17 Sep, 2020

3 commits

  • [ Upstream commit b7429ea53d6c0936a0f10a5d64164f0aea440143 ]

    When input_mt_init_slots() fails, input should be freed
    to prevent memleak. When input_register_device() fails,
    we should call input_mt_destroy_slots() to free memory
    allocated by input_mt_init_slots().

    Signed-off-by: Dinghao Liu
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Dinghao Liu
     
  • [ Upstream commit 724a419ea28f7514a391e80040230f69cf626707 ]

    When operating in XInput mode, the 8bitdo SN30 Pro+ requires the same
    quirk as the official Xbox One Bluetooth controllers for rumble to
    function.

    Other controllers like the N30 Pro 2, SF30 Pro, SN30 Pro, etc. probably
    also need this quirk, but I do not have the hardware to test.

    Signed-off-by: Nicholas Miell
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Nicholas Miell
     
  • [ Upstream commit 77df710ba633dfb6c65c65cf99ea9e084a1c9933 ]

    The Saitek X52 family of joysticks has a pair of axes that were
    originally (by the Windows driver) used as mouse pointer controls. The
    corresponding usage page is the Game Controls page, which is not
    recognized by the generic HID driver, and therefore, both axes get
    mapped to ABS_MISC. The quirk makes the second axis get mapped to
    ABS_MISC+1, and therefore made available separately.

    One Saitek X52 device is already fixed. This patch fixes the other two
    known devices with VID/PID 06a3:0255 and 06a3:0762.

    Signed-off-by: Nirenjan Krishnan
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Nirenjan Krishnan
     

10 Sep, 2020

1 commit

  • [ Upstream commit 627a49975bdc3220f360a8237603a6344ee6a588 ]

    The PixArt OEM mice are known for disconnecting every minute in
    runlevel 1 or 3 if they are not always polled. One Lenovo PixArt
    mouse is already fixed. Got two references for 17ef:602e and three
    references for 17ef:6019 misbehaving like this. Got one direct bug
    report for 17ef:6093 from Wyatt Ward (wyatt8740). So add
    HID_QUIRK_ALWAYS_POLL for all of them.

    Link: https://github.com/sriemer/fix-linux-mouse issue 22
    Signed-off-by: Sebastian Parschauer
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Sebastian Parschauer
     

05 Sep, 2020

2 commits

  • commit 35556bed836f8dc07ac55f69c8d17dce3e7f0e25 upstream.

    When calling into hid_map_usage(), the passed event code is
    blindly stored as is, even if it doesn't fit in the associated bitmap.

    This event code can come from a variety of sources, including devices
    masquerading as input devices, only a bit more "programmable".

    Instead of taking the event code at face value, check that it actually
    fits the corresponding bitmap, and if it doesn't:
    - spit out a warning so that we know which device is acting up
    - NULLify the bitmap pointer so that we catch unexpected uses

    Code paths that can make use of untrusted inputs can now check
    that the mapping was indeed correct and bail out if not.

    Cc: stable@vger.kernel.org
    Signed-off-by: Marc Zyngier
    Signed-off-by: Benjamin Tissoires
    Signed-off-by: Greg Kroah-Hartman

    Marc Zyngier
     
  • commit bce1305c0ece3dc549663605e567655dd701752c upstream.

    It appears that a ReportSize value of zero is legal, even if a bit
    non-sensical. Most of the HID code seems to handle that gracefully,
    except when computing the total size in bytes. When fed as input to
    memset, this leads to some funky outcomes.

    Detect the corner case and correctly compute the size.

    Cc: stable@vger.kernel.org
    Signed-off-by: Marc Zyngier
    Signed-off-by: Benjamin Tissoires
    Signed-off-by: Greg Kroah-Hartman

    Marc Zyngier
     

03 Sep, 2020

3 commits

  • commit 25a097f5204675550afb879ee18238ca917cba7a upstream.

    `uref->usage_index` is not always being properly checked, causing
    hiddev_ioctl_usage() to go out of bounds under some cases. Fix it.

