summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'for-4.15/wacom' into for-linusJiri Kosina2017-11-154-15/+39
|\ | | | | | | | | | | | | - High resolution mode for DEll canvas support, from Benjamin Tissoires - A lot of improvements to pen handling in the Wacom driver, from Jason Gerecke Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * HID: Wacom: switch Dell canvas into highres modeBenjamin Tissoires2017-11-101-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | The Dell Canvas exports 2 collections for the Pen part. The only difference between the 2 is that the default one has half the resolution of the second one. The Windows driver switches the tablet into the second mode, so we should behave the same. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * HID: wacom: generic: Send BTN_STYLUS3 when both barrel switches are setJason Gerecke2017-11-093-2/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Wacom Pro Pen 3D includes a third barrel switch which is intended to be particularly useful in applications where one frequency uses pan, zoom, and rotate to navigate around a scene or model. The pen is compatible with the MobileStudio Pro, 2nd-gen Intuos Pro, and Cintiq Pro. When the third button is pressed, these devices set both the HID_DG_BARRELSWITCH and HID_DG_BARRELSWITCH2 usages since their HID descriptors do not include a usage specific to the button. Rather than send both BTN_STYLUS and BTN_STYLUS2 when the third button is pressed, userspace (libinput) has requested that we detect this condition and report a newly-defined BTN_STYLUS3 event instead. We could define a quirk specific to devices compatible with the Pro Pen 3D, but the liklihood of seeing both barrel switch bits set with other pens/devices is low enough to not worry about (pens mechanically prevent accidental activation of multiple switches). Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Acked-by: Peter Hutterer <peter.hutterer@who-t.net> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * Revert "HID: wacom: generic: Send BTN_TOOL_PEN in prox once the pen enters ↵Jason Gerecke2017-10-111-11/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | range" This reverts commit 3e70969e44ee52d72053145dab2cbad74109c685. This commit causes a few problems for userspace. The most noteworthy are problems related to the distinguishing of different pens and pointer jumps when entering proximity. Userspace is written with the expectation that a pen will provide its tool ID and serial number (if available) in the very first in-prox report. By sending BTN_TOOL_PEN when the tablet starts communicating rather than waiting until a tool ID/serial number is available, userspace ends up treating all pens as being the same and lacking a serial number. Similarly, userspace assumes that the first report will contain X/Y data, but by marking the pen as being in-prox without an X/Y coordinate, userspace ends up warping the pen to the last- known X/Y location. As of commit 5b40104edfb0 ("HID: wacom: generic: Reset events back to zero when pen leaves") this means warping to (0,0). Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * HID: wacom: generic: Reset events back to zero when pen leavesJason Gerecke2017-09-131-4/+4
| | | | | | | | | | | | | | | | | | | | As a pen leaves, we need to be sure to reset all events back to zero so that userspace is able to get the complete pen state when it enters proximity again. Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * HID: wacom: generic: Send BTN_TOOL_PEN in prox once the pen enters rangeJason Gerecke2017-09-131-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When a pen is first able to to be sensed by the tablet, we would like to inform userspace that a tool is nearby so that it can attempt to perform palm rejection. Unfortunately, we don't know any information about the tool that is nearby, so the best we can do is send a prox event for a generic BTN_TOOL_PEN. If the pen later comes closer and enters proximity, we can determine the actual tool type and send BTN_TOOL_PEN out of prox if necessary. Signed-off-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * HID: wacom: generic: Leave tool in prox until it completely leaves senseJason Gerecke2017-09-131-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The legacy