summaryrefslogtreecommitdiff
path: root/drivers/input/misc (follow)
Commit message (Collapse)AuthorAge
* Input: uinput - avoid FF flush when destroying deviceDmitry Torokhov2021-01-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit e8b95728f724797f958912fd9b765a695595d3a6 upstream. Normally, when input device supporting force feedback effects is being destroyed, we try to "flush" currently playing effects, so that the physical device does not continue vibrating (or executing other effects). Unfortunately this does not work well for uinput as flushing of the effects deadlocks with the destroy action: - if device is being destroyed because the file descriptor is being closed, then there is noone to even service FF requests; - if device is being destroyed because userspace sent UI_DEV_DESTROY, while theoretically it could be possible to service FF requests, userspace is unlikely to do so (they'd need to make sure FF handling happens on a separate thread) even if kernel solves the issue with FF ioctls deadlocking with UI_DEV_DESTROY ioctl on udev->mutex. To avoid lockups like the one below, let's install a custom input device flush handler, and avoid trying to flush force feedback effects when we destroying the device, and instead rely on uinput to shut off the device properly. NMI watchdog: Watchdog detected hard LOCKUP on cpu 3 ... <<EOE>> [<ffffffff817a0307>] _raw_spin_lock_irqsave+0x37/0x40 [<ffffffff810e633d>] complete+0x1d/0x50 [<ffffffffa00ba08c>] uinput_request_done+0x3c/0x40 [uinput] [<ffffffffa00ba587>] uinput_request_submit.part.7+0x47/0xb0 [uinput] [<ffffffffa00bb62b>] uinput_dev_erase_effect+0x5b/0x76 [uinput] [<ffffffff815d91ad>] erase_effect+0xad/0xf0 [<ffffffff815d929d>] flush_effects+0x4d/0x90 [<ffffffff815d4cc0>] input_flush_device+0x40/0x60 [<ffffffff815daf1c>] evdev_cleanup+0xac/0xc0 [<ffffffff815daf5b>] evdev_disconnect+0x2b/0x60 [<ffffffff815d74ac>] __input_unregister_device+0xac/0x150 [<ffffffff815d75f7>] input_unregister_device+0x47/0x70 [<ffffffffa00bac45>] uinput_destroy_device+0xb5/0xc0 [uinput] [<ffffffffa00bb2de>] uinput_ioctl_handler.isra.9+0x65e/0x740 [uinput] [<ffffffff811231ab>] ? do_futex+0x12b/0xad0 [<ffffffffa00bb3f8>] uinput_ioctl+0x18/0x20 [uinput] [<ffffffff81241248>] do_vfs_ioctl+0x298/0x480 [<ffffffff81337553>] ? security_file_ioctl+0x43/0x60 [<ffffffff812414a9>] SyS_ioctl+0x79/0x90 [<ffffffff817a04ee>] entry_SYSCALL_64_fastpath+0x12/0x71 Reported-by: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com> Reported-by: Clément VUCHENER <clement.vuchener@gmail.com> Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=193741 Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: cm109 - do not stomp on control URBDmitry Torokhov2020-12-29
| | | | | | | | | | | | | | commit 82e06090473289ce63e23fdeb8737aad59b10645 upstream. We need to make sure we are not stomping on the control URB that was issued when opening the device when attempting to toggle buzzer. To do that we need to mark it as pending in cm109_open(). Reported-and-tested-by: syzbot+150f793ac5bc18eee150@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: adxl34x - clean up a data type in adxl34x_probe()Dan Carpenter2020-11-24
| | | | | | | | | | | | | | [ Upstream commit 33b6c39e747c552fa770eecebd1776f1f4a222b1 ] The "revid" is used to store negative error codes so it should be an int type. Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Michael Hennerich <michael.hennerich@analog.com> Link: https://lore.kernel.org/r/20201026072824.GA1620546@mwanda Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* Input: keyspan-remote - fix control-message timeoutsJohan Hovold2020-01-29
| | | | | | | | | | | | | | | | | | | | | | | commit ba9a103f40fc4a3ec7558ec9b0b97d4f92034249 upstream. The driver was issuing synchronous uninterruptible control requests without using a timeout. This could lead to the driver hanging on probe due to a malfunctioning (or malicious) device until the device is physically disconnected. While sleeping in probe the driver prevents other devices connected to the same hub from being added to (or removed from) the bus. The USB upper limit of five seconds per request should be more than enough. Fixes: 99f83c9c9ac9 ("[PATCH] USB: add driver for Keyspan Digital Remote") Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: stable <stable@vger.kernel.org> # 2.6.13 Link: https://lore.kernel.org/r/20200113171715.30621-1-johan@kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOADAndrey Smirnov2019-07-10
