From 39198815d812ecadd2f80a082bfe503fac89ff88 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Thu, 7 Mar 2013 13:10:52 -0500 Subject: [PATCH] Fix logitech-dj HID bug from Benjamin Tissoires (rhbz 840391) --- kernel.spec | 7 ++ ...l-hid_output_raw_report-during-probe.patch | 66 +++++++++++++++++++ 2 files changed, 73 insertions(+) create mode 100644 logitech-dj-do-not-directly-call-hid_output_raw_report-during-probe.patch diff --git a/kernel.spec b/kernel.spec index c88ffab3b..fa047c3c5 100644 --- a/kernel.spec +++ b/kernel.spec @@ -741,6 +741,9 @@ Patch22265: crypto-user-fix-info-leaks-in-report-API.patch # CVE-2013-1792 rhbz 916646,919021 Patch22266: keys-fix-race-with-concurrent-install_user_keyrings.patch +#rhbz 840391 +Patch22267: logitech-dj-do-not-directly-call-hid_output_raw_report-during-probe.patch + #rhbz 812111 Patch24000: alps.patch @@ -1458,6 +1461,9 @@ ApplyPatch fix-destroy_conntrack-GPF.patch # CVE-2013-1792 rhbz 916646,919021 ApplyPatch keys-fix-race-with-concurrent-install_user_keyrings.patch +#rhbz 840391 +ApplyPatch logitech-dj-do-not-directly-call-hid_output_raw_report-during-probe.patch + # END OF PATCH APPLICATIONS %endif @@ -2315,6 +2321,7 @@ fi # '-' %changelog * Thu Mar 07 2013 Josh Boyer +- Fix logitech-dj HID bug from Benjamin Tissoires (rhbz 840391) - CVE-2013-1792 keys: race condition in install_user_keyrings (rhbz 916646 919021) * Wed Mar 06 2013 Justin M. Forbes diff --git a/logitech-dj-do-not-directly-call-hid_output_raw_report-during-probe.patch b/logitech-dj-do-not-directly-call-hid_output_raw_report-during-probe.patch new file mode 100644 index 000000000..68a524a94 --- /dev/null +++ b/logitech-dj-do-not-directly-call-hid_output_raw_report-during-probe.patch @@ -0,0 +1,66 @@ +From dcd9006b1b053c7b1cebe81333261d4fd492ffeb Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Tue, 05 Mar 2013 16:09:00 +0000 +Subject: HID: logitech-dj: do not directly call hid_output_raw_report() during probe + +hid_output_raw_report() makes a direct call to usb_control_msg(). However, +some USB3 boards have shown that the usb device is not ready during the +.probe(). This blocks the entire usb device, and the paired mice, keyboards +are not functional. The dmesg output is the following: + +[ 11.912287] logitech-djreceiver 0003:046D:C52B.0003: hiddev0,hidraw0: USB HID v1.11 Device [Logitech USB Receiver] on usb-0000:00:14.0-2/input2 +[ 11.912537] logitech-djreceiver 0003:046D:C52B.0003: logi_dj_probe:logi_dj_recv_query_paired_devices error:-32 +[ 11.912636] logitech-djreceiver: probe of 0003:046D:C52B.0003 failed with error -32 + +Relying on the scheduled call to usbhid_submit_report() fixes the problem. + +related bugs: +https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1072082 +https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1039143 +https://bugzilla.redhat.com/show_bug.cgi?id=840391 +https://bugzilla.kernel.org/show_bug.cgi?id=49781 + +Reported-and-tested-by: Bob Bowles +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +--- +diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c +index 9500f2f..8758f38c 100644 +--- a/drivers/hid/hid-logitech-dj.c ++++ b/drivers/hid/hid-logitech-dj.c +@@ -459,19 +459,25 @@ static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev, + struct dj_report *dj_report) + { + struct hid_device *hdev = djrcv_dev->hdev; +- int sent_bytes; ++ struct hid_report *report; ++ struct hid_report_enum *output_report_enum; ++ u8 *data = (u8 *)(&dj_report->device_index); ++ int i; + +- if (!hdev->hid_output_raw_report) { +- dev_err(&hdev->dev, "%s:" +- "hid_output_raw_report is null\n", __func__); ++ output_report_enum = &hdev->report_enum[HID_OUTPUT_REPORT]; ++ report = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT]; ++ ++ if (!report) { ++ dev_err(&hdev->dev, "%s: unable to find dj report\n", __func__); + return -ENODEV; + } + +- sent_bytes = hdev->hid_output_raw_report(hdev, (u8 *) dj_report, +- sizeof(struct dj_report), +- HID_OUTPUT_REPORT); ++ for (i = 0; i < report->field[0]->report_count; i++) ++ report->field[0]->value[i] = data[i]; ++ ++ usbhid_submit_report(hdev, report, USB_DIR_OUT); + +- return (sent_bytes < 0) ? sent_bytes : 0; ++ return 0; + } + + static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev) +-- +cgit v0.9.1