Intuos codepath and tablet behavior (e.g. the 1st-gen Intuos Pro, Cintiq 27, etc.) would result in a BTN_TOOL_* event not being cleared to zero until the tool had completely left the sensing range of the tablet. Before the final "out of prox" packet would be sent, zero or more "in range" packets could be sent to indicate that a pen was still detectable but not within a useful distance. These "in range" packets were used by the driver to keep touch input disabled at greater pen distances. In addition to keeping the `stylus_in_proximity` flag set, the driver would leave the current BTN_TOOL_* marked as being in proximity as well. The new HID codepath also sets `stylus_in_proximity` based on the "sense" flag, but does not leave the current BTN_TOOL_* marked as being in prox. This information is potentially useful to for a future userspace-based palm rejection, so this patch modifies the driver to continue sending it. Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * HID: wacom: generic: Use generic codepath terminology in wacom_wac_pen_reportJason Gerecke2017-09-131-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | The terminology used to describe the various degrees of pen proximity within the wacom_wac_pen_report function does not match that used elsewhere in the generic codepath. Specifically, the names of the variables "prox" and "range" were inspired by the non-generic codepaths. To make the generic codepath internally consistent, replace these terms with "range" and "sense" respectively. Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Signed-off-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | Merge branch 'for-4.15/use-timer-setup' into for-linusJiri Kosina2017-11-152-8/+10
|\ \ | | | | | | | | | | | | | | | - usbhid: conversion to timer_setup() and from_timer() from Kees Cook Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | HID: usbhid: Convert timers to use timer_setup()Kees Cook2017-10-112-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() (introduced by 686fef928bba ("timer: Prepare to change timer callback argument type")) to pass the timer pointer explicitly. Adds pointer back to hid_device for multitouch. [jkosina@suse.cz: extend changelog a little bit as asked for by Benjamin] Cc: Jiri Kosina <jikos@kernel.org> Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> Cc: linux-input@vger.kernel.org Cc: linux-usb@vger.kernel.org Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | | Merge branch 'for-4.15/upstream' into for-linusJiri Kosina2017-11-157-8/+29
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - cp2112: GPIO error handling and Kconfig fixes from Sébastien Szymanski - i2c-hid: fixup / quirk for Apollo-Lake based laptops, from Hans de Goede - Input/Core: add eraser tool support, from Ping Cheng - small assorted code fixes Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: cp2112: fix broken gpio_direction_input callbackSébastien Szymanski2017-11-101-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When everything goes smoothly, ret is set to 0 which makes the function to return EIO error. Fixes: 8e9faa15469e ("HID: cp2112: fix gpio-callback error handling") Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: cp2112: fix interface specification URLSébastien Szymanski2017-11-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: i2c-hid: Add no-irq-after-reset quirk for 0911:5288 deviceHans de Goede2017-11-092-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Several cheap Apollo Lake based laptops / 2-in-1s use an i2c-hid mt touchpad which is advertised by the DSDT with an ACPI HID of "SYNA3602", this touchpad can be found on e.g. the Cube Thinker and the EZBook 3 Pro. On my "T-bao Tbook air" the i2c-hid driver fails to bind to this touchpad: "i2c_hid i2c-SYNA3602:00: failed to reset device.". After some debuging this it seems that this touchpad simply never sends an interrupt after a reset as expected by the i2c hid driver. This commit adds a quirk for this device, making i2c_hid_command sleep 100ms after a reset instead of waiting for an irq, fixing i2c-hid failing to bind to this touchpad. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: cp2112: add HIDRAW dependencySébastien Szymanski2017-11-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Otherwise, with HIDRAW=n, the probe function crashes because of null dereference of hdev->hidraw. Cc: stable@vger.kernel.org Fixes: 42cb6b35b9e6 ("HID: cp2112: use proper hidraw name with minor number") Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: hid-input: Add eraser usage to hidinput_configure_usagePing Cheng2017-10-051-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some tablets report eraser usage to indicate the eraser tool tip is touching the surface. But, hidinput_configure_usage didn't support the usage, which led it falls into default as ABS_MISC. Signed-off-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: retrode: tell what a Retrode is and drop a blank lineRandy Dunlap2017-10-021-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add descriptive info to prompt string so that someone can know what a Retrode is. Drop an unneeded blank line. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Bastien Nocera <hadess@hadess.net> Cc: Jiri Kosina <jikos@kernel.org> Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: add comment for power callback in struct hid_ll_driverJaejoong Kim2017-10-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | There is a missing comment in struct hid_ll_driver. So, add it. Signed-off-by: Jaejoong Kim <climbbb.kim@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: make device_attribute constBhumika Goyal2017-09-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make this const as it is only passed as an argument to the function device_create_file and device_remove_file and the corresponding arguments are of type const. Done using Coccinelle Signed-off-by: Bhumika Goyal <bhumirks@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | | | Merge branch 'for-4.15/sony' into for-linusJiri Kosina2017-11-151-4/+10
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | - SHANWAN PS3 rumble fix from Bastien Nocera Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | | HID: sony: Fix SHANWAN pad rumbling on USBBastien Nocera2017-11-091-4/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The SHANWAN PS3 clone joypad will start its rumble motors as soon as it is plugged in via USB. As the additional USB interrupt does nothing on the original PS3 Sixaxis joypads, and makes a number of other clone joypads actually start sending data, disable that call for the SHANWAN so the rumble motors aren't started on plug. Signed-off-by: Bastien Nocera <hadess@hadess.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | | | | Merge branch 'for-4.15/multitouch' into for-linusJiri Kosina2017-11-152-0/+43
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - make sure that we forward MSC_TIMESTAMP in accordance to the specification, from Nicolas Boichat Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | | | HID: hid-multitouch: forward MSC_TIMESTAMPNicolas Boichat2017-10-052-0/+43
| | |/ / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Computes and forwards the device timestamp according to the specification. Many devices use a 16-bit timestamp field, with a resolution of 100us, therefore rolling around very frequently (every 6.5 seconds). To make sure there is no ambiguity, the timestamp reported to the input stack reset to 0 whenever the time between 2 received events is greater than MAX_TIMESTAMP_INTERVAL (1 second). Signed-off-by: Nicolas Boichat <drinkcat@chromium.org> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | | | | Merge branch 'for-4.15/logitech' into for-linusJiri Kosina2017-11-152-4/+4
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | - small code fixes for Logitech driver from Colin Ian King
| * | | | | HID: hid-logitech: remove redundant assignment to pointer valueColin Ian King2017-10-191-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pointer value is being assigned a value and this is never read, and later on it is being assigned a new value. This the first assignment is redundant and can be removed and hence also the variables report and report_list. Cleans up the clang warning: Value stored to 'value' during its initialization is never read Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | | | HID: hid-lg: make array cbuf static const to shink object code sizeColin Ian King2017-09-061-1/+3