| | | | | | | | | | | | | | | | | commit 7c7da40da1640ce6814dab1e8031b44e19e5a3f6 upstream. In the case of compat syscall ioctl numbers for UI_BEGIN_FF_UPLOAD and UI_END_FF_UPLOAD need to be adjusted before being passed on uinput_ioctl_handler() since code built with -m32 will be passing slightly different values. Extend the code already covering UI_SET_PHYS to cover UI_BEGIN_FF_UPLOAD and UI_END_FF_UPLOAD as well. Reported-by: Pierre-Loup A. Griffais <pgriffais@valvesoftware.com> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: bma150 - register input device after setting private dataJonathan Bakker2019-02-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 90cc55f067f6ca0e64e5e52883ece47d8af7b67b upstream. Otherwise we introduce a race condition where userspace can request input before we're ready leading to null pointer dereference such as input: bma150 as /devices/platform/i2c-gpio-2/i2c-5/5-0038/input/input3 Unable to handle kernel NULL pointer dereference at virtual address 00000018 pgd = (ptrval) [00000018] *pgd=55dac831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] PREEMPT ARM Modules linked in: bma150 input_polldev [last unloaded: bma150] CPU: 0 PID: 2870 Comm: accelerometer Not tainted 5.0.0-rc3-dirty #46 Hardware name: Samsung S5PC110/S5PV210-based board PC is at input_event+0x8/0x60 LR is at bma150_report_xyz+0x9c/0xe0 [bma150] pc : [<80450f70>] lr : [<7f0a614c>] psr: 800d0013 sp : a4c1fd78 ip : 00000081 fp : 00020000 r10: 00000000 r9 : a5e2944c r8 : a7455000 r7 : 00000016 r6 : 00000101 r5 : a7617940 r4 : 80909048 r3 : fffffff2 r2 : 00000000 r1 : 00000003 r0 : 00000000 Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 54e34019 DAC: 00000051 Process accelerometer (pid: 2870, stack limit = 0x(ptrval)) Stackck: (0xa4c1fd78 to 0xa4c20000) fd60: fffffff3 fc813f6c fd80: 40410581 d7530ce3 a5e2817c a7617f00 a5e29404 a5e2817c 00000000 7f008324 fda0: a5e28000 8044f59c a5fdd9d0 a5e2945c a46a4a00 a5e29668 a7455000 80454f10 fdc0: 80909048 a5e29668 a5fdd9d0 a46a4a00 806316d0 00000000 a46a4a00 801df5f0 fde0: 00000000 d7530ce3 a4c1fec0 a46a4a00 00000000 a5fdd9d0 a46a4a08 801df53c fe00: 00000000 801d74bc a4c1fec0 00000000 a4c1ff70 00000000 a7038da8 00000000 fe20: a46a4a00 801e91fc a411bbe0 801f2e88 00000004 00000000 80909048 00000041 fe40: 00000000 00020000 00000000 dead4ead a6a88da0 00000000 ffffe000 806fcae8 fe60: a4c1fec8 00000000 80909048 00000002 a5fdd9d0 a7660110 a411bab0 00000001 fe80: dead4ead ffffffff ffffffff a4c1fe8c a4c1fe8c d7530ce3 20000013 80909048 fea0: 80909048 a4c1ff70 00000001 fffff000 a4c1e000 00000005 00026038 801eabd8 fec0: a7660110 a411bab0 b9394901 00000006 a696201b 76fb3000 00000000 a7039720 fee0: a5fdd9d0 00000101 00000002 00000096 00000000 00000000 00000000 a4c1ff00 ff00: a6b310f4 805cb174 a6b310f4 00000010 00000fe0 00000010 a4c1e000 d7530ce3 ff20: 00000003 a5f41400 a5f41424 00000000 a6962000 00000000 00000003 00000002 ff40: ffffff9c 000a0000 80909048 d7530ce3 a6962000 00000003 80909048 ffffff9c ff60: a6962000 801d890c 00000000 00000000 00020000 a7590000 00000004 00000100 ff80: 00000001 d7530ce3 000288b8 00026320 000288b8 00000005 80101204 a4c1e000 ffa0: 00000005 80101000 000288b8 00026320 000288b8 000a0000 00000000 00000000 ffc0: 000288b8 00026320 000288b8 00000005 7eef3bac 000264e8 00028ad8 00026038 ffe0: 00000005 7eef3300 76f76e91 76f78546 800d0030 000288b8 00000000 00000000 [<80450f70>] (input_event) from [<a5e2817c>] (0xa5e2817c) Code: e1a08148 eaffffa8 e351001f 812fff1e (e590c018) ---[ end trace 1c691ee85f2ff243 ]--- Signed-off-by: Jonathan Bakker <xc-racer2@live.ca> Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: drv260x - fix initializing overdrive voltageDmitry Torokhov2018-04-29
| | | | | | | | | | | | | commit 74c82dae6c474933f2be401976e1530b5f623221 upstream. We were accidentally initializing haptics->rated_voltage twice, and did not initialize overdrive voltage. Acked-by: Dan Murphy <dmurphy@ti.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Cc: Amit Pundir <amit.pundir@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: twl4030-pwrbutton - use correct device for irq requestSebastian Reichel2018-03-24
