18 Mar, 2020

1 commit

  • Pull HID fixes from Jiri Kosina:

    - string buffer formatting fixes in picolcd and sensor drivers, from
    Takashi Iwai

    - two new device IDs from Chen-Tsung Hsieh and Tony Fischetti

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
    HID: add ALWAYS_POLL quirk to lenovo pixart mouse
    HID: google: add moonball USB id
    HID: hid-sensor-custom: Use scnprintf() for avoiding potential buffer overflow
    HID: hid-picolcd_fb: Use scnprintf() for avoiding potential buffer overflow

    Linus Torvalds
     

17 Mar, 2020

1 commit

  • A lenovo pixart mouse (17ef:608d) is afflicted common the the malfunction
    where it disconnects and reconnects every minute--each time incrementing
    the device number. This patch adds the device id of the device and
    specifies that it needs the HID_QUIRK_ALWAYS_POLL quirk in order to
    work properly.

    Signed-off-by: Tony Fischetti
    Signed-off-by: Jiri Kosina

    Tony Fischetti
     

16 Mar, 2020

1 commit


11 Mar, 2020

2 commits


05 Mar, 2020

1 commit

  • Fix below warnings reported by coccicheck:
    drivers/hid/hid-hyperv.c:197:2-7: WARNING: NULL check before some freeing functions is not needed.
    drivers/hid/hid-hyperv.c:211:2-7: WARNING: NULL check before some freeing functions is not needed.

    Signed-off-by: Lucas Tanure
    Reviewed-by: Michael Kelley
    Reviewed-by: Wei Liu
    Acked-by: Benjamin Tissoires
    Signed-off-by: Wei Liu

    Lucas Tanure
     

28 Feb, 2020

1 commit

  • Pull HID subsystem fixes from Jiri Kosina:

    - syzkaller-reported error handling fixes in various drivers, from
    various people

    - increase of HID report buffer size to 8K, which is apparently needed
    by certain modern devices

    - a few new device-ID-specific fixes / quirks

    - battery charging status reporting fix in logitech-hidpp, from Filipe
    Laíns

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
    HID: hid-bigbenff: fix race condition for scheduled work during removal
    HID: hid-bigbenff: call hid_hw_stop() in case of error
    HID: hid-bigbenff: fix general protection fault caused by double kfree
    HID: i2c-hid: add Trekstor Surfbook E11B to descriptor override
    HID: alps: Fix an error handling path in 'alps_input_configured()'
    HID: hiddev: Fix race in in hiddev_disconnect()
    HID: core: increase HID report buffer size to 8KiB
    HID: core: fix off-by-one memset in hid_report_raw_event()
    HID: apple: Add support for recent firmware on Magic Keyboards
    HID: ite: Only bind to keyboard USB interface on Acer SW5-012 keyboard dock
    HID: logitech-hidpp: BatteryVoltage: only read chargeStatus if extPower is active

    Linus Torvalds
     

18 Feb, 2020

3 commits


14 Feb, 2020

1 commit


12 Feb, 2020

4 commits

  • They are issues:
    - if 'input_allocate_device()' fails and return NULL, there is no need
    to free anything and 'input_free_device()' call is a no-op. It can
    be axed.
    - 'ret' is known to be 0 at this point, so we must set it to a
    meaningful value before returning

    Fixes: 2562756dde55 ("HID: add Alps I2C HID Touchpad-Stick support")
    Signed-off-by: Christophe JAILLET
    Signed-off-by: Jiri Kosina

    Christophe JAILLET
     
  • Syzbot reports that "hiddev" is used after it's free in hiddev_disconnect().
    The hiddev_disconnect() function sets "hiddev->exist = 0;" so
    hiddev_release() can free it as soon as we drop the "existancelock"
    lock. This patch moves the mutex_unlock(&hiddev->existancelock) until
    after we have finished using it.

    Reported-by: syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com
    Fixes: 7f77897ef2b6 ("HID: hiddev: fix potential use-after-free")
    Suggested-by: Alan Stern
    Signed-off-by: Dan Carpenter
    Signed-off-by: Jiri Kosina

    dan.carpenter@oracle.com
     
  • In case a report is greater than HID_MAX_BUFFER_SIZE, it is truncated,
    but the report-number byte is not correctly handled. This results in a
    off-by-one in the following memset, causing a kernel Oops and ensuing
    system crash.