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't populate array cbuf on the stack, instead make it static. Makes the object code smaller by over 110 bytes: Before: text data bss dec hex filename 15096 3504 128 18728 4928 drivers/hid/hid-lg.o After: text data bss dec hex filename 14884 3600 128 18612 48b4 drivers/hid/hid-lg.o Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | | | | Merge branch 'for-4.15/hyperv' into for-linusJiri Kosina2017-11-151-1/+1
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | - trivial printk() line termination fix for HyperV
| * | | | | HID: hyperv: pr_err() strings should end with newlinesArvind Yadav2017-10-051-1/+1
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pr_err() messages should terminated with a new-line to avoid other messages being concatenated onto the end. Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | | | | Merge branch 'for-4.15/asus' into for-linusJiri Kosina2017-11-153-2/+32
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | - Asus laptop fixes (fn keys, backlight), from Mustafa Kuscu and Maxime Bellengé
| * | | | | HID: add backlight level quirk for Asus ROG laptopsMustafa Kuscu2017-11-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On laptops such as Asus GL553VD, setting keyboard backlight levels does not work. This change enables F3/F4 keys to set backlight levels (from 0 to 3, total 4 levels) on such laptops. It is intended only to the following device: 0x0b05 1854: P: Vendor=0b05 ProdID=1854 Rev=03.02 S: Manufacturer=ITE Tech. Inc. S: Product=ITE Device(8910) [jkosina@suse.cz: massage changelog a little bit] Signed-off-by: Mustafa C Kuscu <mustafakuscu@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | | | HID: asus: Add support for Fn keys on Asus ROG G752Maxime Bellengé2017-09-163-1/+31
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for Fn keys on Asus ROG G752 laptop. The report descriptor is broken so I fixed it. Tested on an Asus G752VT. Resent fix white space fixes Signed-off-by: Maxime Bellengé <maxime.bellenge@gmail.com> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | | | | Merge branch 'for-4.15/alps' into for-linusJiri Kosina2017-11-158573-244105/+330395
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | - New ALPS touchpad (T4, found currently on HP EliteBook 1000, Zbook Stduio and HP Elite book x360) support from Masaki Ota
| * | | | | HID: alps: add new U1 device IDMasaki Ota2017-10-173-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add new U1 device Product ID This device is used on HP Elite book x360 series. [jkosina@suse.cz: update changelog] Signed-off-by: Masaki Ota <masaki.ota@jp.alps.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | | | HID: alps: add support for Alps T4 Touchpad deviceMasaki Ota2017-10-173-20/+323
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Define T4 device specification value for support T4 device. - Creeate "t4_contact_data" and "t4_input_report" structure for decoding and storing T4-specific data - Create "t4_calc_check_sum()" function for calculating checksum value to send to the device. T4 needs to send this value when reading or writing device address value. - Create "t4_read_write_register()" function for reading and writing device address value. - Create "t4_raw_event()" function for decodin XYZ, palm and button data. - Replace "MAX_TOUCHES" fixed variable to "max_fingers" variable. - Add T4 devuce product ID. (0x120C) T4 device is used on HP EliteBook 1000 series and Zbook Stduio [jkosina@suse.cz: rewrite changelog] Signed-off-by: Masaki Ota <masaki.ota@jp.alps.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | | | HID: alps: remove variables local to u1_init() from the device structMasaki Ota2017-10-171-40/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move dev_ctrl, dev_type, sen_line_num_x, sen_line_num_y, pitch_x, pitch_y, resolution, btn_info from u1_dev structure to "u1_init()", because these variables are only used in there. [jkosina@suse.cz: rewrite changelog] Signed-off-by: Masaki Ota <masaki.ota@jp.alps.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | | | HID: alps: properly handle max_fingers and minimum on X and Y axisMasaki Ota2017-10-171-14/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Create x_min, y_min and max_fingers variables for set correct XY minimum value and the number of max finger on each devices. [jkosina@suse.cz: update shortlog] Signed-off-by: Masaki Ota <masaki.ota@jp.alps.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | | | HID: alps: Separate U1 device codeMasaki Ota2017-10-171-53/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Create 'static int u1_init()' and factor out U1 device initialization code from main initialization and introduce per-device 'has_sp' flag. [jkosina@suse.cz: rewrite changelog] Signed-off-by: Masaki Ota <masaki.ota@jp.alps.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | | | HID: alps: delete unnecessary struct u1_dev devInfoMasaki Ota2017-10-171-35/+34