| | | | | | | | | | | | | [ Upstream commit 3071e9dd6cd3f2290d770117330f2c8b2e9a97e4 ] The interrupt should be requested for the platform device and not for the input device. Fixes: 7f9ce649d267 ("Input: twl4030-pwrbutton - simplify driver using devm_*") Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: twl4030-vibra - fix sibling-node lookupJohan Hovold2018-01-23
| | | | | | | | | | | | | | | | commit 5b189201993ab03001a398de731045bfea90c689 upstream. A helper purported to look up a child node based on its name was using the wrong of-helper and ended up prematurely freeing the parent of-node while searching the whole device tree depth-first starting at the parent node. Fixes: 64b9e4d803b1 ("input: twl4030-vibra: Support for DT booted kernel") Fixes: e661d0a04462 ("Input: twl4030-vibra - fix ERROR: Bad of_node_put() warning") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: twl6040-vibra - fix child-node lookupJohan Hovold2018-01-23
| | | | | | | | | | | | | | | | | | | | | | commit dcaf12a8b0bbdbfcfa2be8dff2c4948d9844b4ad upstream. Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at parent rather than just matching on its children. Later sanity checks on node properties (which would likely be missing) should prevent this from causing much trouble however, especially as the original premature free of the parent node has already been fixed separately (but that "fix" was apparently never backported to stable). Fixes: e7ec014a47e4 ("Input: twl6040-vibra - update for device tree support") Fixes: c52c545ead97 ("Input: twl6040-vibra - fix DT node memory management") Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Tested-by: H. Nikolaus Schaller <hns@goldelico.com> (on Pyra OMAP5 hardware) Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: twl6040-vibra - fix DT node memory managementH. Nikolaus Schaller2018-01-23
| | | | | | | | | | | | | | | | | | | commit c52c545ead97fcc2f4f8ea38f1ae3c23211e09a8 upstream. commit e7ec014a47e4 ("Input: twl6040-vibra - update for device tree support") made the separate vibra DT node to a subnode of the twl6040. It now calls of_find_node_by_name() to locate the "vibra" subnode. This function has a side effect to call of_node_put on() for the twl6040 parent node passed in as a parameter. This causes trouble later on. Solution: we must call of_node_get() before of_find_node_by_name() Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: ims-psu - check if CDC union descriptor is saneDmitry Torokhov2017-11-18
| | | | | | | | | | | | | | commit ea04efee7635c9120d015dcdeeeb6988130cb67a upstream. Before trying to use CDC union descriptor, try to validate whether that it is sane by checking that intf->altsetting->extra is big enough and that descriptor bLength is not too big and not too small. Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Cc: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: cm109 - validate number of endpoints before using themJohan Hovold2017-03-30
| | | | | | | | | | | | | commit ac2ee9ba953afe88f7a673e1c0c839227b1d7891 upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints. Fixes: c04148f915e5 ("Input: add driver for USB VoIP phones with CM109...") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: yealink - validate number of endpoints before using themJohan Hovold2017-03-30
| | | | | | | | | | | | | commit 5cc4a1a9f5c179795c8a1f2b0f4361829d6a070e upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints. Fixes: aca951a22a1d ("[PATCH] input-driver-yealink-P1K-usb-phone") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: ims-pcu - validate number of endpoints before using themJohan Hovold2017-03-30
| | | | | | | | | | | | | commit 1916d319271664241b7aa0cd2b05e32bdb310ce9 upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack control-interface endpoints. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: drv260x - fix input device's parent assignmentJingkui Wang2017-01-09