    Reported-by: syzbot+34ee1b45d88571c2fa8b@syzkaller.appspotmail.com
    Link: https://syzkaller.appspot.com/bug?id=f2aebe90b8c56806b050a20b36f51ed6acabe802
    Reviewed-by: Dan Carpenter
    Signed-off-by: Peilin Ye
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    Peilin Ye
     
  • commit eef4016243e94c438f177ca8226876eb873b9c75 upstream.

    Before this commit i2c_hid_parse() consists of the following steps:

    1. Send power on cmd
    2. usleep_range(1000, 5000)
    3. Send reset cmd
    4. Wait for reset to complete (device interrupt, or msleep(100))
    5. Send power on cmd
    6. Try to read HID descriptor

    Notice how there is an usleep_range(1000, 5000) after the first power-on
    command, but not after the second power-on command.

    Testing has shown that at least on the BMAX Y13 laptop's i2c-hid touchpad,
    not having a delay after the second power-on command causes the HID
    descriptor to read as all zeros.

    In case we hit this on other devices too, the descriptor being all zeros
    can be recognized by the following message being logged many, many times:

    hid-generic 0018:0911:5288.0002: unknown main item tag 0x0

    At the same time as the BMAX Y13's touchpad issue was debugged,
    Kai-Heng was working on debugging some issues with Goodix i2c-hid
    touchpads. It turns out that these need a delay after a PWR_ON command
    too, otherwise they stop working after a suspend/resume cycle.
    According to Goodix a delay of minimal 60ms is needed.

    Having multiple cases where we need a delay after sending the power-on
    command, seems to indicate that we should always sleep after the power-on
    command.

    This commit fixes the mentioned issues by moving the existing 1ms sleep to
    the i2c_hid_set_power() function and changing it to a 60ms sleep.

    Cc: stable@vger.kernel.org
    BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208247
    Reported-by: Kai-Heng Feng
    Reported-and-tested-by: Andrea Borgia
    Signed-off-by: Hans de Goede
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    Hans de Goede
     
  • [ Upstream commit 68f775ddd2a6f513e225f9a565b054ab48fef142 ]

    Add HID_QUIRK_NOGET for Logitech GROUP device.

    Logitech GROUP is a compound with camera and audio.
    When the HID interface in an audio device is requested to get
    specific report id, all following control transfers are stalled
    and never be restored back.

    BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=203419
    Signed-off-by: Ikjoon Jang
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Ikjoon Jang
     

19 Aug, 2020

1 commit

  • commit 4f57cace81438cc873a96f9f13f08298815c9b51 upstream.

    Some devices, particularly the 3DConnexion Spacemouse wireless 3D
    controllers, return more than just the battery capacity in the battery
    report. The Spacemouse devices return an additional byte with a device
    specific field. However, hidinput_query_battery_capacity() only
    requests a 2 byte transfer.

    When a spacemouse is connected via USB (direct wire, no wireless dongle)
    and it returns a 3 byte report instead of the assumed 2 byte battery
    report the larger transfer confuses and frightens the USB subsystem
    which chooses to ignore the transfer. Then after 2 seconds assume the
    device has stopped responding and reset it. This can be reproduced
    easily by using a wired connection with a wireless spacemouse. The
    Spacemouse will enter a loop of resetting every 2 seconds which can be
    observed in dmesg.

    This patch solves the problem by increasing the transfer request to 4
    bytes instead of 2. The fix isn't particularly elegant, but it is simple
    and safe to backport to stable kernels. A further patch will follow to
    more elegantly handle battery reports that contain additional data.

    Signed-off-by: Grant Likely
    Cc: Darren Hart
    Cc: Jiri Kosina
    Cc: Benjamin Tissoires
    Cc: stable@vger.kernel.org
    Tested-by: Darren Hart
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    Grant Likely
     

29 Jul, 2020

4 commits

  • [ Upstream commit a5d81646fa294eed57786a9310b06ca48902adf8 ]

    The Maxxter KB-BT-001 Bluetooth keyboard, which looks somewhat like the
    Apple Wireless Keyboard, is using the vendor and product IDs (05AC:0239)
    of the Apple Wireless Keyboard (2009 ANSI version) .