    Note: With commit 8ec321e96e05 ("HID: Fix slab-out-of-bounds read in
    hid_field_extract") I no longer hit the kernel Oops as we instead fail
    "controlled" at probe if there is a report too long in the HID
    report-descriptor. hid_report_raw_event() is an exported symbol, so
    presumabely we cannot always rely on this being the case.

    Fixes: 966922f26c7f ("HID: fix a crash in hid_report_raw_event()
    function.")
    Signed-off-by: Johan Korsnes
    Cc: Armando Visconti
    Cc: Jiri Kosina
    Cc: Alan Stern
    Signed-off-by: Jiri Kosina

    Johan Korsnes
     
  • Magic Keyboards with more recent firmware (0x0100) report Fn key differently.
    Without this patch, Fn key may not behave as expected and may not be
    configurable via hid_apple fnmode module parameter.

    Signed-off-by: Mansour Behabadi
    Signed-off-by: Jiri Kosina

    Mansour Behabadi
     

03 Feb, 2020

1 commit

  • Commit 8f18eca9ebc5 ("HID: ite: Add USB id match for Acer SW5-012 keyboard
    dock") added the USB id for the Acer SW5-012's keyboard dock to the
    hid-ite driver to fix the rfkill driver not working.

    Most keyboard docks with an ITE 8595 keyboard/touchpad controller have the
    "Wireless Radio Control" bits which need the special hid-ite driver on the
    second USB interface (the mouse interface) and their touchpad only supports
    mouse emulation, so using generic hid-input handling for anything but
    the "Wireless Radio Control" bits is fine. On these devices we simply bind
    to all USB interfaces.

    But unlike other ITE8595 using keyboard docks, the Acer Aspire Switch 10
    (SW5-012)'s touchpad not only does mouse emulation it also supports
    HID-multitouch and all the keys including the "Wireless Radio Control"
    bits have been moved to the first USB interface (the keyboard intf).

    So we need hid-ite to handle the first (keyboard) USB interface and have
    it NOT bind to the second (mouse) USB interface so that that can be
    handled by hid-multitouch.c and we get proper multi-touch support.

    This commit changes the hid_device_id for the SW5-012 keyboard dock to
    only match on hid devices from the HID_GROUP_GENERIC group, this way
    hid-ite will not bind the the mouse/multi-touch interface which has
    HID_GROUP_MULTITOUCH_WIN_8 as group.
    This fixes the regression to mouse-emulation mode introduced by adding
    the keyboard dock USB id.

    Cc: stable@vger.kernel.org
    Fixes: 8f18eca9ebc5 ("HID: ite: Add USB id match for Acer SW5-012 keyboard dock")
    Reported-by: Zdeněk Rampas
    Signed-off-by: Hans de Goede
    Signed-off-by: Benjamin Tissoires

    Hans de Goede
     

31 Jan, 2020

1 commit

  • Pull drm updates from Davbe Airlie:
    "This is the main pull request for graphics for 5.6. Usual selection of
    changes all over.

    I've got one outstanding vmwgfx pull that touches mm so kept it
    separate until after all of this lands. I'll try and get it to you
    soon after this, but it might be early next week (nothing wrong with
    code, just my schedule is messy)

    This also hits a lot of fbdev drivers with some cleanups.

    Other notables:
    - vulkan timeline semaphore support added to syncobjs
    - nouveau turing secureboot/graphics support
    - Displayport MST display stream compression support