| | |/ / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Delete "struct u1_dev devInfo" structure, because u1_dev structure is already declared as "struct u1_dev *data". [jkosina@suse.cz: rewrite changelog] Signed-off-by: Masaki Ota <masaki.ota@jp.alps.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | | Merge branch 'for-linus' of ↵Linus Torvalds2017-10-125-5/+25
| |\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID fixes from Jiri Kosina: - fix for potential out-of-bounds memory access (found by fuzzing, likely requires specially crafted device to trigger) by Jaejoong Kim - two new device IDs for elecom driver from Alex Manoussakis * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: hid-elecom: extend to fix descriptor for HUGE trackball HID: usbhid: fix out-of-bounds bug
| * \ \ \ \ Merge tag 'sound-4.14-rc5' of ↵Linus Torvalds2017-10-1210-22/+61
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "It's been a busy week for defending the attacks from fuzzer people. This contains various USB-audio driver fixes and sequencer core fixes spotted by syzkaller and other fuzzer, as well as one quirk for a Plantronics USB audio device" * tag 'sound-4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: caiaq: Fix stray URB at probe error path ALSA: seq: Fix use-after-free at creating a port ALSA: usb-audio: Kill stray URB at exiting ALSA: line6: Fix leftover URB at error-path during probe ALSA: line6: Fix NULL dereference at podhd_disconnect() ALSA: line6: Fix missing initialization before error path ALSA: seq: Fix copy_from_user() call inside lock ALSA: usb-audio: Add sample rate quirk for Plantronics P610
| | * | | | | ALSA: caiaq: Fix stray URB at probe error pathTakashi Iwai2017-10-111-3/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | caiaq driver doesn't kill the URB properly at its error path during the probe, which may lead to a use-after-free error later. This patch addresses it. Reported-by: Johan Hovold <johan@kernel.org> Reviewed-by: Johan Hovold <johan@kernel.org> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| | * | | | | ALSA: seq: Fix use-after-free at creating a portTakashi Iwai2017-10-112-3/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is a potential race window opened at creating and deleting a port via ioctl, as spotted by fuzzing. snd_seq_create_port() creates a port object and returns its pointer, but it doesn't take the refcount, thus it can be deleted immediately by another thread. Meanwhile, snd_seq_ioctl_create_port() still calls the function snd_seq_system_client_ev_port_start() with the created port object that is being deleted, and this triggers use-after-free like: BUG: KASAN: use-after-free in snd_seq_ioctl_create_port+0x504/0x630 [snd_seq] at addr ffff8801f2241cb1 ============================================================================= BUG kmalloc-512 (Tainted: G B ): kasan: bad access detected ----------------------------------------------------------------------------- INFO: Allocated in snd_seq_create_port+0x94/0x9b0 [snd_seq] age=1 cpu=3 pid=4511 ___slab_alloc+0x425/0x460 __slab_alloc+0x20/0x40 kmem_cache_alloc_trace+0x150/0x190 snd_seq_create_port+0x94/0x9b0 [snd_seq] snd_seq_ioctl_create_port+0xd1/0x630 [snd_seq] snd_seq_do_ioctl+0x11c/0x190 [snd_seq] snd_seq_ioctl+0x40/0x80 [snd_seq] do_vfs_ioctl+0x54b/0xda0 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x16/0x75 INFO: Freed in port_delete+0x136/0x1a0 [snd_seq] age=1 cpu=2 pid=4717 __slab_free+0x204/0x310 kfree+0x15f/0x180 port_delete+0x136/0x1a0 [snd_seq] snd_seq_delete_port+0x235/0x350 [snd_seq] snd_seq_ioctl_delete_port+0xc8/0x180 [snd_seq] snd_seq_do_ioctl+0x11c/0x190 [snd_seq] snd_seq_ioctl+0x40/0x80 [snd_seq] do_vfs_ioctl+0x54b/0xda0 