    But its F1 - F10 keys are marked as sending F1 - F10, not the special
    functions hid-apple.c maps them too; and since its descriptors do not
    contain the HID_UP_CUSTOM | 0x0003 usage apple-hid looks for for the
    Fn-key, apple_setup_input() never gets called, so F1 - F6 are mapped
    to key-codes which have not been set in the keybit array causing them
    to not send any events at all.

    The lack of a usage code matching the Fn key in the clone is actually
    useful as this allows solving this problem in a generic way.

    This commits adds a fn_found flag and it adds a input_configured
    callback which checks if this flag is set once all usages have been
    mapped. If it is not set, then assume this is a clone and clear the
    quirks bitmap so that the hid-apple code does not add any special
    handling to this keyboard.

    This fixes F1 - F6 not sending anything at all and F7 - F12 sending
    the wrong codes on the Maxxter KB-BT-001 Bluetooth keyboard and on
    similar clones.

    Cc: Joao Moreno
    Signed-off-by: Hans de Goede
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Hans de Goede
     
  • [ Upstream commit 2d3f53a80e4eed078669853a178ed96d88f74143 ]

    Using uhid and KASAN this driver crashed because it was getting
    several connection events where it only expected one. Then the
    device was added several times to the static device list and it got
    corrupted.

    This patch checks if the device is already in the list before adding
    it.

    Signed-off-by: Rodrigo Rivas Costa
    Tested-by: Siarhei Vishniakou
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Rodrigo Rivas Costa
     
  • [ Upstream commit aa3c439c144f0a465ed1f28f11c772886fb02b35 ]

    Add support for devices which that have reports with id == 2

    Signed-off-by: Caiyuan Xie
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Caiyuan Xie
     
  • [ Upstream commit 43e666acb79f3d355dd89bf20f4d25d3b15da13e ]

    The Mediacom FlexBook edge13 uses the SIPODEV SP1064 touchpad, which does not
    supply descriptors, so it has to be added to the override list.

    Signed-off-by: Federico Ricchiuto
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Federico Ricchiuto
     

22 Jul, 2020

5 commits

  • commit 1ee1369b46de1083238fced60ff718f59de4b8aa upstream.

    As this is a cypress HID->COM RS232 style device that is handled
    by the cypress_M8 driver we also need to add it to the ignore list
    in hid-quirks.

    Cc: stable
    Signed-off-by: James Hilliard
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    James Hilliard
     
  • commit ca28aff0e1dc7dce9e12a7fd9276b7118ce5e73a upstream.

    The Obins Anne Pro 2 keyboard (04d9:a293) disconnects after a few
    minutes of inactivity when using it wired and typing does not result
    in any input events any more. This is a common firmware flaw. So add
    the ALWAYS_POLL quirk for this device.

    GitHub user Dietrich Moerman (dietrichm) tested the quirk and
    requested my help in my project
    https://github.com/sriemer/fix-linux-mouse issue 22 to provide
    this patch.

    Link: https://www.reddit.com/r/AnnePro/comments/gruzcb/anne_pro_2_linux_cant_type_after_inactivity/
    Signed-off-by: Sebastian Parschauer
    Cc: stable@vger.kernel.org # v4.16+
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    Sebastian Parschauer
     
  • commit 6363d2065cd399cf9d6dc9d08c437f8658831100 upstream.

    Neither the trackpad, nor the mouse want input core to generate autorepeat
    events for their buttons, so let's reset the bit (as hid-input sets it for
    these devices based on the usage vendor code).

    Cc: stable@vger.kernel.org
    Reported-by: Yariv
    Tested-by: Yariv
    Signed-off-by: Dmitry Torokhov
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    Dmitry Torokhov
     
  • commit e13762abf38ead29071407f32b9dcec38f21dc34 upstream.

    These messages appear each time the mouse wakes from sleep, in my case
    (Logitech M705), every minute or so.
    Let's downgrade them to the "debug" level so they don't fill the kernel log
    by default.

    While we are at it, let's make clear that this is a wheel multiplier (and
    not, for example, XY movement multiplier).

