HID: betop: fix slab-out-of-bounds Write in betop_probe
[platform/kernel/linux-rpi.git] / drivers / hid / hid-betopff.c
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *  Force feedback support for Betop based devices
4  *
5  *  The devices are distributed under various names and the same USB device ID
6  *  can be used in both adapters and actual game controllers.
7  *
8  *  0x11c2:0x2208 "BTP2185 BFM mode Joystick"
9  *   - tested with BTP2185 BFM Mode.
10  *
11  *  0x11C0:0x5506 "BTP2185 PC mode Joystick"
12  *   - tested with BTP2185 PC Mode.
13  *
14  *  0x8380:0x1850 "BTP2185 V2 PC mode USB Gamepad"
15  *   - tested with BTP2185 PC Mode with another version.
16  *
17  *  0x20bc:0x5500 "BTP2185 V2 BFM mode Joystick"
18  *   - tested with BTP2171s.
19  *  Copyright (c) 2014 Huang Bo <huangbobupt@163.com>
20  */
21
22 /*
23  */
24
25
26 #include <linux/input.h>
27 #include <linux/slab.h>
28 #include <linux/module.h>
29 #include <linux/hid.h>
30
31 #include "hid-ids.h"
32
33 struct betopff_device {
34         struct hid_report *report;
35 };
36
37 static int hid_betopff_play(struct input_dev *dev, void *data,
38                          struct ff_effect *effect)
39 {
40         struct hid_device *hid = input_get_drvdata(dev);
41         struct betopff_device *betopff = data;
42         __u16 left, right;
43
44         left = effect->u.rumble.strong_magnitude;
45         right = effect->u.rumble.weak_magnitude;
46
47         betopff->report->field[2]->value[0] = left / 256;
48         betopff->report->field[3]->value[0] = right / 256;
49
50         hid_hw_request(hid, betopff->report, HID_REQ_SET_REPORT);
51
52         return 0;
53 }
54
55 static int betopff_init(struct hid_device *hid)
56 {
57         struct betopff_device *betopff;
58         struct hid_report *report;
59         struct hid_input *hidinput;
60         struct list_head *report_list =
61                         &hid->report_enum[HID_OUTPUT_REPORT].report_list;
62         struct input_dev *dev;
63         int field_count = 0;
64         int error;
65         int i, j;
66
67         if (list_empty(&hid->inputs)) {
68                 hid_err(hid, "no inputs found\n");
69                 return -ENODEV;
70         }
71
72         hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
73         dev = hidinput->input;
74
75         if (list_empty(report_list)) {
76                 hid_err(hid, "no output reports found\n");
77                 return -ENODEV;
78         }
79
80         report = list_first_entry(report_list, struct hid_report, list);
81         /*
82          * Actually there are 4 fields for 4 Bytes as below:
83          * -----------------------------------------
84          * Byte0  Byte1  Byte2    Byte3
85          * 0x00   0x00   left_motor right_motor
86          * -----------------------------------------
87          * Do init them with default value.
88          */
89         for (i = 0; i < report->maxfield; i++) {
90                 for (j = 0; j < report->field[i]->report_count; j++) {
91                         report->field[i]->value[j] = 0x00;
92                         field_count++;
93                 }
94         }
95
96         if (field_count < 4) {
97                 hid_err(hid, "not enough fields in the report: %d\n",
98                                 field_count);
99                 return -ENODEV;
100         }
101
102         betopff = kzalloc(sizeof(*betopff), GFP_KERNEL);
103         if (!betopff)
104                 return -ENOMEM;
105
106         set_bit(FF_RUMBLE, dev->ffbit);
107
108         error = input_ff_create_memless(dev, betopff, hid_betopff_play);
109         if (error) {
110                 kfree(betopff);
111                 return error;
112         }
113
114         betopff->report = report;
115         hid_hw_request(hid, betopff->report, HID_REQ_SET_REPORT);
116
117         hid_info(hid, "Force feedback for betop devices by huangbo <huangbobupt@163.com>\n");
118
119         return 0;
120 }
121
122 static int betop_probe(struct hid_device *hdev, const struct hid_device_id *id)
123 {
124         int ret;
125
126         if (id->driver_data)
127                 hdev->quirks |= HID_QUIRK_MULTI_INPUT;
128
129         ret = hid_parse(hdev);
130         if (ret) {
131                 hid_err(hdev, "parse failed\n");
132                 goto err;
133         }
134
135         ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT & ~HID_CONNECT_FF);
136         if (ret) {
137                 hid_err(hdev, "hw start failed\n");
138                 goto err;
139         }
140
141         betopff_init(hdev);
142
143         return 0;
144 err:
145         return ret;
146 }
147
148 static const struct hid_device_id betop_devices[] = {
149         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185BFM, 0x2208) },
150         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185PC, 0x5506) },
151         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185V2PC, 0x1850) },
152         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185V2BFM, 0x5500) },
153         { }
154 };
155 MODULE_DEVICE_TABLE(hid, betop_devices);
156
157 static struct hid_driver betop_driver = {
158         .name = "betop",
159         .id_table = betop_devices,
160         .probe = betop_probe,
161 };
162 module_hid_driver(betop_driver);
163
164 MODULE_LICENSE("GPL");