| | | | | | | | | | | | | | | | | | | commit 5a8a6b89c15766446d845671d574a9243b6d8786 upstream. We were assigning I2C bus controller instead of client as parent device. Besides being logically wrong, it messed up with devm handling of input device. As a result we were leaving input device and event node behind after rmmod-ing the driver, which lead to a kernel oops if one were to access the event node later. Let's remove the assignment and rely on devm_input_allocate_device() to set it up properly for us. Signed-off-by: Jingkui Wang <jkwang@google.com> Fixes: 7132fe4f5687 ("Input: drv260x - add TI drv260x haptics driver") Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: uinput - handle compat ioctl for UI_SET_PHYSRicky Liang2016-06-07
| | | | | | | | | | | | | commit affa80bd97f7ca282d1faa91667b3ee9e4c590e6 upstream. When running a 32-bit userspace on a 64-bit kernel, the UI_SET_PHYS ioctl needs to be treated with special care, as it has the pointer size encoded in the command. Signed-off-by: Ricky Liang <jcliang@chromium.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: pwm-beeper - fix - scheduling while atomicManfred Schlaegl2016-06-01
| | | | | | | | | | | | | | | | | commit f49cf3b8b4c841457244c461c66186a719e13bcc upstream. Pwm config may sleep so defer it using a worker. On a Freescale i.MX53 based board we ran into "BUG: scheduling while atomic" because input_inject_event locks interrupts, but imx_pwm_config_v2 sleeps. Tested on Freescale i.MX53 SoC with 4.6.0. Signed-off-by: Manfred Schlaegl <manfred.schlaegl@gmx.at> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: max8997-haptic - fix NULL pointer dereferenceMarek Szyprowski2016-05-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 6ae645d5fa385f3787bf1723639cd907fe5865e7 upstream. NULL pointer derefence happens when booting with DTB because the platform data for haptic device is not set in supplied data from parent MFD device. The MFD device creates only platform data (from Device Tree) for itself, not for haptic child. Unable to handle kernel NULL pointer dereference at virtual address 0000009c pgd = c0004000 [0000009c] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM (max8997_haptic_probe) from [<c03f9cec>] (platform_drv_probe+0x4c/0xb0) (platform_drv_probe) from [<c03f8440>] (driver_probe_device+0x214/0x2c0) (driver_probe_device) from [<c03f8598>] (__driver_attach+0xac/0xb0) (__driver_attach) from [<c03f67ac>] (bus_for_each_dev+0x68/0x9c) (bus_for_each_dev) from [<c03f7a38>] (bus_add_driver+0x1a0/0x218) (bus_add_driver) from [<c03f8db0>] (driver_register+0x78/0xf8) (driver_register) from [<c0101774>] (do_one_initcall+0x90/0x1d8) (do_one_initcall) from [<c0a00dbc>] (kernel_init_freeable+0x15c/0x1fc) (kernel_init_freeable) from [<c06bb5b4>] (kernel_init+0x8/0x114) (kernel_init) from [<c0107938>] (ret_from_fork+0x14/0x3c) Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Fixes: 104594b01ce7 ("Input: add driver support for MAX8997-haptic") [k.kozlowski: Write commit message, add CC-stable] Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delayStephen Boyd2016-05-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit eda5ecc0a6b865561997e177c393f0b0136fe3b7 upstream. The trigger delay algorithm that converts from microseconds to the register value looks incorrect. According to most of the PMIC documentation, the equation is delay (Seconds) = (1 / 1024) * 2 ^ (x + 4) except for one case where the documentation looks to have a formatting issue and the equation looks like delay (Seconds) = (1 / 1024) * 2 x + 4 Most likely this driver was written with the improper documentation to begin with. According to the downstream sources the valid delays are from 2 seconds to 1/64 second, and the latter equation just doesn't make sense for that. Let's fix the algorithm and the range check to match the documentation and the downstream sources. Reported-by: Bjorn Andersson <bjorn.andersson@linaro.org> Fixes: 92d57a73e410 ("input: Add support for Qualcomm PMIC8XXX power key") Signed-off-by: Stephen Boyd <sboyd@codeaurora.org> Tested-by: John Stultz <john.stultz@linaro.org> Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: ati_remote2 - fix crashes on detecting device with invalid descriptorVladis Dronov2016-04-12