    Fixes: 4435ff2f09a2 ("HID: logitech: Enable high-resolution scrolling on Logitech mice")
    Cc: stable@vger.kernel.org
    Signed-off-by: Maciej S. Szmigiero
    Reviewed-by: Harry Cutts
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    Maciej S. Szmigiero
     
  • [ Upstream commit 3045696d0ce663d67c95dcb8206d3de57f6841ec ]

    The ITE 8595 chip used in various 2-in-1 keyboard docks works fine with
    the hid-generic driver (minus the RF_KILL key) and also keeps working fine
    when swapping drivers, so there is no need to have it in the
    hid_have_special_driver list.

    Note the other 2 USB ids in hid-ite.c were never added to
    hid_have_special_driver.

    Signed-off-by: Hans de Goede
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Hans de Goede
     

24 Jun, 2020

2 commits

  • [ Upstream commit fb68ada81e65d593b51544fa43c284322107a742 ]

    The Trust Panora Graphic Tablet has two interfaces. Interface zero reports pen
    movement, pen pressure and pen buttons. Interface one reports tablet buttons
    and tablet scroll. Both use the mouse protocol.

    Without these quirks, libinput gets confused about what device it talks to.

    For completeness, here is the usbhid-dump:

    ```
    $ sudo usbhid-dump -d 145f:0212
    003:013:001:DESCRIPTOR 1588949402.559961
    05 0D 09 01 A1 01 85 07 A1 02 09 00 75 08 95 07
    81 02 C0 C0 09 0E A1 01 85 05 09 23 A1 02 09 52
    09 53 25 0A 75 08 95 02 B1 02 C0 C0 05 0C 09 36
    A1 00 85 06 05 09 19 01 29 20 15 00 25 01 95 20
    75 01 81 02 C0

    003:013:000:DESCRIPTOR 1588949402.563942
    05 01 09 02 A1 01 85 08 09 01 A1 00 05 09 19 01
    29 03 15 00 25 01 95 03 75 01 81 02 95 05 81 01
    05 01 09 30 09 31 09 38 09 00 15 81 25 7F 75 08
    95 04 81 06 C0 C0 05 01 09 02 A1 01 85 09 09 01
    A1 00 05 09 19 01 29 03 15 00 25 01 95 03 75 01
    81 02 95 05 81 01 05 01 09 30 09 31 26 FF 7F 95
    02 75 10 81 02 05 0D 09 30 26 FF 03 95 01 75 10
    81 02 C0 C0 05 01 09 00 A1 01 85 04 A1 00 26 FF
    00 09 00 75 08 95 07 B1 02 C0 C0
    ```

    Signed-off-by: Cristian Klein
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Cristian Klein
     
  • [ Upstream commit 0b66fb3e6b7a53688f8e20945ac78cd3d832c65f ]

    Older compilers like gcc-4.8 don't see that the variable is
    initialized when it is used:

    In file included from include/linux/compiler_types.h:68:0,
    from :0:
    drivers/hid/intel-ish-hid/ishtp-fw-loader.c: In function 'load_fw_from_host':
    include/linux/compiler-gcc.h:75:45: warning: 'fw_info.ldr_capability.max_dma_buf_size' may be used uninitialized in this function [-Wmaybe-uninitialized]
    #define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__)
    ^
    drivers/hid/intel-ish-hid/ishtp-fw-loader.c:770:22: note: 'fw_info.ldr_capability.max_dma_buf_size' was declared here
    struct shim_fw_info fw_info;
    ^

    Make sure to initialize it before returning an error from ish_query_loader_prop().

    Fixes: 91b228107da3 ("HID: intel-ish-hid: ISH firmware loader client driver")
    Signed-off-by: Arnd Bergmann
    Acked-by: Srinivas Pandruvada
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Arnd Bergmann
     

07 Jun, 2020

3 commits

  • commit 6507ef10660efdfee93f0f3b9fac24b5e4d83e56 upstream.

    This device uses the SIPODEV SP1064 touchpad, which does not
    supply descriptors, so it has to be added to the override list.

    Cc: stable@vger.kernel.org
    Signed-off-by: Julian Sax
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    Julian Sax
     
  • commit 40d5bb87377a599d0405af765290f28aaa6abb1e upstream.