    Detailed summary:

    uapi:
    - dma-buf heaps added (and fixed)
    - command line add support for panel oreientation
    - command line allow overriding penguin count

    drm:
    - mipi dsi definition updates
    - lockdep annotations for dma_resv
    - remove dma-buf kmap/kunmap support
    - constify fb_ops in all fbdev drivers
    - MST fix for daisy chained hotplug-
    - CTA-861-G modes with VIC >= 193 added
    - fix drm_panel_of_backlight export
    - LVDS decoder support
    - more device based logging support
    - scanline alighment for dumb buffers
    - MST DSC helpers

    scheduler:
    - documentation fixes
    - job distribution improvements

    panel:
    - Logic PD type 28 panel support
    - Jimax8729d MIPI-DSI
    - igenic JZ4770
    - generic DSI devicetree bindings
    - sony acx424AKP panel
    - Leadtek LTK500HD1829
    - xinpeng XPP055C272
    - AUO B116XAK01
    - GiantPlus GPM940B0
    - BOE NV140FHM-N49
    - Satoz SAT050AT40H12R2
    - Sharp LS020B1DD01D panels.

    ttm:
    - use blocking WW lock

    i915:
    - hw/uapi state separation
    - Lock annotation improvements
    - selftest improvements
    - ICL/TGL DSI VDSC support
    - VBT parsing improvments
    - Display refactoring
    - DSI updates + fixes
    - HDCP 2.2 for CFL
    - CML PCI ID fixes
    - GLK+ fbc fix
    - PSR fixes
    - GEN/GT refactor improvments
    - DP MST fixes
    - switch context id alloc to xarray
    - workaround updates
    - LMEM debugfs support
    - tiled monitor fixes
    - ICL+ clock gating programming removed
    - DP MST disable sequence fixed
    - LMEM discontiguous object maps
    - prefaulting for discontiguous objects
    - use LMEM for dumb buffers if possible
    - add LMEM mmap support

    amdgpu:
    - enable sync object timelines for vulkan
    - MST atomic routines
    - enable MST DSC support
    - add DMCUB display microengine support
    - DC OEM i2c support
    - Renoir DC fixes
    - Initial HDCP 2.x support
    - BACO support for Arcturus
    - Use BACO for runtime PM power save
    - gfxoff on navi10
    - gfx10 golden updates and fixes
    - DCN support on POWER
    - GFXOFF for raven1 refresh
    - MM engine idle handlers cleanup
    - 10bpc EDP panel fixes
    - renoir watermark fixes
    - SR-IOV fixes
    - Arcturus VCN fixes
    - GDDR6 training fixes
    - freesync fixes
    - Pollock support

    amdkfd:
    - unify more codepath with amdgpu
    - use KIQ to setup HIQ rather than MMIO

    radeon:
    - fix vma fault handler race
    - PPC DMA fix
    - register check fixes for r100/r200

    nouveau:
    - mmap_sem vs dma_resv fix
    - rewrite the ACR secure boot code for Turing
    - TU10x graphics engine support (TU11x pending)
    - Page kind mapping for turing
    - 10-bit LUT support
    - GP10B Tegra fixes
    - HD audio regression fix

    hisilicon/hibmc:
    - use generic fbdev code and helpers

    rockchip:
    - dsi/px30 support

    virtio:
    - fb damage support
    - static some functions

    vc4:
    - use dma_resv lock wrappers

    msm:
    - use dma_resv lock wrappers
    - sc7180 display + DSI support
    - a618 support
    - UBWC support improvements

    vmwgfx:
    - updates + new logging uapi

    exynos:
    - enable/disable callback cleanups

    etnaviv:
    - use dma_resv lock wrappers

    atmel-hlcdc:
    - clock fixes

    mediatek:
    - cmdq support
    - non-smooth cursor fixes
    - ctm property support

    sun4i:
    - suspend support
    - A64 mipi dsi support

    rcar-du:
    - Color management module support
    - LVDS encoder dual-link support
    - R8A77980 support

    analogic:
    - add support for an6345

    ast:
    - atomic modeset support
    - primary plane garbage fix

    arcgpu:
    - fixes for fourcc handling

    tegra:
    - minor fixes and improvments

    mcde:
    - vblank support

    meson:
    - OSD1 plane AFBC commit

    gma500:
    - add pageflip support
    - reomve global drm_dev

    komeda:
    - tweak debugfs output
    - d32 support
    - runtime PM suppotr

    udl:
    - use generic shmem helpers
    - cleanup and fixes"