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x16/0x75 Call Trace: [<ffffffff81b03781>] dump_stack+0x63/0x82 [<ffffffff81531b3b>] print_trailer+0xfb/0x160 [<ffffffff81536db4>] object_err+0x34/0x40 [<ffffffff815392d3>] kasan_report.part.2+0x223/0x520 [<ffffffffa07aadf4>] ? snd_seq_ioctl_create_port+0x504/0x630 [snd_seq] [<ffffffff815395fe>] __asan_report_load1_noabort+0x2e/0x30 [<ffffffffa07aadf4>] snd_seq_ioctl_create_port+0x504/0x630 [snd_seq] [<ffffffffa07aa8f0>] ? snd_seq_ioctl_delete_port+0x180/0x180 [snd_seq] [<ffffffff8136be50>] ? taskstats_exit+0xbc0/0xbc0 [<ffffffffa07abc5c>] snd_seq_do_ioctl+0x11c/0x190 [snd_seq] [<ffffffffa07abd10>] snd_seq_ioctl+0x40/0x80 [snd_seq] [<ffffffff8136d433>] ? acct_account_cputime+0x63/0x80 [<ffffffff815b515b>] do_vfs_ioctl+0x54b/0xda0 ..... We may fix this in a few different ways, and in this patch, it's fixed simply by taking the refcount properly at snd_seq_create_port() and letting the caller unref the object after use. Also, there is another potential use-after-free by sprintf() call in snd_seq_create_port(), and this is moved inside the lock. This fix covers CVE-2017-15265. Reported-and-tested-by: Michael23 Yu <ycqzsy@gmail.com> Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| | * | | | | ALSA: usb-audio: Kill stray URB at exitingTakashi Iwai2017-10-102-2/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | USB-audio driver may leave a stray URB for the mixer interrupt when it exits by some error during probe. This leads to a use-after-free error as spotted by syzkaller like: ================================================================== BUG: KASAN: use-after-free in snd_usb_mixer_interrupt+0x604/0x6f0 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:16 dump_stack+0x292/0x395 lib/dump_stack.c:52 print_address_description+0x78/0x280 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 kasan_report+0x23d/0x350 mm/kasan/report.c:409 __asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:430 snd_usb_mixer_interrupt+0x604/0x6f0 sound/usb/mixer.c:2490 __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779 .... Allocated by task 1484: save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772 kmalloc ./include/linux/slab.h:493 kzalloc ./include/linux/slab.h:666 snd_usb_create_mixer+0x145/0x1010 sound/usb/mixer.c:2540 create_standard_mixer_quirk+0x58/0x80 sound/usb/quirks.c:516 snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560 create_composite_quirk+0x1c4/0x3e0 sound/usb/quirks.c:59 snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560 usb_audio_probe+0x1040/0x2c10 sound/usb/card.c:618 .... Freed by task 1484: save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:524 slab_free_hook mm/slub.c:1390 slab_free_freelist_hook mm/slub.c:1412 slab_free mm/slub.c:2988 kfree+0xf6/0x2f0 mm/slub.c:3919 snd_usb_mixer_free+0x11a/0x160 sound/usb/mixer.c:2244 snd_usb_mixer_dev_free+0x36/0x50 sound/usb/mixer.c:2250 __snd_device_free+0x1ff/0x380 sound/core/device.c:91 snd_device_free_all+0x8f/0xe0 sound/core/device.c:244 snd_card_do_free sound/core/init.c:461 release_card_device+0x47/0x170 sound/core/init.c:181 device_release+0x13f/0x210 drivers/base/core.c:814 .... Actually such a URB is killed properly at disconnection when the device gets probed successfully, and what we need is to apply it for the error-path, too. In this patch, we apply snd_usb_mixer_disconnect() at releasing. Also introduce a new flag, disconnected, to struct usb_mixer_interface for not performing the disconnection procedure twice. Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| | * | | | | ALSA: line6: Fix leftover URB at error-path during probeTakashi Iwai2017-10-091-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While line6_probe() may kick off URB for a control MIDI endpoint, the function doesn't clean up it properly at its error path. This results in a leftover URB action that is eventually triggered later and causes an Oops like: general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 0 Comm: swapper/1 Not tainted RIP: 0010:usb_fill_bulk_urb ./include/linux/usb.h:1619 RIP: 0010:line6_start_listen+0x3fe/0x9e0 sound/usb/line6/driver.c:76 Call Trace: <IRQ> line6_data_received+0x1f7/0x470 sound/usb/line6/driver.c:326 __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779 usb_hcd_giveback_urb+0x337/0x420 