    Two touchpad/trackstick combos are currently not behaving properly.
    They define a mouse emulation collection, as per Win8 requirements,
    but also define a separate mouse collection for the trackstick.

    The way the kernel currently treat the collections is that it
    merges both in one device. However, given that the first mouse
    collection already defines X,Y and left, right buttons, when
    mapping the events from the second mouse collection, hid-multitouch
    sees that these events are already mapped, and simply ignores them.

    To be able to report events from the tracktick, add a new quirked
    class for it, and manually add the 2 devices we know about.

    Link: https://bugzilla.kernel.org/show_bug.cgi?id=207235
    Cc: stable@vger.kernel.org
    Tested-by: Kai-Heng Feng
    Signed-off-by: Benjamin Tissoires
    Signed-off-by: Greg Kroah-Hartman

    Benjamin Tissoires
     
  • commit e72455b898ac678667c5674668186b4670d87d11 upstream.

    Fix for non-working buttons on knock-off USB dongles for Sony
    controllers. These USB dongles are used to connect older Sony DA/DS1/DS2
    controllers via USB and are common on Amazon, AliExpress, etc. Without
    the patch, the square, X, and circle buttons do not function. These
    dongles used to work prior to kernel 4.10 but removing the global DS3
    report fixup in commit e19a267b9987 ("HID: sony: DS3 comply to Linux gamepad
    spec") exposed the problem.

    Many people reported the problem on the Ubuntu forums and are working
    around the problem by falling back to the 4.9 hid-sony driver.

    The problem stems from these dongles incorrectly reporting their button
    count as 13 instead of 16. This patch fixes up the report descriptor by
    changing the button report count to 16 and removing 3 padding bits.

    Cc: stable@vger.kernel.org
    Fixes: e19a267b9987 ("HID: sony: DS3 comply to Linux gamepad spec")
    Signed-off-by: Scott Shumate
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    Scott Shumate
     

27 May, 2020

5 commits

  • [ Upstream commit 1e189f267015a098bdcb82cc652d13fbf2203fa0 ]

    Add a HID_QUIRK_NO_INIT_REPORTS quirk for the Dell K12A keyboard-dock,
    which can be used with various Dell Venue 11 models.

    Without this quirk the keyboard/touchpad combo works fine when connected
    at boot, but when hotplugged 9 out of 10 times it will not work properly.
    Adding the quirk fixes this.

    Cc: Mario Limonciello
    Signed-off-by: Hans de Goede
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Hans de Goede
     
  • [ Upstream commit 538f67407e2c0e5ed2a46e7d7ffa52f2e30c7ef8 ]

    On the Dell XPS 9570, the Synaptics SYNA2393 touchpad generates spurious
    interrupts after resuming from suspend until it receives some input or
    is reset. Add it to the quirk I2C_HID_QUIRK_RESET_ON_RESUME so that it
    is reset when resuming from suspend.

    More information about the bug can be found in this mailing list
    discussion: https://www.spinics.net/lists/linux-input/msg59530.html

    Signed-off-by: Daniel Playfair Cal
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Daniel Playfair Cal
     
  • [ Upstream commit 185af3e775b693f773d9a4b5a8c3cda69fc8ca0f ]

    HID_DEVICE_ID_ALPS_1657 PID is too specific, as there are many other
    ALPS hardware IDs using this particular touchpad.

    Rename the identifier to HID_DEVICE_ID_ALPS_U1_UNICORN_LEGACY in order
    to describe reality better.

    Fixes: 640e403b1fd24 ("HID: alps: Add AUI1657 device ID")
    Reported-by: Xiaojian Cao
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Jiri Kosina
     
  • [ Upstream commit 640e403b1fd24e7f31ac6f29f0b6a21d285ed729 ]

    This device is used on Lenovo V130-15IKB variants and uses
    the same registers as U1.