    * tag 'drm-next-2020-01-30' of git://anongit.freedesktop.org/drm/drm: (1998 commits)
    drm/nouveau/fb/gp102-: allow module to load even when scrubber binary is missing
    drm/nouveau/acr: return error when registering LSF if ACR not supported
    drm/nouveau/disp/gv100-: not all channel types support reporting error codes
    drm/nouveau/disp/nv50-: prevent oops when no channel method map provided
    drm/nouveau: support synchronous pushbuf submission
    drm/nouveau: signal pending fences when channel has been killed
    drm/nouveau: reject attempts to submit to dead channels
    drm/nouveau: zero vma pointer even if we only unreference it rather than free
    drm/nouveau: Add HD-audio component notifier support
    drm/nouveau: fix build error without CONFIG_IOMMU_API
    drm/nouveau/kms/nv04: remove set but not used variable 'width'
    drm/nouveau/kms/nv50: remove set but not unused variable 'nv_connector'
    drm/nouveau/mmu: fix comptag memory leak
    drm/nouveau/gr/gp10b: Use gp100_grctx and gp100_gr_zbc
    drm/nouveau/pmu/gm20b,gp10b: Fix Falcon bootstrapping
    drm/exynos: Rename Exynos to lowercase
    drm/exynos: change callback names
    drm/mst: Don't do atomic checks over disabled managers
    drm/amdgpu: add the lost mutex_init back
    drm/amd/display: skip opp blank or unblank if test pattern enabled
    ...

    Linus Torvalds
     

28 Jan, 2020

1 commit

  • In the HID++ 2.0 function getBatteryInfo() from the BatteryVoltage
    (0x1001) feature, chargeStatus is only valid if extPower is active.

    Previously we were ignoring extPower, which resulted in wrong values.

    Example:
    With an unplugged mouse

    $ cat /sys/class/power_supply/hidpp_battery_0/status
    Charging

    This patch fixes that, it also renames charge_sts to flags as
    charge_sts can be confused with chargeStatus from the spec.

    Spec:
    +--------+-------------------------------------------------------------------------+
    | byte | 2 |
    +--------+--------------+------------+------------+----------+----------+----------+
    | bit | 0..2 | 3 | 4 | 5 | 6 | 7 |
    +--------+--------------+------------+------------+----------+----------+----------+
    | buffer | chargeStatus | fastCharge | slowCharge | critical | (unused) | extPower |
    +--------+--------------+------------+------------+----------+----------+----------+
    Table 1 - battery voltage (0x1001), getBatteryInfo() (ASE 0), 3rd byte

    +-------+--------------------------------------+
    | value | meaning |
    +-------+--------------------------------------+
    | 0 | Charging |
    +-------+--------------------------------------+
    | 1 | End of charge (100% charged) |
    +-------+--------------------------------------+
    | 2 | Charge stopped (any "normal" reason) |
    +-------+--------------------------------------+
    | 7 | Hardware error |
    +-------+--------------------------------------+
    Table 2 - chargeStatus value

    Signed-off-by: Filipe Laíns
    Tested-by: Pedro Vanzella
    Reviewed-by: Pedro Vanzella
    Signed-off-by: Benjamin Tissoires

    Filipe Laíns
     

27 Jan, 2020

2 commits


20 Jan, 2020

1 commit


13 Jan, 2020

1 commit


10 Jan, 2020

1 commit

  • hidraw and uhid device nodes are always available for writing so we should
    always report EPOLLOUT and EPOLLWRNORM bits, not only in the cases when
    there is nothing to read.

    Reported-by: Linus Torvalds
    Fixes: be54e7461ffdc ("HID: uhid: Fix returning EPOLLOUT from uhid_char_poll")
    Fixes: 9f3b61dc1dd7b ("HID: hidraw: Fix returning EPOLLOUT from hidraw_poll")
    Signed-off-by: Jiri Kosina

    Jiri Kosina
     

09 Jan, 2020

1 commit

  • The `connected` value for wired devices was not properly initialized,
    it must be set to `true` upon creation, because wired devices do not
    generate connection events.

    When a raw client (the Steam Client) uses the device, the input device
    is destroyed. Then, when the raw client finishes, it must be recreated.
    But since the `connected` variable was false this never happended.