drivers/usb/core/hcd.c:1845 dummy_timer+0xba9/0x39f0 drivers/usb/gadget/udc/dummy_hcd.c:1965 call_timer_fn+0x2a2/0x940 kernel/time/timer.c:1281 .... Since the whole clean-up procedure is done in line6_disconnect() callback, we can simply call it in the error path instead of open-coding the whole again. It'll fix such an issue automagically. The bug was spotted by syzkaller. Fixes: eedd0e95d355 ("ALSA: line6: Don't forget to call driver's destructor at error path") Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| | * | | | | ALSA: line6: Fix NULL dereference at podhd_disconnect()Takashi Iwai2017-10-091-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When podhd_init() failed with the acquiring a ctrl i/f, the line6 helper still calls the disconnect callback that eventually calls again usb_driver_release_interface() with the NULL intf. Put the proper NULL check before calling it for avoiding an Oops. Fixes: fc90172ba283 ("ALSA: line6: Claim pod x3 usb data interface") Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| | * | | | | ALSA: line6: Fix missing initialization before error pathTakashi Iwai2017-10-091-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The error path in podhd_init() tries to clear the pending timer, while the timer object is initialized at the end of init sequence, thus it may hit the uninitialized object, as spotted by syzkaller: INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator. CPU: 1 PID: 1845 Comm: kworker/1:2 Not tainted 4.14.0-rc2-42613-g1488251d1a98 #238 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x292/0x395 lib/dump_stack.c:52 register_lock_class+0x6c4/0x1a00 kernel/locking/lockdep.c:769 __lock_acquire+0x27e/0x4550 kernel/locking/lockdep.c:3385 lock_acquire+0x259/0x620 kernel/locking/lockdep.c:4002 del_timer_sync+0x12c/0x280 kernel/time/timer.c:1237 podhd_disconnect+0x8c/0x160 sound/usb/line6/podhd.c:299 line6_probe+0x844/0x1310 sound/usb/line6/driver.c:783 podhd_probe+0x64/0x70 sound/usb/line6/podhd.c:474 .... For addressing it, assure the initializations of timer and work by moving them to the beginning of podhd_init(). Fixes: 790869dacc3d ("ALSA: line6: Add support for POD X3") Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| | * | | | | ALSA: seq: Fix copy_from_user() call inside lockTakashi Iwai2017-10-092-8/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The event handler in the virmidi sequencer code takes a read-lock for the linked list traverse, while it's calling snd_seq_dump_var_event() in the loop. The latter function may expand the user-space data depending on the event type. It eventually invokes copy_from_user(), which might be a potential dead-lock. The sequencer core guarantees that the user-space data is passed only with atomic=0 argument, but snd_virmidi_dev_receive_event() ignores it and always takes read-lock(). For avoiding the problem above, this patch introduces rwsem for non-atomic case, while keeping rwlock for atomic case. Also while we're at it: the superfluous irq flags is dropped in snd_virmidi_input_open(). Reported-by: Jia-Ju Bai <baijiaju1990@163.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| | * | | | | ALSA: usb-audio: Add sample rate quirk for Plantronics P610Kai-Heng Feng2017-10-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Like other Plantronics devices, P610 does not support sample rate reading. Apply sample rate quirk to it. BugLink: https://bugs.launchpad.net/bugs/1719853 Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | | | | Merge branch 'waitid-fix'Linus Torvalds2017-10-121-0/+6
| |\ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Merge waitid() fix from Kees Cook. I'd have hoped that the unsafe_{get|put}_user() naming would have avoided these kinds of stupid bugs, but no such luck. * waitid-fix: waitid(): Add missing access_ok() checks
| | * | | | | | waitid(): Add missing access_ok() checksKees Cook2017-10-101-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds missing access_ok() checks. CVE-2017-5123 Reported-by: Chris Salls <chrissalls5@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Al Viro <viro@zeniv.linux.org.uk> Fixes: 4c48abe91be0 ("waitid(): switch copyout of siginfo to unsafe_put_user()") Cc: stable@kernel.org # 4.13 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-18 13:01:16 +0100