| | | | | | | | | | | | | | | | | | commit 950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d upstream. The ati_remote2 driver expects at least two interfaces with one endpoint each. If given malicious descriptor that specify one interface or no endpoints, it will crash in the probe function. Ensure there is at least two interfaces and one endpoint for each interface before using it. The full disclosure: http://seclists.org/bugtraq/2016/Mar/90 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: ims-pcu - sanity check against missing interfacesOliver Neukum2016-04-12
| | | | | | | | | | | | commit a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff upstream. A malicious device missing interface can make the driver oops. Add sanity checking. Signed-off-by: Oliver Neukum <ONeukum@suse.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Input: powermate - fix oops with malicious USB descriptorsJosh Boyer2016-04-12
| | | | | | | | | | | | | | | | | | commit 9c6ba456711687b794dcf285856fc14e2c76074f upstream. The powermate driver expects at least one valid USB endpoint in its probe function. If given malicious descriptors that specify 0 for the number of endpoints, it will crash. Validate the number of endpoints on the interface before using them. The full report for this issue can be found here: http://seclists.org/bugtraq/2016/Mar/85 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Merge branch 'for-linus' of ↵Linus Torvalds2015-12-19
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: "Just a few assorted driver fixes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: elants_i2c - fix wake-on-touch Input: elan_i2c - set input device's vendor and product IDs Input: sun4i-lradc-keys - fix typo in binding documentation Input: atmel_mxt_ts - add maxtouch to I2C table for module autoload Input: arizona-haptic - fix disabling of haptics device Input: aiptek - fix crash on detecting device without endpoints Input: atmel_mxt_ts - add generic platform data for Chromebooks Input: parkbd - clear unused function pointers Input: walkera0701 - clear unused function pointers Input: turbografx - clear unused function pointers Input: gamecon - clear unused function pointers Input: db9 - clear unused function pointers
| * Input: arizona-haptic - fix disabling of haptics deviceCharles Keepax2015-12-02
| | | | | | | | | | | | | | A small copy and paste error was preventing the haptics device being disabled. This patch corrects the value written on disable. Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* | Merge branch 'for-linus' of ↵Linus Torvalds2015-11-06
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: "Items of note: - evdev users can now limit or mask the kind of events they will receive. This will allow applications such as power manager or network manager to only be woken when user presses special keys such as KEY_POWER or KEY_WIFI and not be bothered with ordinary key presses coming from keyboard - support for FocalTech FT6236 touchscreen controller - support for ROHM BU21023/24 touchscreen controller - edt-ft5x06 touchscreen driver got a face lift and can now be used with FT5506 - support for Google Fiber TV Box remote controls - improvements in xpad driver (with more to come) - several parport-based drivers have been switched to the new device model - other miscellaneous driver improvements" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (70 commits) HID: hid-gfrm: avoid warning for input_configured API change HID: hid-input: allow input_configured callback return errors Input: evdev - fix bug in checking duplicate clock change request Input: add userio module Input: evdev - add event-mask API Input: snvs_pwrkey - remove duplicated semicolon HID: hid-gfrm: Google Fiber TV Box remote controls Input: e3x0-button - update Kconfig description Input: tegra-kbc - drop use of IRQF_NO_SUSPEND flag Input: tegra-kbc - enable support for the standard "wakeup-source" property Input: xen - check return value of xenbus_printf Input: hp_sdc_rtc - fix y2038 problem in proc_show Input: nomadik-ske-keypad - fix a trivial typo Input: xpad - fix clash of presence handling with LED setting Input: edt-ft5x06 - work around FT5506 firmware bug Input: edt-ft5x06 - add support for FT5506 Input: edt-ft5x06 - add support for different max support points Input: edt-ft5x06 - use max support points to determine how much to read Input: rotary-encoder - add support for quarter-period mode Input: rotary-encoder - use of_property_read_bool ...