    Signed-off-by: Rodrigo Rivas Costa
    Signed-off-by: Jiri Kosina

    Rodrigo Rivas Costa
     

30 Dec, 2019

1 commit


19 Dec, 2019

1 commit

  • 1002 if ((quirks & MT_QUIRK_IGNORE_DUPLICATES) && mt) {
    1003 struct input_mt_slot *i_slot = &mt->slots[slotnum];
    1004
    1005 if (input_mt_is_active(i_slot) &&
    1006 input_mt_is_used(mt, i_slot))
    1007 return -EAGAIN;
    1008 }

    We previously assumed 'mt' could be null (see line 1002).

    The following situation is similar, so add a judgement.

    Signed-off-by: Pan Zhang
    Signed-off-by: Benjamin Tissoires

    Pan Zhang
     

18 Dec, 2019

7 commits

  • Newer Logitech mice report their battery voltage through feature 0x1001
    instead of the battery levels through feature 0x1000.

    When the device is brought up and we try to query the battery, figure
    out if it supports the old or the new feature. If it supports the new
    feature, record the feature index and read the battery voltage and
    its charge status. The device will respond with three bytes: the first
    two are its voltage, and the last one is a bitset, reporting if the
    battery is charging, fast or slow, in critical level or discharging.

    If everything went correctly, record the fact that we're capable
    of querying battery voltage.

    Note that the protocol only gives us the current voltage in mV.
    We store that as-is, but when queried, we report it in uV as
    expected by sysfs.

    Like we do for other ways of interacting with the battery for other
    devices, refresh the battery status and notify the power supply
    subsystem of the changes in voltage and status.

    Since there are no known devices which implement both the old and the
    new battery feature, we make sure to try the newer feature first and
    only fall back to the old one if that fails.

    Signed-off-by: Pedro Vanzella
    Signed-off-by: Benjamin Tissoires

    Pedro Vanzella
     
  • This patch adds support for the Logitech MX Master 3 Mouse using the
    Logitech Unifying Receiver and Bluetooth LE.

    Signed-off-by: Adrian Freund
    Signed-off-by: Benjamin Tissoires

    Adrian Freund
     
  • This patch allows hidpp_report_is_connect_event to support
    WirelessDeviceStatus connect events.

    The WirelessDeviceStatus feature index is stored in hidpp_device when
    probed. The connect event's fap feature_index is compared against it if the
    device supports it.

    Signed-off-by: Mazin Rezk
    Signed-off-by: Benjamin Tissoires

    Mazin Rezk
     
  • This patch allows short reports to be translated into long reports.

    hidpp_validate_device now returns a u8 instead of a bool which represents
    the supported reports. The corresponding bits (i.e.
    HIDPP_REPORT_*_SUPPORTED) are set if an HID++ report is supported.

    If a short report is being sent and the device does not support it, it is
    instead sent as a long report.

    This patch also introduces support for the MX Master (b01e and b012).

    Signed-off-by: Mazin Rezk
    Signed-off-by: Benjamin Tissoires

    Mazin Rezk
     
  • A new PID is in use for repaired MobileStudio Pro devices. Add it to the
    list of devices that need special-casing in wacom_wac_pad_event.

    Signed-off-by: Jason Gerecke
    Signed-off-by: Benjamin Tissoires

    Jason Gerecke
     
  • Add Comet Lake H into ishtp support list.

    Signed-off-by: Even Xu
    Acked-by: Srinivas Pandruvada
    Signed-off-by: Benjamin Tissoires

    Even Xu
     
  • The open method of hiddev handler fails to bring the device out of
    autosuspend state as was promised in 0361a28d3f9a, as it actually has 2
    blocks that try to start the transport (call hid_hw_open()) with both
    being guarded by the "open" counter, so the 2nd block is never executed as
    the first block increments the counter so it is never at 0 when we check
    it for the second block.

    Additionally hiddev_open() was leaving counter incremented on errors,
    causing the device to never be reopened properly if there was ever an
    error.

    Let's fix all of this by factoring out code that creates client structure
    and powers up the device into a separate function that is being called
    from usbhid_open() with the "existancelock" being held.

