1. 01 Feb, 2018 1 commit
  2. 31 Jan, 2018 2 commits
    • Marcin Niestroj's avatar
      Input: goodix - use generic touchscreen_properties · fafef982
      Marcin Niestroj authored
      Use touchscreen_properties structure instead of implementing all
      properties by our own. It allows us to reuse generic code for parsing
      device-tree properties (which was implemented manually in the driver for
      now). Additionally, it allows us to report events using generic
      touchscreen_report_pos(), which automatically handles inverted and
      swapped axes.
      
      This fixes the issue with the custom code incorrectly handling case where
      ts->inverted_x and ts->swapped_x_y were true, but ts->inverted_y was
      false. Assuming we have 720x1280 touch panel, ts->abs_x_max == 1279 and
      ts->abs_y_max == 719 (because we inverted that in goodix_read_config()).
      Now let's assume that we received event from (0:0) position (in touch
      panel original coordinates). In function goodix_ts_report_touch() we
      calculate input_x as 1279, but after swapping input_y takes that value
      (which is more that maximum 719 value reported during initialization).
      
      Note that since touchscreen coordinates are 0-indexed, we now report
      touchscreen range as (0:size-1).
      
      Developed and tested on custom DT-based device with gt1151 touch
      panel.
      Signed-off-by: default avatarMarcin Niestroj <m.niestroj@grinn-global.com>
      [dtor: fix endianness annotation reported by sparse, handle errors when
       initializing MT slots]
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      fafef982
    • Andi Shyti's avatar
      Input: mms114 - fix typo in definition · 13e94540
      Andi Shyti authored
      It's 'MMS114_INFORMATION', not 'MMS114_INFOMATION'
      Signed-off-by: default avatarAndi Shyti <andi.shyti@samsung.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      13e94540
  3. 30 Jan, 2018 2 commits
  4. 26 Jan, 2018 4 commits
  5. 24 Jan, 2018 2 commits
  6. 23 Jan, 2018 12 commits
  7. 22 Jan, 2018 2 commits
  8. 19 Jan, 2018 2 commits
  9. 18 Jan, 2018 3 commits
    • Nick Desaulniers's avatar
      Input: synaptics-rmi4 - prevent UAF reported by KASAN · 55edde9f
      Nick Desaulniers authored
      KASAN found a UAF due to dangling pointer. As the report below says,
      rmi_f11_attention() accesses drvdata->attn_data.data, which was freed in
      rmi_irq_fn.
      
      [  311.424062] BUG: KASAN: use-after-free in rmi_f11_attention+0x526/0x5e0 [rmi_core]
      [  311.424067] Read of size 27 at addr ffff88041fd610db by task irq/131-i2c_hid/1162
      [  311.424075] CPU: 0 PID: 1162 Comm: irq/131-i2c_hid Not tainted 4.15.0-rc8+ #2
      [  311.424076] Hardware name: Razer Blade Stealth/Razer, BIOS 6.05 01/26/2017
      [  311.424078] Call Trace:
      [  311.424086]  dump_stack+0xae/0x12d
      [  311.424090]  ? _atomic_dec_and_lock+0x103/0x103
      [  311.424094]  ? show_regs_print_info+0xa/0xa
      [  311.424099]  ? input_handle_event+0x10b/0x810
      [  311.424104]  print_address_description+0x65/0x229
      [  311.424108]  kasan_report.cold.5+0xa7/0x281
      [  311.424117]  rmi_f11_attention+0x526/0x5e0 [rmi_core]
      [  311.424123]  ? memcpy+0x1f/0x50
      [  311.424132]  ? rmi_f11_attention+0x526/0x5e0 [rmi_core]
      [  311.424143]  ? rmi_f11_probe+0x1e20/0x1e20 [rmi_core]
      [  311.424153]  ? rmi_process_interrupt_requests+0x220/0x2a0 [rmi_core]
      [  311.424163]  ? rmi_irq_fn+0x22c/0x270 [rmi_core]
      [  311.424173]  ? rmi_process_interrupt_requests+0x2a0/0x2a0 [rmi_core]
      [  311.424177]  ? free_irq+0xa0/0xa0
      [  311.424180]  ? irq_finalize_oneshot.part.39+0xeb/0x180
      [  311.424190]  ? rmi_process_interrupt_requests+0x2a0/0x2a0 [rmi_core]
      [  311.424193]  ? irq_thread_fn+0x3d/0x80
      [  311.424197]  ? irq_finalize_oneshot.part.39+0x180/0x180
      [  311.424200]  ? irq_thread+0x21d/0x290
      [  311.424203]  ? irq_thread_check_affinity+0x170/0x170
      [  311.424207]  ? remove_wait_queue+0x150/0x150
      [  311.424212]  ? kasan_unpoison_shadow+0x30/0x40
      [  311.424214]  ? __init_waitqueue_head+0xa0/0xd0
      [  311.424218]  ? task_non_contending.cold.55+0x18/0x18
      [  311.424221]  ? irq_forced_thread_fn+0xa0/0xa0
      [  311.424226]  ? irq_thread_check_affinity+0x170/0x170
      [  311.424230]  ? kthread+0x19e/0x1c0
      [  311.424233]  ? kthread_create_worker_on_cpu+0xc0/0xc0
      [  311.424237]  ? ret_from_fork+0x32/0x40
      
