HID_USB_DEVICE(USB_VENDOR_ID_KYE, + USB_DEVICE_ID_KYE_EASYPEN_M610X) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, ++ USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) }, + { } + }; + MODULE_DEVICE_TABLE(hid, kye_devices); +-- +cgit v0.9.2 diff --git a/kernel.spec b/kernel.spec index de54e8f..c90f166 100644 --- a/kernel.spec +++ b/kernel.spec @@ -786,6 +786,9 @@ Patch25060: ipv6-ip6_sk_dst_check-must-not-assume-ipv6-dst.patch #rhbz 976789 980643 Patch25062: vhost-net-fix-use-after-free-in-vhost_net_flush.patch +#rhbz 959721 +Patch25063: HID-kye-Add-report-fixup-for-Genius-Gila-Gaming-mouse.patch + # END OF PATCH DEFINITIONS %endif @@ -1525,6 +1528,9 @@ ApplyPatch ipv6-ip6_sk_dst_check-must-not-assume-ipv6-dst.patch #rhbz 976789 980643 ApplyPatch vhost-net-fix-use-after-free-in-vhost_net_flush.patch +#rhbz 959721 +ApplyPatch HID-kye-Add-report-fixup-for-Genius-Gila-Gaming-mouse.patch + # END OF PATCH APPLICATIONS %endif @@ -2377,6 +2383,7 @@ fi # '-' %changelog * Fri Jul 05 2013 Josh Boyer +- Add report fixup for Genius Gila mouse from Benjamin Tissoires (rhbz 959721) - Add vhost-net use-after-free fix (rhbz 976789 980643) - Add fix for timer issue in bridge code (rhbz 980254) - CVE-2013-2232 ipv6: using ipv4 vs ipv6 structure during routing lookup in sendmsg (rhbz 981552 981564)