]> git.proxmox.com Git - mirror_ubuntu-kernels.git/blob - drivers/hid/hid-betopff.c
HID: betop: fix slab-out-of-bounds Write in betop_probe
[mirror_ubuntu-kernels.git] / drivers / hid / hid-betopff.c
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Force feedback support for Betop based devices
4 *
5 * The devices are distributed under various names and the same USB device ID
6 * can be used in both adapters and actual game controllers.
7 *
8 * 0x11c2:0x2208 "BTP2185 BFM mode Joystick"
9 * - tested with BTP2185 BFM Mode.
10 *
11 * 0x11C0:0x5506 "BTP2185 PC mode Joystick"
12 * - tested with BTP2185 PC Mode.
13 *
14 * 0x8380:0x1850 "BTP2185 V2 PC mode USB Gamepad"
15 * - tested with BTP2185 PC Mode with another version.
16 *
17 * 0x20bc:0x5500 "BTP2185 V2 BFM mode Joystick"
18 * - tested with BTP2171s.
19 * Copyright (c) 2014 Huang Bo <huangbobupt@163.com>
20 */
21
22 /*
23 */
24
25
26 #include <linux/input.h>
27 #include <linux/slab.h>
28 #include <linux/module.h>
29 #include <linux/hid.h>
30
31 #include "hid-ids.h"
32
33 struct betopff_device {
34 struct hid_report *report;
35 };
36
37 static int hid_betopff_play(struct input_dev *dev, void *data,
38 struct ff_effect *effect)
39 {
40 struct hid_device *hid = input_get_drvdata(dev);
41 struct betopff_device *betopff = data;
42 __u16 left, right;
43
44 left = effect->u.rumble.strong_magnitude;
45 right = effect->u.rumble.weak_magnitude;
46
47 betopff->report->field[2]->value[0] = left / 256;
48 betopff->report->field[3]->value[0] = right / 256;
49
50 hid_hw_request(hid, betopff->report, HID_REQ_SET_REPORT);
51
52 return 0;
53 }
54
55 static int betopff_init(struct hid_device *hid)
56 {
57 struct betopff_device *betopff;
58 struct hid_report *report;
59 struct hid_input *hidinput;
60 struct list_head *report_list =
61 &hid->report_enum[HID_OUTPUT_REPORT].report_list;
62 struct input_dev *dev;
63 int field_count = 0;
64 int error;
65 int i, j;
66
67 if (list_empty(&hid->inputs)) {
68 hid_err(hid, "no inputs found\n");
69 return -ENODEV;
70 }
71
72 hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
73 dev = hidinput->input;
74
75 if (list_empty(report_list)) {
76 hid_err(hid, "no output reports found\n");
77 return -ENODEV;
78 }
79
80 report = list_first_entry(report_list, struct hid_report, list);
81 /*
82 * Actually there are 4 fields for 4 Bytes as below:
83 * -----------------------------------------
84 * Byte0 Byte1 Byte2 Byte3
85 * 0x00 0x00 left_motor right_motor
86 * -----------------------------------------
87 * Do init them with default value.
88 */
89 for (i = 0; i < report->maxfield; i++) {
90 for (j = 0; j < report->field[i]->report_count; j++) {
91 report->field[i]->value[j] = 0x00;
92 field_count++;
93 }
94 }
95
96 if (field_count < 4) {
97 hid_err(hid, "not enough fields in the report: %d\n",
98 field_count);
99 return -ENODEV;
100 }
101
102 betopff = kzalloc(sizeof(*betopff), GFP_KERNEL);
103 if (!betopff)
104 return -ENOMEM;
105
106 set_bit(FF_RUMBLE, dev->ffbit);
107
108 error = input_ff_create_memless(dev, betopff, hid_betopff_play);
109 if (error) {
110 kfree(betopff);
111 return error;
112 }
113
114 betopff->report = report;
115 hid_hw_request(hid, betopff->report, HID_REQ_SET_REPORT);
116
117 hid_info(hid, "Force feedback for betop devices by huangbo <huangbobupt@163.com>\n");
118
119 return 0;
120 }
121
122 static int betop_probe(struct hid_device *hdev, const struct hid_device_id *id)
123 {
124 int ret;
125
126 if (id->driver_data)
127 hdev->quirks |= HID_QUIRK_MULTI_INPUT;
128
129 ret = hid_parse(hdev);
130 if (ret) {
131 hid_err(hdev, "parse failed\n");
132 goto err;
133 }
134
135 ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT & ~HID_CONNECT_FF);
136 if (ret) {
137 hid_err(hdev, "hw start failed\n");
138 goto err;
139 }
140
141 betopff_init(hdev);
142
143 return 0;
144 err:
145 return ret;
146 }
147
148 static const struct hid_device_id betop_devices[] = {
149 { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185BFM, 0x2208) },
150 { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185PC, 0x5506) },
151 { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185V2PC, 0x1850) },
152 { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185V2BFM, 0x5500) },
153 { }
154 };
155 MODULE_DEVICE_TABLE(hid, betop_devices);
156
157 static struct hid_driver betop_driver = {
158 .name = "betop",
159 .id_table = betop_devices,
160 .probe = betop_probe,
161 };
162 module_hid_driver(betop_driver);
163
164 MODULE_LICENSE("GPL");