| * Input: e3x0-button - update Kconfig descriptionMoritz Fischer2015-10-26
| | | | | | | | | | | | | | | | | | The driver is now used for the entire USRP e3xx series, this commit fixes the description that will be displayed in the menu accordingly. Signed-off-by: Moritz Fischer <moritz.fischer@ettus.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * Input: xen - check return value of xenbus_printfInsu Yun2015-10-22
| | | | | | | | | | | | | | | | | | Internally, xenbus_printf uses memory allocation, so it can fail under memory pressure, leaving the input device configured as absolute with the backend supplying relative coordinates. Signed-off-by: Insu Yun <wuninsu@gmail.com> Reviewed-by: Julien Grall <julien.grall@citrix.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * Input: hp_sdc_rtc - fix y2038 problem in proc_showWEN Pingbo2015-10-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | hp_sdc_rtc_proc_show() use timeval to store the time, which will overflow in 2038. This patch fixes this problem by replacing timeval with timespec64. hp_sdc_rtc_proc_show() only output string, so that userspace will work normally if we apply this patch. Not all timer in i8042 have y2038 risk(handshake, match timer, etc), Replacements in those timer are just for consistency. Signed-off-by: WEN Pingbo <pingbo.wen@linaro.org> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * Input: rotary-encoder - add support for quarter-period modeEzequiel Garcia2015-10-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some encoders have both outputs low in stable states, others also have a stable state with both outputs high (half-period mode) and some have a stable state in all steps (quarter-period mode). The driver used to support the former states and with this change it can also support the later. This commit also deprecates the 'half-period' property and introduces a new property 'steps-per-period'. This property specifies the number of steps (stable states) produced by the rotary encoder for each GPIO period. Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar> Signed-off-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * Input: rotary-encoder - use of_property_read_boolBen Gamari2015-10-16
| | | | | | | | | | | | | | | | This commit makes uses of_property_read_bool() to read boolean properties. This is just cosmetic cleanup. Signed-off-by: Ben Gamari <bgamari.foss@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * Input: rotary_encoder - add wake up supportSylvain Rochet2015-10-13
| | | | | | | | | | | | | | This patch adds wake up support to GPIO rotary encoders. Signed-off-by: Sylvain Rochet <sylvain.rochet@finsecur.com> Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * Merge tag 'v4.3-rc4' into nextDmitry Torokhov2015-10-05
| |\ | | | | | | | | | Merge with mainline to sync up with changes to parkbd driver.
| * | Input: kxtj9 - remove unneeded retval variableJavier Martinez Canillas2015-10-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The retval variable isn't needed since isn't used in the function. Remove the variable and just return 0 instead. This also fixes the following make coccicheck warning: drivers/input/misc/kxtj9.c:638:5-11: Unneeded variable: "retval". Return "0" on line 646 Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * | Input: add DA9062 OnKey capability to DA9063 OnKey driverS Twiss2015-09-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add DA9062 OnKey support into the existing DA9063 OnKey driver component by using generic access tables for common register and bit mask definitions. The following change will add generic register and bit mask support to the DA9063 OnKey. The following alterations have been made to the DA9063 OnKey: - Addition of a da906x_chip_config structure to hold all generic registers and bitmasks for this type of OnKey component. - Addition of an struct of_device_id table for DA9063 and DA9062 defaults - Refactoring functions to use struct da9063_onkey accesses to generic registers/masks instead of using defines from registers.h - Re-work of da9063_onkey_probe() to use of_match_node() and dev_get_regmap() to provide initialisation of generic registers and masks and access to regmap Signed-off-by: Steve Twiss <stwiss.opensource@diasemi.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * | Merge tag 'v4.3-rc3' into nextDmitry Torokhov2015-09-29
| |\ \ | | | | | | | | | | | | | | | | Merge with Linux 4.3-rc3 to bring in MFD DA9062 changes to merge DA9062 OnKey driver.