    Signed-off-by: Artem Borisov
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Artem Borisov
     
  • [ Upstream commit f9e82295eec141a0569649d400d249333d74aa91 ]

    Add support for P80H84 touchscreen from eGalaxy:

    idVendor 0x0eef D-WAV Scientific Co., Ltd
    idProduct 0xc002
    iManufacturer 1 eGalax Inc.
    iProduct 2 eGalaxTouch P80H84 2019 vDIVA_1204_T01 k4.02.146

    Signed-off-by: Sebastian Reichel
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Sebastian Reichel
     

14 May, 2020

4 commits

  • commit dcce8ef8f70a8e38e6c47c1bae8b312376c04420 upstream.

    The state of the center button was not reported to userspace for the
    2nd-gen Intuos Pro S when used over Bluetooth due to the pad handling
    code not being updated to support its reduced number of buttons. This
    patch uses the actual number of buttons present on the tablet to
    assemble a button state bitmap.

    Link: https://github.com/linuxwacom/xf86-input-wacom/issues/112
    Fixes: cd47de45b855 ("HID: wacom: Add 2nd gen Intuos Pro Small support")
    Signed-off-by: Jason Gerecke
    Cc: stable@vger.kernel.org # v5.3+
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    Jason Gerecke
     
  • commit 0ed08faded1da03eb3def61502b27f81aef2e615 upstream.

    The syzbot fuzzer discovered a bad race between in the usbhid driver
    between usbhid_stop() and usbhid_close(). In particular,
    usbhid_stop() does:

    usb_free_urb(usbhid->urbin);
    ...
    usbhid->urbin = NULL; /* don't mess up next start */

    and usbhid_close() does:

    usb_kill_urb(usbhid->urbin);

    with no mutual exclusion. If the two routines happen to run
    concurrently so that usb_kill_urb() is called in between the
    usb_free_urb() and the NULL assignment, it will access the
    deallocated urb structure -- a use-after-free bug.

    This patch adds a mutex to the usbhid private structure and uses it to
    enforce mutual exclusion of the usbhid_start(), usbhid_stop(),
    usbhid_open() and usbhid_close() callbacks.

    Reported-and-tested-by: syzbot+7bf5a7b0f0a1f9446f4c@syzkaller.appspotmail.com
    Signed-off-by: Alan Stern
    CC:
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    Alan Stern
     
  • commit b43f977dd281945960c26b3ef67bba0fa07d39d9 upstream.

    This reverts commit 15893fa40109f5e7c67eeb8da62267d0fdf0be9d.

    The referenced commit broke pen and touch input for a variety of devices
    such as the Cintiq Pro 32. Affected devices may appear to work normally
    for a short amount of time, but eventually loose track of actual touch
    state and can leave touch arbitration enabled which prevents the pen
    from working. The commit is not itself required for any currently-available
    Bluetooth device, and so we revert it to correct the behavior of broken
    devices.

    This breakage occurs due to a mismatch between the order of collections
    and the order of usages on some devices. This commit tries to read the
    contact count before processing events, but will fail if the contact
    count does not occur prior to the first logical finger collection. This
    is the case for devices like the Cintiq Pro 32 which place the contact
    count at the very end of the report.

    Without the contact count set, touches will only be partially processed.
    The `wacom_wac_finger_slot` function will not open any slots since the
    number of contacts seen is greater than the expectation of 0, but we will
    still end up calling `input_mt_sync_frame` for each finger anyway. This
    can cause problems for userspace separate from the issue currently taking
    place in the kernel. Only once all of the individual finger collections
    have been processed do we finally get to the enclosing collection which
    contains the contact count. The value ends up being used for the *next*
    report, however.

    This delayed use of the contact count can cause the driver to loose track
    of the actual touch state and believe that there are contacts down when
    there aren't. This leaves touch arbitration enabled and prevents the pen
    from working. It can also cause userspace to incorrectly treat single-
    finger input as gestures.

    Link: https://github.com/linuxwacom/input-wacom/issues/146
    Signed-off-by: Jason Gerecke
    Reviewed-by: Aaron Armstrong Skomra
    Fixes: 15893fa40109 ("HID: wacom: generic: read the number of expected touches on a per collection basis")
    Cc: stable@vger.kernel.org # 5.3+
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    Jason Gerecke
     
  • commit 778fbf4179991e7652e97d7f1ca1f657ef828422 upstream.