    Fixes: 0361a28d3f9a ("HID: autosuspend support for USB HID")
    Signed-off-by: Dmitry Torokhov
    Signed-off-by: Benjamin Tissoires

    Dmitry Torokhov
     

17 Dec, 2019

1 commit

  • drm-misc-next for v5.6:

    UAPI Changes:
    - Add support for DMA-BUF HEAPS.

    Cross-subsystem Changes:
    - mipi dsi definition updates, pulled into drm-intel as well.
    - Add lockdep annotations for dma_resv vs mmap_sem and fs_reclaim.
    - Remove support for dma-buf kmap/kunmap.
    - Constify fb_ops in all fbdev drivers, including drm drivers and drm-core, and media as well.

    Core Changes:
    - Small cleanups to ttm.
    - Fix SCDC definition.
    - Assorted cleanups to core.
    - Add todo to remove load/unload hooks, and use generic fbdev emulation.
    - Assorted documentation updates.
    - Use blocking ww lock in ttm fault handler.
    - Remove drm_fb_helper_fbdev_setup/teardown.
    - Warning fixes with W=1 for atomic.
    - Use drm_debug_enabled() instead of drm_debug flag testing in various drivers.
    - Fallback to nontiled mode in fbdev emulation when not all tiles are present. (Later on reverted)
    - Various kconfig indentation fixes in core and drivers.
    - Fix freeing transactions in dp-mst correctly.
    - Sean Paul is steping down as core maintainer. :-(
    - Add lockdep annotations for atomic locks vs dma-resv.
    - Prevent use-after-free for a bad job in drm_scheduler.
    - Fill out all block sizes in the P01x and P210 definitions.
    - Avoid division by zero in drm/rect, and fix bounds.
    - Add drm/rect selftests.
    - Add aspect ratio and alternate clocks for HDMI 4k modes.
    - Add todo for drm_framebuffer_funcs and fb_create cleanup.
    - Drop DRM_AUTH for prime import/export ioctls.
    - Clear DP-MST payload id tables downstream when initializating.
    - Fix for DSC throughput definition.
    - Add extra FEC definitions.
    - Fix fake offset in drm_gem_object_funs.mmap.
    - Stop using encoder->bridge in core directly
    - Handle bridge chaining slightly better.
    - Add backlight support to drm/panel, and use it in many panel drivers.
    - Increase max number of y420 modes from 128 to 256, as preparation to add the new modes.

    Driver Changes:
    - Small fixes all over.
    - Fix documentation in vkms.
    - Fix mmap_sem vs dma_resv in nouveau.
    - Small cleanup in komeda.
    - Add page flip support in gma500 for psb/cdv.
    - Add ddc symlink in the connector sysfs directory for many drivers.
    - Add support for analogic an6345, and fix small bugs in it.
    - Add atomic modesetting support to ast.
    - Fix radeon fault handler VMA race.
    - Switch udl to use generic shmem helpers.
    - Unconditional vblank handling for mcde.
    - Miscellaneous fixes to mcde.
    - Tweak debug output from komeda using debugfs.
    - Add gamma and color transform support to komeda for DOU-IPS.
    - Add support for sony acx424AKP panel.
    - Various small cleanups to gma500.
    - Use generic fbdev emulation in udl, and replace udl_framebuffer with generic implementation.
    - Add support for Logic PD Type 28 panel.
    - Use drm_panel_* wrapper functions in exynos/tegra/msm.
    - Add devicetree bindings for generic DSI panels.
    - Don't include drm_pci.h directly in many drivers.
    - Add support for begin/end_cpu_access in udmabuf.
    - Stop using drm_get_pci_dev in gma500 and mga200.
    - Fixes to UDL damage handling, and use dma_buf_begin/end_cpu_access.
    - Add devfreq thermal support to panfrost.
    - Fix hotplug with daisy chained monitors by removing VCPI when disabling topology manager.
    - meson: Add support for OSD1 plane AFBC commit.
    - Stop displaying garbage when toggling ast primary plane on/off.
    - More cleanups and fixes to UDL.
    - Add D32 suport to komeda.
    - Remove globle copy of drm_dev in gma500.
    - Add support for Boe Himax8279d MIPI-DSI LCD panel.
    - Add support for ingenic JZ4770 panel.
    - Small null pointer deference fix in ingenic.
    - Remove support for the special tfp420 driver, as there is a generic way to do it.