| * | | Input: ad714x - convert to using managed resourcesVaishali Thakkar2015-09-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use managed resource functions devm_request_threaded_irq, devm_inpute_allocate_device and devm_kzalloc to simplify error handling. Also, remove use of input_unregister_device as input_register_device itself handles it and works as resource managed function. To be compatible with the change, various gotos are replaced with direct returns, and unneeded labels are dropped. With these changes remove ad714x_remove and corresponding calls of it as they are now redundant. Signed-off-by: Vaishali Thakkar <vthakkar1994@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| | | |
| \ \ \
*-. \ \ \ Merge remote-tracking branches 'spi/topic/omap-100k', ↵Mark Brown2015-11-04
|\ \ \ \ \ | | |_|/ / | |/| | / | |_|_|/ |/| | | 'spi/topic/omap-uwire', 'spi/topic/owner', 'spi/topic/pxa' and 'spi/topic/pxa2xx' into spi-next
| | * | spi: Drop owner assignment from spi_driversAndrew F. Davis2015-10-28
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | An spi_driver does not need to set an owner, it will be populated by the driver core. Signed-off-by: Andrew F. Davis <afd@ti.com> Acked-by: Jonathan Cameron <jic23@kernel.org> Signed-off-by: Mark Brown <broonie@kernel.org>
* | | Merge branch 'for-linus' of ↵Linus Torvalds2015-10-02
|\ \ \ | |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input layer fixes from Dmitry Torokhov: "Fixes for two recent regressions (in Synaptics PS/2 and uinput drivers) and some more driver fixups" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Revert "Input: synaptics - fix handling of disabling gesture mode" Input: psmouse - fix data race in __ps2_command Input: elan_i2c - add all valid ic type for i2c/smbus Input: zhenhua - ensure we have BITREVERSE Input: omap4-keypad - fix memory leak Input: serio - fix blocking of parport Input: uinput - fix crash when using ABS events Input: elan_i2c - expand maximum product_id form 0xFF to 0xFFFF Input: elan_i2c - add ic type 0x03 Input: elan_i2c - don't require known iap version Input: imx6ul_tsc - fix controller name Input: imx6ul_tsc - use the preferred method for kzalloc() Input: imx6ul_tsc - check for negative return value Input: imx6ul_tsc - propagate the errors Input: walkera0701 - fix abs() calculations on 64 bit values Input: mms114 - remove unneded semicolons Input: pm8941-pwrkey - remove unneded semicolon Input: fix typo in MT documentation Input: cyapa - fix address of Gen3 devices in device tree documentation
| * | Input: uinput - fix crash when using ABS eventsDmitry Torokhov2015-09-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit b6d30968d86c45a7bb599eaca13ff048d3fa576c (Input: uinput - switch to using for_each_set_bit()) switched driver to use for_each_set_bit(). However during initial write of the uinput structure that contains min/max data for all possible axes none of them are reflected in dev->absbit yet and so we were skipping over all of them and were not allocating absinfo memory which caused crash later when driver tried to sens EV_ABS events: <1>[ 15.064330] BUG: unable to handle kernel NULL pointer dereference at 0000000000000024 <1>[ 15.064336] IP: [<ffffffff8163f142>] input_handle_event+0x232/0x4e0 <4>[ 15.064343] PGD 0 <4>[ 15.064345] Oops: 0000 [#1] SMP Fixes: b6d30968d86c45a7bb599eaca13ff048d3fa576c Cc: stable@vger.kernel.org Reported-by: Stephen Chandler Paul <cpaul@redhat.com> Tested-by: Stephen Chandler Paul <cpaul@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * | Input: pm8941-pwrkey - remove unneded semicolonJavier Martinez Canillas2015-09-19
| | | | | | | | | | | | | | | | | | It's not needed and is just creating a null statement so remove it. Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* | | Merge branch 'for-linus' of ↵Linus Torvalds2015-09-11
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull more input updates from Dmitry Torokhov: "Second round of updates for the input subsystem. This introduces two brand new touchscreen drivers (Colibri and imx6ul_tsc), some small driver fixes, and we are no longer report errors from evdev_flush() as users do not really have a way of handling errors, error codes that we were returning were not on the list of errors supposed to be returned by close(), and errors were causing issues with one of older versions of systemd" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: imx_keypad - remove obsolete comment Input: touchscreen - add imx6ul_tsc driver support Input: Add touchscreen support for Colibri VF50 Input: i8042 - lower log level for "no controller" message Input: evdev - do not report errors form flush() Input: elants_i2c - extend the calibration timeout to 12 seconds Input: sparcspkr - fix module autoload for OF platform drivers Input: regulator-haptic - fix module autoload for OF platform driver Input: pwm-beeper - fix module autoload for OF platform driver Input: ab8500-ponkey - Fix module autoload for OF platform driver Input: cyttsp - remove unnecessary MODULE_ALIAS() Input: elan_i2c - add ACPI ID "ELAN1000"
| * | Merge branch 'next' into for-linusDmitry Torokhov2015-09-11
| |\| | | | | | | | | | Prepare second round of input updates for 4.3 merge window.
