HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them

In commit 2ff5baa9b527 ("HID: appleir: Fix potential NULL dereference at
raw event handle"), we handle the fact that raw event callbacks
can happen even for a HID device that has not been "claimed" causing a
crash if a broken device were attempted to be connected to the system.

Fix up the remaining in-tree HID drivers that forgot to add this same
check to resolve the same issue.

Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <bentiss@kernel.org>
Cc: Bastien Nocera <hadess@hadess.net>
Cc: linux-input@vger.kernel.org
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

diff --git a/drivers/hid/hid-cmedia.c b/drivers/hid/hid-cmedia.c
index 528d7f361215769f9db989831009ba945eacfb67..8bf5649b0c793e0111c77d85f887520c042d14d6 100644 (file)
--- a/drivers/hid/hid-cmedia.c
+++ b/drivers/hid/hid-cmedia.c
@@ -99,7 +99,7 @@ static int cmhid_raw_event(struct hid_device *hid, struct hid_report *report,
 {
        struct cmhid *cm = hid_get_drvdata(hid);
 
-       if (len != CM6533_JD_RAWEV_LEN)
+       if (len != CM6533_JD_RAWEV_LEN || !(hid->claimed & HID_CLAIMED_INPUT))
                goto out;
        if (memcmp(data+CM6533_JD_SFX_OFFSET, ji_sfx, sizeof(ji_sfx)))
                goto out;

diff --git a/drivers/hid/hid-creative-sb0540.c b/drivers/hid/hid-creative-sb0540.c
index b4c8e7a5d3e0251803e674034b975c323d4af210..dfd6add353d19a00175a846481670adf170c8f60 100644 (file)
--- a/drivers/hid/hid-creative-sb0540.c
+++ b/drivers/hid/hid-creative-sb0540.c
@@ -153,7 +153,7 @@ static int creative_sb0540_raw_event(struct hid_device *hid,
        u64 code, main_code;
        int key;
 
-       if (len != 6)
+       if (len != 6 || !(hid->claimed & HID_CLAIMED_INPUT))
                return 0;
 
        /* From daemons/hw_hiddev.c sb0540_rec() in lirc */

diff --git a/drivers/hid/hid-zydacron.c b/drivers/hid/hid-zydacron.c
index 3bdb26f4559257efb2144d44d7cb4351088cbc67..1aae80f848f503ba1d0bf18265a14090100dc768 100644 (file)
--- a/drivers/hid/hid-zydacron.c
+++ b/drivers/hid/hid-zydacron.c
@@ -114,7 +114,7 @@ static int zc_raw_event(struct hid_device *hdev, struct hid_report *report,
        unsigned key;
        unsigned short index;
 
-       if (report->id == data[0]) {
+       if (report->id == data[0] && (hdev->claimed & HID_CLAIMED_INPUT)) {
 
                /* break keys */
                for (index = 0; index < 4; index++) {