Pull HID fixes from Jiri Kosina:
- fixes for a couple potential memory corruption problems (the HW would
have to be manufactured to be deliberately evil to trigger those)
found by Ben Hawkes
- fix for potential infinite loop when using sysfs interface of
logitech driver, from Simon Wood
- a couple more simple driver fixes
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: fix a couple of off-by-ones
HID: logitech: perform bounds checking on device_id early enough
HID: logitech: fix bounds checking on LED report size
HID: logitech: Prevent possibility of infinite loop when using /sys interface
HID: rmi: print an error if F11 is not found instead of stopping the device
HID: hid-sensor-hub: use devm_ functions consistently
HID: huion: Use allocated buffer for DMA
HID: huion: Fail on parameter retrieval errors
device_index is a char type and the size of paired_dj_deivces is 7
elements, therefore proper bounds checking has to be applied to
device_index before it is used.
We are currently performing the bounds checking in
logi_dj_recv_add_djhid_device(), which is too late, as malicious device
could send REPORT_TYPE_NOTIF_DEVICE_UNPAIRED early enough and trigger the
problem in one of the report forwarding functions called from
logi_dj_raw_event().
Fix this by performing the check at the earliest possible ocasion in
logi_dj_raw_event().
Cc: stable@vger.kernel.org
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The check on report size for REPORT_TYPE_LEDS in logi_dj_ll_raw_request()
is wrong; the current check doesn't make any sense -- the report allocated
by HID core in hid_hw_raw_request() can be much larger than
DJREPORT_SHORT_LENGTH, and currently logi_dj_ll_raw_request() doesn't
handle this properly at all.
Fix the check by actually trimming down the report size properly if it is
too large.
Cc: stable@vger.kernel.org
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Pull input layer fixes from Dmitry Torokhov:
"Second round of updates for the input subsystem. Mostly small fixups
to the code merged in the first round (atmel_mxt_ts, wacom) but also a
smallish patch to xbox driver to support Xbox One controllers and a
patch to better handle Synaptics profile sensors found in Cr-48
Chromebooks that should not affect any other devices"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: edt-ft5x06 - remove superfluous assignment
Input: xpad - add support for Xbox One controllers
Input: atmel_mxt_ts - fix a few issues reported by Coverity
Input: atmel_mxt_ts - split config update a bit
Input: atmel_mxt_ts - simplify mxt_initialize a bit
Input: joystick - use get_cycles on ARMv8
Input: wacom - fix compiler warning if !CONFIG_PM
Input: cap1106 - allow changing key mapping from userspace
Input: synaptics - use firmware data for Cr-48
Input: synaptics - properly initialize slots for semi-MT
Input: MT - make slot cleanup callable outside mt_sync_frame()
Input: atmel_mxt_ts - mXT224 DMA quirk was fixed in firmware v2.0.AA
If the device data is not accessible for some reason, returning 0 will cause the call to be
continuously called again as none of the string has been 'consumed'.
Signed-off-by: Simon Wood <simon@mungewell.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Currently rmi_probe will return -EIO if the device doesn't report that it has F11.
This would indicate that something happened and the device is in the bootloader.
We can recover the device using a userspace firmware update tool, but it needs
access to the device through the hidraw device file. If the probe returns -EIO
the hidraw device won't be created. So instead of failing the probe, just print
an error message, but leave the device accessible from userspace.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
If CONFIG_PM is not set:
drivers/hid/wacom_sys.c:1436: warning: ‘wacom_reset_resume’ defined but
not used
Protect the unused functions by #ifdef CONFIG_PM to fix this.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Use devm_kzalloc for all calls to kzalloc and not just the first. Use
devm functions for other allocations as well. The calls to free the
allocated memory in the probe and remove functions are done away with
and a label is removed in the probe function.
The semantic match that finds the inconsistency is as follows:
// <smpl>
@@
@@
*devm_kzalloc(...)
...
*kzalloc(...)
// </smpl>
Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Reviewed-by: Srinivas Pandruvada <srinivas.pandruvada@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Allocate a buffer with kmalloc for receiving the parameters string
descriptor with usb_control_msg, instead of using a buffer on the stack,
as the latter is unsafe. Use an enum for indices into the buffer to
ensure the buffer size if sufficient.
This fixes the static checker error "doing dma on the stack (buf)".
Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Fail Huion tablet interface enabling and probing, if parameter retrieval
fails. Move the main code path out of the else block accordingly.
This should prevent devices appearing in a half-working state due to
original report descriptor being used, simplifying diagnostics. This
also makes it easier to add cleanup in later commits, as error handling
is simplified.
Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Pull input updates from Dmitry Torokhov:
- big update to Wacom driver by Benjamin Tissoires, converting it to
HID infrastructure and unifying USB and Bluetooth models
- large update to ALPS driver by Hans de Goede, which adds support for
newer touchpad models as well as cleans up and restructures the code
- more changes to Atmel MXT driver, including device tree support
- new driver for iPaq x3xxx touchscreen
- driver for serial Wacom tablets
- driver for Microchip's CAP1106
- assorted cleanups and improvements to existing drover and input core
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (93 commits)
Input: wacom - update the ABI doc according to latest changes
Input: wacom - only register once the MODULE_* macros
Input: HID - remove hid-wacom Bluetooth driver
Input: wacom - add copyright note and bump version to 2.0
Input: wacom - remove passing id for wacom_set_report
Input: wacom - check for bluetooth protocol while setting OLEDs
Input: wacom - handle Intuos 4 BT in wacom.ko
Input: wacom - handle Graphire BT tablets in wacom.ko
Input: wacom - prepare the driver to include BT devices
Input: hyperv-keyboard - register as a wakeup source
Input: imx_keypad - remove ifdef round PM methods
Input: jornada720_ts - get rid of space indentation and use tab
Input: jornada720_ts - switch to using managed resources
Input: alps - Rushmore and v7 resolution support
Input: mcs5000_ts - remove ifdef around power management methods
Input: mcs5000_ts - protect PM functions with CONFIG_PM_SLEEP
Input: ads7846 - release resources on failure for clean exit
Input: wacom - add support for 0x12C ISDv4 sensor
Input: atmel_mxt_ts - use deep sleep mode when stopped
ARM: dts: am437x-gp-evm: Update binding for touchscreen size
...
Pull HID updates from Jiri Kosina:
"Some highlights:
- hid-sony improvements of Sixaxis device support by Antonio Ospite
- hid-hyperv driven devices can now be used as wakeup source, by
Dexuan Cui
- hid-lenovo driver is now more generic and supports more devices, by
Jamie Lentin
- hid-huion now supports wider range of tablets, by Nikolai
Kondrashov
- other various unsorted fixes and device ID additions"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (30 commits)
HID: hyperv: register as a wakeup source
HID: sony: Default initialize all elements of the LED max_brightness array to 1
HID: huion: Fix sparse warnings
HID: usbhid: Use flag HID_DISCONNECTED when a usb device is removed
HID: ignore jabra gn9350e
HID: cp2112: add I2C mode
HID: use multi input quirk for 22b9:2968
HID: rmi: only bind the hid-rmi driver to the mouse interface of composite USB devices
HID: rmi: check that report ids exist in the report_id_hash before accessing their size
HID: lenovo: Add support for Compact (BT|USB) keyboard
HID: lenovo: Don't call function in condition, show error codes
HID: lenovo: Prepare support for adding other devices
HID: lenovo: Rename hid-lenovo-tpkbd to hid-lenovo
HID: huion: Handle tablets with UC-Logic vendor ID
HID: huion: Switch to generating report descriptor
HID: huion: Don't ignore other interfaces
HID: huion: Use "tablet" instead of specific model
HID: add quirk for 0x04d9:0xa096 device
HID: i2c-hid: call the hid driver's suspend and resume callbacks
HID: rmi: change logging level of log messages related to unexpected reports
...
Putting the various MODULE_* makes them appear several times in modinfo
because wacom.h is used both in wacom_sys.c and wacom_wac.h.
Having the macros near the module declaration makes them appear only once.
Add also MODULE_VERSION(DRIVER_VERSION) to export the current version
number.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Every call of wacom_set_report was passing "id" as a separate parameter
and buffer also passed the same information. We can use first u8 of the
buffer instead of "id"
Signed-off-by: Przemo Firszt <przemo@firszt.eu>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: Ping Cheng <pingc@wacom.com>
Tested-by: Przemo Firszt <przemo@firszt.eu>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Bluetooth Intuos 4 use 1-bit definition while the USB ones use a 4-bits
definition. This changes the size of the raw image we receive, and thus
the kernel will only accept 1-bit images for Bluetooth and 4-bits for
USB.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Przemo Firszt <przemo@firszt.eu>
Reviewed-by: Ping Cheng <pingc@wacom.com>
Tested-by: Przemo Firszt <przemo@firszt.eu>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
A good point of this change is that now, the Intuos4 bluetooth can handle
the different tools (artpen, airbrush, mice), and we get a common interface
between USB and BT for accessing the LEDs/OLEDs.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: Ping Cheng <pingc@wacom.com>
Tested-by: Przemo Firszt <przemo@firszt.eu>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Now that wacom is a hid driver, there is no point in having a separate
driver for bluetooth devices. This patch prepares the common paths of
Bluetooth devices in the common wacom driver. It also adds the sysfs file
"speed" used by Bluetooth devices.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: Ping Cheng <pingc@wacom.com>
Tested-by: Przemo Firszt <przemo@firszt.eu>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