| | * Input: sparcspkr - fix module autoload for OF platform driversLuis de Bethencourt2015-09-03
| | | | | | | | | | | | | | | | | | | | | | | | These platform drivers have a OF device ID table but the OF module alias information is not created so module autoloading won't work. Signed-off-by: Luis de Bethencourt <luis@debethencourt.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| | * Input: regulator-haptic - fix module autoload for OF platform driverLuis de Bethencourt2015-09-03
| | | | | | | | | | | | | | | | | | | | | This platform driver has a OF device ID table but the OF module alias information is not created so module autoloading won't work. Signed-off-by: Luis de Bethencourt <luis@debethencourt.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| | * Input: pwm-beeper - fix module autoload for OF platform driverLuis de Bethencourt2015-09-03
| | | | | | | | | | | | | | | | | | | | | This platform driver has a OF device ID table but the OF module alias information is not created so module autoloading won't work. Signed-off-by: Luis de Bethencourt <luis@debethencourt.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| | * Input: ab8500-ponkey - Fix module autoload for OF platform driverLuis de Bethencourt2015-09-03
| | | | | | | | | | | | | | | | | | | | | This platform driver has a OF device ID table but the OF module alias information is not created so module autoloading won't work. Signed-off-by: Luis de Bethencourt <luis@debethencourt.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* | | Merge tag 'for-linus-4.3-rc0b-tag' of ↵Linus Torvalds2015-09-10
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen terminology fixes from David Vrabel: "Use the correct GFN/BFN terms more consistently" * tag 'for-linus-4.3-rc0b-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/xenbus: Rename the variable xen_store_mfn to xen_store_gfn xen/privcmd: Further s/MFN/GFN/ clean-up hvc/xen: Further s/MFN/GFN clean-up video/xen-fbfront: Further s/MFN/GFN clean-up xen/tmem: Use xen_page_to_gfn rather than pfn_to_gfn xen: Use correctly the Xen memory terminologies arm/xen: implement correctly pfn_to_mfn xen: Make clear that swiotlb and biomerge are dealing with DMA address
| * | | xen: Use correctly the Xen memory terminologiesJulien Grall2015-09-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Based on include/xen/mm.h [1], Linux is mistakenly using MFN when GFN is meant, I suspect this is because the first support for Xen was for PV. This resulted in some misimplementation of helpers on ARM and confused developers about the expected behavior. For instance, with pfn_to_mfn, we expect to get an MFN based on the name. Although, if we look at the implementation on x86, it's returning a GFN. For clarity and avoid new confusion, replace any reference to mfn with gfn in any helpers used by PV drivers. The x86 code will still keep some reference of pfn_to_mfn which may be used by all kind of guests No changes as been made in the hypercall field, even though they may be invalid, in order to keep the same as the defintion in xen repo. Note that page_to_mfn has been renamed to xen_page_to_gfn to avoid a name to close to the KVM function gfn_to_page. Take also the opportunity to simplify simple construction such as pfn_to_mfn(page_to_pfn(page)) into xen_page_to_gfn. More complex clean up will come in follow-up patches. [1] http://xenbits.xen.org/gitweb/?p=xen.git;a=commitdiff;h=e758ed14f390342513405dd766e874934573e6cb Signed-off-by: Julien Grall <julien.grall@citrix.com> Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Acked-by: Wei Liu <wei.liu2@citrix.com> Signed-off-by: David Vrabel <david.vrabel@citrix.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-04-20 23:06:55 +0000