    We've recently switched from extracting the value of HID_DG_CONTACTMAX
    at a fixed offset (which may not be correct for all tablets) to
    injecting the report into the driver for the generic codepath to handle.
    Unfortunately, this change was made for *all* tablets, even those which
    aren't generic. Because `wacom_wac_report` ignores reports from non-
    generic devices, the contact count never gets initialized. Ultimately
    this results in the touch device itself failing to probe, and thus the
    loss of touch input.

    This commit adds back the fixed-offset extraction for non-generic devices.

    Link: https://github.com/linuxwacom/input-wacom/issues/155
    Fixes: 184eccd40389 ("HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report")
    Signed-off-by: Jason Gerecke
    Reviewed-by: Aaron Armstrong Skomra
    CC: stable@vger.kernel.org # 5.3+
    Signed-off-by: Benjamin Tissoires
    Cc: Guenter Roeck
    Signed-off-by: Greg Kroah-Hartman

    Jason Gerecke
     

21 Mar, 2020

7 commits

  • commit 819d578d51d0ce73f06e35d69395ef55cd683a74 upstream.

    A lenovo pixart mouse (17ef:608d) is afflicted common the the malfunction
    where it disconnects and reconnects every minute--each time incrementing
    the device number. This patch adds the device id of the device and
    specifies that it needs the HID_QUIRK_ALWAYS_POLL quirk in order to
    work properly.

    Signed-off-by: Tony Fischetti
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    Tony Fischetti
     
  • commit 58322a1590fc189a8e1e349d309637d4a4942840 upstream.

    Add 1 additional hammer-like device.

    Signed-off-by: Chen-Tsung Hsieh
    Reviewed-by: Nicolas Boichat
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    Chen-Tsung Hsieh
     
  • [ Upstream commit 4eb1b01de5b9d8596d6c103efcf1a15cfc1bedf7 ]

    It's possible that there is scheduled work left while the device is
    already being removed, which can cause a kernel crash. Adding a flag
    will avoid this.

    Signed-off-by: Hanno Zulla
    Signed-off-by: Benjamin Tissoires
    Signed-off-by: Sasha Levin

    Hanno Zulla
     
  • [ Upstream commit 976a54d0f4202cb412a3b1fc7f117e1d97db35f3 ]

    It's required to call hid_hw_stop() once hid_hw_start() was called
    previously, so error cases need to handle this. Also, hid_hw_close() is
    not necessary during removal.

    Signed-off-by: Hanno Zulla
    Signed-off-by: Benjamin Tissoires
    Signed-off-by: Sasha Levin

    Hanno Zulla
     
  • [ Upstream commit 789a2c250340666220fa74bc6c8f58497e3863b3 ]

    The struct *bigben was allocated via devm_kzalloc() and then used as a
    parameter in input_ff_create_memless(). This caused a double kfree
    during removal of the device, since both the managed resource API and
    ml_ff_destroy() in drivers/input/ff-memless.c would call kfree() on it.

    Signed-off-by: Hanno Zulla
    Signed-off-by: Benjamin Tissoires
    Signed-off-by: Sasha Levin

    Hanno Zulla
     
  • [ Upstream commit be0aba826c4a6ba5929def1962a90d6127871969 ]

    The Surfbook E11B uses the SIPODEV SP1064 touchpad, which does not supply
    descriptors, so it has to be added to the override list.

    BugLink: https://bugs.launchpad.net/bugs/1858299
    Signed-off-by: Kai-Heng Feng
    Reviewed-by: Hans de Goede
    Signed-off-by: Benjamin Tissoires
    Signed-off-by: Sasha Levin

    Kai-Heng Feng
     
  • [ Upstream commit e433be929e63265b7412478eb7ff271467aee2d7 ]

    Magic Keyboards with more recent firmware (0x0100) report Fn key differently.
    Without this patch, Fn key may not behave as expected and may not be
    configurable via hid_apple fnmode module parameter.

    Signed-off-by: Mansour Behabadi
    Signed-off-by: Jiri Kosina
    Signed-off-by: Sasha Levin

    Mansour Behabadi