commit 950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d upstream.
The ati_remote2 driver expects at least two interfaces with one
endpoint each. If given malicious descriptor that specify one
interface or no endpoints, it will crash in the probe function.
Ensure there is at least two interfaces and one endpoint for each
interface before using it.
The full disclosure: http://seclists.org/bugtraq/2016/Mar/90
Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9c6ba456711687b794dcf285856fc14e2c76074f upstream.
The powermate driver expects at least one valid USB endpoint in its
probe function. If given malicious descriptors that specify 0 for
the number of endpoints, it will crash. Validate the number of
endpoints on the interface before using them.
The full report for this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/85
Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d4f1b06d685d11ebdaccf11c0db1cb3c78736862 upstream.
We should set device's capabilities first, and then register it,
otherwise various handlers already present in the kernel will not be
able to connect to the device.
Reported-by: Lauri Kasanen <cand@gmx.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit dd0d0d4de582a6a61c032332c91f4f4cb2bab569 upstream.
Without i8042.nomux=1 the Elantech touch pad is not working at all on
a Fujitsu Lifebook U745. This patch does not seem necessary for all
U745 (maybe because of different BIOS versions?). However, it was
verified that the patch does not break those (see opensuse bug 883192:
https://bugzilla.opensuse.org/show_bug.cgi?id=883192).
Signed-off-by: Aurélien Francillon <aurelien@francillon.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6544a1df11c48c8413071aac3316792e4678fbfb upstream.
When using a protocol v2 or v3 hardware, elantech uses the function
elantech_report_semi_mt_data() to report data. This devices are rather
creepy because if num_finger is 3, (x2,y2) is (0,0). Yes, only one valid
touch is reported.
Anyway, userspace (libinput) is now confused by these (0,0) touches,
and detect them as palm, and rejects them.
Commit 3c0213d17a ("Input: elantech - fix semi-mt protocol for v3 HW")
was sufficient enough for xf86-input-synaptics and libinput before it has
palm rejection. Now we need to actually tell libinput that this device is
a semi-mt one and it should not rely on the actual values of the 2 touches.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When sending "SLEEP" command to the controller it ceases scanning
completely and is unable to wake the system up from sleep, so if it is
configured as a wakeup source we should simply configure interrupt for
wakeup and rely on idle logic within the controller to reduce power
consumption while it is not used.
Signed-off-by: James Chen <james.chen@emc.com.tw>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Previously the "vendor" and "product" IDs for the elan_i2c driver simply
reported 0000. This patch modifies the elan_i2c driver to include the
Elan vendor ID and the touchpad's product id under
input/input*/{vendor,product}.
Specifically, this is to allow us to apply a generic Elan gestures config
that will apply to all Elan touchpads on ChromeOS. These configs match to
input devices in various ways, but one major way is by matching on vendor
ID. Adding this patch allows the default Elan touchpad config to be
applied to Elan touchpads in this kernel by matching on devices that have
vendor ID 04f3.
Note that product ID is also available via custom sysfs entry "product_id"
as well.
Signed-off-by: Charlie Mooney <charliemooney@chromium.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The Atmel maxtouch DT binding documents that the compatible string for
the device is "atmel,maxtouch" and the I2C core always reports a module
alias of the form i2c:alias where alias is the compatible string model:
$ grep MODALIAS /sys/devices/platform/12e00000.i2c/i2c-8/8-004b/uevent
MODALIAS=i2c:maxtouch
But there isn't maxtouch entry in the I2C device ID table so when the
i2c:maxtouch MODALIAS uevent is reported, kmod is not able to match the
alias with a module to load:
$ modinfo atmel_mxt_ts | grep alias
alias: of:N*T*Catmel,maxtouch
alias: i2c:mXT224
alias: i2c:atmel_mxt_tp
alias: i2c:atmel_mxt_ts
alias: i2c:qt602240_ts
So add the maxtouch entry to the I2C device ID table to allow the module
to be autoloaded when the device is registered via OF.
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
A small copy and paste error was preventing the haptics device being
disabled. This patch corrects the value written on disable.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The aiptek driver crashes in aiptek_probe() when a specially crafted USB
device without endpoints is detected. This fix adds a check that the device
has proper configuration expected by the driver. Also an error return value
is changed to more matching one in one of the error paths.
Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Apparently people are installing generic Linux distributions not only on
Pixels but also on other Chromebooks. Unfortunately on all of them Atmel
parts assigned names ATML0000 and ATML0001, and do not carry any other
configuration data. So let's create generic instance of platform data that
should cover most of them (we assume that they will not be using T100
objects, since with those Google mapped BTN_LEFT onto a different GPIO, so
slightly different keymap would be needed, but I think we used parts with
T100 on ARM devices where we thankfully have DTS and can describe the
devices better).
Tested-by: Rich K <rgkirch@gmail.com>
Reviewed-by: Javier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
parkbd_parport_cb is a local uninitialized structure and the member
function pointers will be pointing to arbitrary locations unless they
are cleared.
Fixes: 33ca8ab97c ("Input: parkbd - use parallel port device model")
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
walkera0701_parport_cb is a local uninitialized structure and the member
function pointers will be pointing to arbitrary locations unless they
are cleared.
Fixes: 221bcb24c6 ("Input: walkera0701 - use parallel port device model")
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
tgfx_parport_cb is a local uninitialized structure and the member
function pointers will be pointing to arbitrary locations unless they
are cleared.
Fixes: 4de27a638a ("Input: turbografx - use parallel port device model")
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
gc_parport_cb is a local uninitialized structure and the member
function pointers will be pointing to arbitrary locations unless they
are cleared.
Fixes: a517e87c3d ("Input: gamecon - use parallel port device model")
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
db9_parport_cb is a local uninitialized structure and the member
function pointers will be pointing to arbitrary locations unless they
are cleared.
Fixes: 2260c419b5 ("Input: db9 - use parallel port device model")
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Pull more input updates from Dmitry Torokhov:
"An update to the tsc2005 driver that allows it to also support tsc2004
(basically the same controller, but uses i2c instead of spi bus), and
a couple of bug fixes"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: parkbd - drop bogus __init from parkbd_allocate_serio()
Input: elantech - add Fujitsu Lifebook U745 to force crc_enabled
Input: tsc2004 - add support for tsc2004
Input: tsc200x-core - rename functions and variables
Input: tsc2005 - separate SPI and core functions
WARNING: vmlinux.o(.text+0x1056606): Section mismatch in reference from the function parkbd_attach() to the function .init.text:parkbd_allocate_serio()
The function parkbd_attach() references
the function __init parkbd_allocate_serio().
This is often because parkbd_attach lacks a __init
annotation or the annotation of parkbd_allocate_serio is wrong.
Commit 33ca8ab97c ("Input: parkbd - use parallel port device
model") dropped the __init attribute from the sole caller of
parkbd_allocate_serio(), but forgot to remove it from
parkbd_allocate_serio() itself.
Fixes: 33ca8ab97c ("Input: parkbd - use parallel port device model")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Pull input updates from Dmitry Torokhov:
"Items of note:
- evdev users can now limit or mask the kind of events they will
receive. This will allow applications such as power manager or
network manager to only be woken when user presses special keys
such as KEY_POWER or KEY_WIFI and not be bothered with ordinary
key presses coming from keyboard
- support for FocalTech FT6236 touchscreen controller
- support for ROHM BU21023/24 touchscreen controller
- edt-ft5x06 touchscreen driver got a face lift and can now be used
with FT5506
- support for Google Fiber TV Box remote controls
- improvements in xpad driver (with more to come)
- several parport-based drivers have been switched to the new device
model
- other miscellaneous driver improvements"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (70 commits)
HID: hid-gfrm: avoid warning for input_configured API change
HID: hid-input: allow input_configured callback return errors
Input: evdev - fix bug in checking duplicate clock change request
Input: add userio module
Input: evdev - add event-mask API
Input: snvs_pwrkey - remove duplicated semicolon
HID: hid-gfrm: Google Fiber TV Box remote controls
Input: e3x0-button - update Kconfig description
Input: tegra-kbc - drop use of IRQF_NO_SUSPEND flag
Input: tegra-kbc - enable support for the standard "wakeup-source" property
Input: xen - check return value of xenbus_printf
Input: hp_sdc_rtc - fix y2038 problem in proc_show
Input: nomadik-ske-keypad - fix a trivial typo
Input: xpad - fix clash of presence handling with LED setting
Input: edt-ft5x06 - work around FT5506 firmware bug
Input: edt-ft5x06 - add support for FT5506
Input: edt-ft5x06 - add support for different max support points
Input: edt-ft5x06 - use max support points to determine how much to read
Input: rotary-encoder - add support for quarter-period mode
Input: rotary-encoder - use of_property_read_bool
...