    Signed-off-by: Daniel Vetter

    From: Maarten Lankhorst
    Link: https://patchwork.freedesktop.org/patch/msgid/ba73535a-9334-5302-2e1f-5208bd7390bd@linux.intel.com

    Daniel Vetter
     

13 Dec, 2019

5 commits

  • We should not be leaving half-mapped usages with potentially invalid
    keycodes, as that may confuse hidinput_find_key() when the key is located
    by index, which may end up feeding way too large keycode into the VT
    keyboard handler and cause OOB write there:

    BUG: KASAN: global-out-of-bounds in clear_bit include/asm-generic/bitops-instrumented.h:56 [inline]
    BUG: KASAN: global-out-of-bounds in kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline]
    BUG: KASAN: global-out-of-bounds in kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495
    Write of size 8 at addr ffffffff89a1b2d8 by task syz-executor108/1722
    ...
    kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline]
    kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495
    input_to_handler+0x3b6/0x4c0 drivers/input/input.c:118
    input_pass_values.part.0+0x2e3/0x720 drivers/input/input.c:145
    input_pass_values drivers/input/input.c:949 [inline]
    input_set_keycode+0x290/0x320 drivers/input/input.c:954
    evdev_handle_set_keycode_v2+0xc4/0x120 drivers/input/evdev.c:882
    evdev_do_ioctl drivers/input/evdev.c:1150 [inline]

    Cc: stable@vger.kernel.org
    Reported-by: syzbot+19340dff067c2d3835c0@syzkaller.appspotmail.com
    Signed-off-by: Dmitry Torokhov
    Tested-by: Benjamin Tissoires
    Signed-off-by: Jiri Kosina

    Dmitry Torokhov
     
  • Apply it to the Lenovo Y720 gaming laptop I2C peripheral then.

    This fixes dmesg being flooded with errors visible on un-suspend
    in Linux Mint 19 Cinnamon.

    Example of error log:

    [ 4.326588] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4)
    [ 4.326845] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4)
    [ 4.327095] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4)
    [ 4.327341] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4)
    [ 4.327609] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4)

    Example of fixed log (debug on)

    [ 3731.333183] i2c_hid i2c-ITE33D1:00: input: 02 00
    [ 3731.333581] i2c_hid i2c-ITE33D1:00: input: 02 00
    [ 3731.333842] i2c_hid i2c-ITE33D1:00: input: 02 00
    [ 3731.334107] i2c_hid i2c-ITE33D1:00: input: 02 00
    [ 3731.334367] i2c_hid i2c-ITE33D1:00: input: 02 00

    [jkosina@suse.cz: rebase onto more recent codebase]
    Signed-off-by: Pavel Balan
    Signed-off-by: Jiri Kosina

    Pavel Balan
     
  • At least on a T100HA an Asus vendor-page usage-code 0xff event is send on
    every suspend and again on resume, resulting in the following warning:

    asus 0003:0B05:1807.0002: Unmapped Asus vendor usagepage code 0xff

    being logged twice on every suspend/resume.

    This commit silences the "Unmapped Asus vendor usagepage code ..."
    warning for usage-code 0xff to avoid these warnings being logged.

    Signed-off-by: Hans de Goede
    Signed-off-by: Jiri Kosina

    Hans de Goede
     
  • The Acer SW5-012 2-in-1 keyboard dock uses a Synaptics S91028 touchpad
    which is connected to an ITE 8595 USB keyboard controller chip.

    This keyboard has the same quirk for its rfkill / airplane mode hotkey as
    other keyboards with the ITE 8595 chip, it only sends a single release
    event when pressed and released, it never sends a press event.

    This commit adds this keyboards USB id to the hid-ite id-table, fixing
    the rfkill key not working on this keyboard.

    Signed-off-by: Hans de Goede
    Signed-off-by: Jiri Kosina

    Hans de Goede
     
  • Without the quirk, joystick shows up as single controller
    for both first and second player pads/pins.

    Signed-off-by: Priit Laes
    Signed-off-by: Jiri Kosina

    Priit Laes
     

11 Dec, 2019

1 commit