diff --git a/HID-rmi-Check-that-a-device-is-a-RMI-device-before-c.patch b/HID-rmi-Check-that-a-device-is-a-RMI-device-before-c.patch new file mode 100644 index 0000000..d6a8e6a --- /dev/null +++ b/HID-rmi-Check-that-a-device-is-a-RMI-device-before-c.patch @@ -0,0 +1,54 @@ +From ef14a4bf0910d06c7e202552914028d4956809cb Mon Sep 17 00:00:00 2001 +From: Andrew Duggan +Date: Tue, 17 Oct 2017 18:37:36 -0700 +Subject: [PATCH] HID: rmi: Check that a device is a RMI device before calling + RMI functions + +The hid-rmi driver may handle non rmi devices on composite USB devices. +Callbacks need to make sure that the current device is a RMI device before +calling RMI specific functions. Most callbacks already have this check, but +this patch adds checks to the remaining callbacks. + +Reported-by: Hendrik Langer +Tested-by: Hendrik Langer +Reviewed-by: Benjamin Tissoires +Signed-off-by: Andrew Duggan +Signed-off-by: Jiri Kosina +--- + drivers/hid/hid-rmi.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c +index ef241d66562e..0f43c4292685 100644 +--- a/drivers/hid/hid-rmi.c ++++ b/drivers/hid/hid-rmi.c +@@ -368,6 +368,11 @@ static int rmi_check_sanity(struct hid_device *hdev, u8 *data, int size) + static int rmi_raw_event(struct hid_device *hdev, + struct hid_report *report, u8 *data, int size) + { ++ struct rmi_data *hdata = hid_get_drvdata(hdev); ++ ++ if (!(hdata->device_flags & RMI_DEVICE)) ++ return 0; ++ + size = rmi_check_sanity(hdev, data, size); + if (size < 2) + return 0; +@@ -713,9 +718,11 @@ static void rmi_remove(struct hid_device *hdev) + { + struct rmi_data *hdata = hid_get_drvdata(hdev); + +- clear_bit(RMI_STARTED, &hdata->flags); +- cancel_work_sync(&hdata->reset_work); +- rmi_unregister_transport_device(&hdata->xport); ++ if (hdata->device_flags & RMI_DEVICE) { ++ clear_bit(RMI_STARTED, &hdata->flags); ++ cancel_work_sync(&hdata->reset_work); ++ rmi_unregister_transport_device(&hdata->xport); ++ } + + hid_hw_stop(hdev); + } +-- +2.14.3 + diff --git a/kernel.spec b/kernel.spec index c985f5b..5b51e73 100644 --- a/kernel.spec +++ b/kernel.spec @@ -650,6 +650,9 @@ Patch625: v3-2-2-Input-synaptics---Lenovo-X1-Carbon-5-should-use-SMBUS-RMI.patch # Fixes for QXL issues Patch627: qxl-fixes.patch +# rhbz 1462175 +Patch628: HID-rmi-Check-that-a-device-is-a-RMI-device-before-c.patch + # END OF PATCH DEFINITIONS %endif @@ -2204,6 +2207,9 @@ fi # # %changelog +* Mon Dec 11 2017 Jeremy Cline +- Re-fix USB null pointer dereference on ThinkPad X1 (rhbz 1462175) + * Mon Dec 11 2017 Jeremy Cline - 4.14.5-300 - Linux v4.14.5 - Re-enable driver for the Behringer BCD 2000