HID: core: Avoid uninitialized buffer access
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / hid / hid-cypress.c
1 /*
2 * HID driver for some cypress "special" devices
3 *
4 * Copyright (c) 1999 Andreas Gal
5 * Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
6 * Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
7 * Copyright (c) 2006-2007 Jiri Kosina
8 * Copyright (c) 2008 Jiri Slaby
9 */
10
11 /*
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the Free
14 * Software Foundation; either version 2 of the License, or (at your option)
15 * any later version.
16 */
17
18 #include <linux/device.h>
19 #include <linux/hid.h>
20 #include <linux/input.h>
21 #include <linux/module.h>
22
23 #include "hid-ids.h"
24
25 #define CP_RDESC_SWAPPED_MIN_MAX 0x01
26 #define CP_2WHEEL_MOUSE_HACK 0x02
27 #define CP_2WHEEL_MOUSE_HACK_ON 0x04
28
29 /*
30 * Some USB barcode readers from cypress have usage min and usage max in
31 * the wrong order
32 */
33 static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
34 unsigned int *rsize)
35 {
36 unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
37 unsigned int i;
38
39 if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX))
40 return rdesc;
41
42 for (i = 0; i < *rsize - 4; i++)
43 if (rdesc[i] == 0x29 && rdesc[i + 2] == 0x19) {
44 __u8 tmp;
45
46 rdesc[i] = 0x19;
47 rdesc[i + 2] = 0x29;
48 tmp = rdesc[i + 3];
49 rdesc[i + 3] = rdesc[i + 1];
50 rdesc[i + 1] = tmp;
51 }
52 return rdesc;
53 }
54
55 static int cp_input_mapped(struct hid_device *hdev, struct hid_input *hi,
56 struct hid_field *field, struct hid_usage *usage,
57 unsigned long **bit, int *max)
58 {
59 unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
60
61 if (!(quirks & CP_2WHEEL_MOUSE_HACK))
62 return 0;
63
64 if (usage->type == EV_REL && usage->code == REL_WHEEL)
65 set_bit(REL_HWHEEL, *bit);
66 if (usage->hid == 0x00090005)
67 return -1;
68
69 return 0;
70 }
71
72 static int cp_event(struct hid_device *hdev, struct hid_field *field,
73 struct hid_usage *usage, __s32 value)
74 {
75 unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
76
77 if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput ||
78 !usage->type || !(quirks & CP_2WHEEL_MOUSE_HACK))
79 return 0;
80
81 if (usage->hid == 0x00090005) {
82 if (value)
83 quirks |= CP_2WHEEL_MOUSE_HACK_ON;
84 else
85 quirks &= ~CP_2WHEEL_MOUSE_HACK_ON;
86 hid_set_drvdata(hdev, (void *)quirks);
87 return 1;
88 }
89
90 if (usage->code == REL_WHEEL && (quirks & CP_2WHEEL_MOUSE_HACK_ON)) {
91 struct input_dev *input = field->hidinput->input;
92
93 input_event(input, usage->type, REL_HWHEEL, value);
94 return 1;
95 }
96
97 return 0;
98 }
99
100 static int cp_probe(struct hid_device *hdev, const struct hid_device_id *id)
101 {
102 unsigned long quirks = id->driver_data;
103 int ret;
104
105 hid_set_drvdata(hdev, (void *)quirks);
106
107 ret = hid_parse(hdev);
108 if (ret) {
109 hid_err(hdev, "parse failed\n");
110 goto err_free;
111 }
112
113 ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
114 if (ret) {
115 hid_err(hdev, "hw start failed\n");
116 goto err_free;
117 }
118
119 return 0;
120 err_free:
121 return ret;
122 }
123
124 static const struct hid_device_id cp_devices[] = {
125 { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1),
126 .driver_data = CP_RDESC_SWAPPED_MIN_MAX },
127 { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_2),
128 .driver_data = CP_RDESC_SWAPPED_MIN_MAX },
129 { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_3),
130 .driver_data = CP_RDESC_SWAPPED_MIN_MAX },
131 { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_4),
132 .driver_data = CP_RDESC_SWAPPED_MIN_MAX },
133 { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE),
134 .driver_data = CP_2WHEEL_MOUSE_HACK },
135 { }
136 };
137 MODULE_DEVICE_TABLE(hid, cp_devices);
138
139 static struct hid_driver cp_driver = {
140 .name = "cypress",
141 .id_table = cp_devices,
142 .report_fixup = cp_report_fixup,
143 .input_mapped = cp_input_mapped,
144 .event = cp_event,
145 .probe = cp_probe,
146 };
147 module_hid_driver(cp_driver);
148
149 MODULE_LICENSE("GPL");