      [  311.424244] Allocated by task 899:
      [  311.424249]  kasan_kmalloc+0xbf/0xe0
      [  311.424252]  __kmalloc_track_caller+0xd9/0x1f0
      [  311.424255]  kmemdup+0x17/0x40
      [  311.424264]  rmi_set_attn_data+0xa4/0x1b0 [rmi_core]
      [  311.424269]  rmi_raw_event+0x10b/0x1f0 [hid_rmi]
      [  311.424278]  hid_input_report+0x1a8/0x2c0 [hid]
      [  311.424283]  i2c_hid_irq+0x146/0x1d0 [i2c_hid]
      [  311.424286]  irq_thread_fn+0x3d/0x80
      [  311.424288]  irq_thread+0x21d/0x290
      [  311.424291]  kthread+0x19e/0x1c0
      [  311.424293]  ret_from_fork+0x32/0x40
      
      [  311.424296] Freed by task 1162:
      [  311.424300]  kasan_slab_free+0x71/0xc0
      [  311.424303]  kfree+0x90/0x190
      [  311.424311]  rmi_irq_fn+0x1b2/0x270 [rmi_core]
      [  311.424319]  rmi_irq_fn+0x257/0x270 [rmi_core]
      [  311.424322]  irq_thread_fn+0x3d/0x80
      [  311.424324]  irq_thread+0x21d/0x290
      [  311.424327]  kthread+0x19e/0x1c0
      [  311.424330]  ret_from_fork+0x32/0x40
      
      [  311.424334] The buggy address belongs to the object at ffff88041fd610c0 which belongs to the cache kmalloc-64 of size 64
      [  311.424340] The buggy address is located 27 bytes inside of 64-byte region [ffff88041fd610c0, ffff88041fd61100)
      [  311.424344] The buggy address belongs to the page:
      [  311.424348] page:ffffea00107f5840 count:1 mapcount:0 mapping: (null) index:0x0
      [  311.424353] flags: 0x17ffffc0000100(slab)
      [  311.424358] raw: 0017ffffc0000100 0000000000000000 0000000000000000 00000001802a002a
      [  311.424363] raw: dead000000000100 dead000000000200 ffff8804228036c0 0000000000000000
      [  311.424366] page dumped because: kasan: bad access detected
      
      [  311.424369] Memory state around the buggy address:
      [  311.424373]  ffff88041fd60f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  311.424377]  ffff88041fd61000: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb
      [  311.424381] >ffff88041fd61080: fb fb fb fb fc fc fc fc fb fb fb fb fb fb fb fb
      [  311.424384]                                                     ^
      [  311.424387]  ffff88041fd61100: fc fc fc fc fb fb fb fb fb fb fb fb fc fc fc fc
      [  311.424391]  ffff88041fd61180: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarNick Desaulniers <nick.desaulniers@gmail.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      55edde9f
    • Colin Ian King's avatar
      Input: cyapa - remove redundant assignment to 'pwr_cmd' · deb106be
      Colin Ian King authored
      The variable pwr_cmd is being assigned to cyapa->suspend_power_mode
      twice, once during the declaration and once after taking an
      interruptible mutex lock.  Remove the redundant first assignment
      since the value is never read and it is outside the mutex lock.
      
      Cleans up clang warning:
      drivers/input/mouse/cyapa.c:743:5: warning: Value stored to 'pwr_cmd'
      during its initialization is never read
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      deb106be
    • Corentin Labbe's avatar
      Input: remove at32psif · 0de45027
      Corentin Labbe authored
      Since AVR32 arch is gone, at32psif driver is useless.
      Signed-off-by: default avatarCorentin Labbe <clabbe.montjoie@gmail.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      0de45027
  10. 17 Jan, 2018 9 commits
  11. 16 Jan, 2018 1 commit