We should not be leaving half-mapped usages with potentially invalid keycodes, as that may confuse hidinput_find_key() when the key is located by index, which may end up feeding way too large keycode into the VT keyboard handler and cause OOB write there: BUG: KASAN: global-out-of-bounds in clear_bit include/asm-generic/bitops-instrumented.h:56 [inline] BUG: KASAN: global-out-of-bounds in kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] BUG: KASAN: global-out-of-bounds in kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 Write of size 8 at addr ffffffff89a1b2d8 by task syz-executor108/1722 ... kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 input_to_handler+0x3b6/0x4c0 drivers/input/input.c:118 input_pass_values.part.0+0x2e3/0x720 drivers/input/input.c:145 input_pass_values drivers/input/input.c:949 [inline] input_set_keycode+0x290/0x320 drivers/input/input.c:954 evdev_handle_set_keycode_v2+0xc4/0x120 drivers/input/evdev.c:882 evdev_do_ioctl drivers/input/evdev.c:1150 [inline] Cc: stable@vger.kernel.org Reported-by: syzbot+19340dff067c2d3835c0@syzkaller.appspotmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details you should have received a copy of the gnu general public license along with this program if not write to the free software foundation inc 59 temple place suite 330 boston ma 02111 1307 usa extracted by the scancode license scanner the SPDX license identifier GPL-2.0-or-later has been chosen to replace the boilerplate/reference in 1334 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Allison Randal <allison@lohutok.net> Reviewed-by: Richard Fontana <rfontana@redhat.com> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190527070033.113240726@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Pull input updates from Dmitry Torokhov: "A few new drivers: - driver for Azoteq IQS550/572/525 touch controllers - driver for Microchip AT42QT1050 keys - driver for GPIO controllable vibrators - support for GT5663 in Goodix driver ... along with miscellaneous driver fixes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: libps2 - mark expected switch fall-through Input: qt1050 - add Microchip AT42QT1050 support Input: add support for Azoteq IQS550/572/525 Input: add a driver for GPIO controllable vibrators Input: synaptics-rmi4 - fix enum_fmt Input: synaptics-rmi4 - fill initial format HID: input: add mapping for KEY_KBD_LAYOUT_NEXT Input: add KEY_KBD_LAYOUT_NEXT Input: hyperv-keyboard - add module description Input: olpc_apsp - depend on ARCH_MMP Input: sun4i-a10-lradc-keys - add support for A83T Input: snvs_pwrkey - use dev_pm_set_wake_irq() to simplify code Input: lpc32xx-key - add clocks property and fix DT binding example Input: i8042 - signal wakeup from atkbd/psmouse Input: goodix - add GT5663 CTP support Input: goodix - add regulators suppot Input: evdev - use struct_size() in kzalloc() and vzalloc() Input: edt-ft5x06 - convert to use SPDX identifier Input: edt-ft5x06 - enable ACPI enumeration
Prepare input updates for 5.2 merge window.
Pull HID updates from Jiri Kosina: - support for U2F Zero device, from Andrej Shadura - logitech-dj has historically been treating devices behind non-unifying receivers as generic devices, using the HID emulation in the receiver. That had several shortcomings (special keys handling, battery level monitoring, etc). The driver has been reworked to enumarate (and directly communicate with) the devices behind the receiver, to avoid the (too) generic HID implementation in the receiver itself. All the work done by Benjamin Tissoires and Hans de Goede. - restructuring of intel-ish driver in order to allow for multiple clients of the ISH implementation, from Srinivas Pandruvada - several other smaller fixes and assorted device ID additions * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (68 commits) HID: logitech-dj: fix spelling in printk HID: input: fix assignment of .value HID: input: make sure the wheel high resolution multiplier is set HID: logitech-dj: add usbhid dependency in Kconfig HID: logitech-hidpp: add support for HID++ 1.0 consumer keys reports HID: logitech-hidpp: add support for HID++ 1.0 extra mouse buttons reports HID: logitech-hidpp: add support for HID++ 1.0 wheel reports HID: logitech-hidpp: make hidpp10_set_register_bit a bit more generic HID: logitech-hidpp: add input_device ptr to struct hidpp_device HID: logitech-hidpp: do not hardcode very long report length HID: logitech-hidpp: handle devices attached to 27MHz wireless receivers HID: logitech-hidpp: use RAP instead of FAP to get the protocol version HID: logitech-hidpp: remove unused origin_is_hid_core function parameter HID: logitech-hidpp: remove double assignment from __hidpp_send_report HID: logitech-hidpp: do not make failure to get the name fatal HID: logitech-hidpp: ignore very-short or empty names HID: logitech-hidpp: make .probe usbhid capable HID: logitech-hidpp: allow non HID++ devices to be handled by this module HID: logitech-dj: add support for Logitech Bluetooth Mini-Receiver HID: logitech-dj: make appending of the HID++ descriptors conditional ...
HUTRR56 defined a new usage code on consumer page to cycle through set of keyboard layouts, let's add this mapping. Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The value field is actually an array of .maxfield. We should assign the
correct number to the correct usage.
Not that we never encounter a device that requires this ATM, but better
have the proper code path.
Fixes: 2dc702c991e377 ("HID: input: use the Resolution Multiplier for
high-resolution scrolling")
Cc: stable@vger.kernel.org # v5.0+
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Some old mice have a tendency to not accept the high resolution multiplier.
They reply with a -EPIPE which was previously ignored.
Force the call to resolution multiplier to be synchronous and actually
check for the answer. If this fails, consider the mouse like a normal one.
Fixes: 2dc702c991e377 ("HID: input: use the Resolution Multiplier for
high-resolution scrolling")
Link: https://bugzilla.redhat.com/show_bug.cgi?id=1700071
Reported-and-tested-by: James Feeney <james@nurealm.net>
Cc: stable@vger.kernel.org # v5.0+
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Pull input updates from Dmitry Torokhov: - several new key mappings for HID - a host of new ACPI IDs used to identify Elan touchpads in Lenovo laptops * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: snvs_pwrkey - initialize necessary driver data before enabling IRQ HID: input: add mapping for "Toggle Display" key HID: input: add mapping for "Full Screen" key HID: input: add mapping for keyboard Brightness Up/Down/Toggle keys HID: input: add mapping for Expose/Overview key HID: input: fix mapping of aspect ratio key [media] doc-rst: switch to new names for Full Screen/Aspect keys Input: document meanings of KEY_SCREEN and KEY_ZOOM Input: elan_i2c - add hardware ID for multiple Lenovo laptops
According to HUTRR89 usage 0x1cb from the consumer page was assigned to allow launching desktop-aware assistant application, so let's add the mapping. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>