linux-stable.git/drivers/hid, branch v3.18.3

HID: Add a new id 0x501a for Genius MousePen i608X

2015-01-16T14:59:49+00:00

commit 2bacedada682d5485424f5227f27a3d5d6eb551c upstream.

New Genius MousePen i608X devices have a new id 0x501a instead of the
old 0x5011 so add a new #define with "_2" appended and change required
places.

The remaining two checkpatch warnings about line length
being over 80 characters are present in the original files too and this
patch was made in the same style (no line break).

Just adding a new id and changing the required places should make the
new device work without any issues according to the bug report in the
following url.

This patch was made according to and fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=67111

Signed-off-by: Giedrius Statkevičius 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: add battery quirk for USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO keyboard

2015-01-16T14:59:49+00:00

commit da940db41dcf8c04166f711646df2f35376010aa upstream.

Apple bluetooth wireless keyboard (sold in UK) has always reported zero
for battery strength no matter what condition the batteries are actually
in. With this patch applied (applying same quirk as other Apple
keyboards), the battery strength is now correctly reported.

Signed-off-by: Karl Relton 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: i2c-hid: Do not free buffers in i2c_hid_stop()

2015-01-16T14:59:49+00:00

commit 5b44c53aeb791757072be4a267255cedfff594fd upstream.

When a hid driver that uses i2c-hid as transport is unloaded, the hid core
will call i2c_hid_stop() which releases all the buffers associated with the
device. This includes also the command buffer.

Now, when the i2c-hid driver itself is unloaded it tries to power down the
device by sending it PWR_SLEEP command. Since the command buffer is already
released we get following crash:

 [   79.691459] BUG: unable to handle kernel NULL pointer dereference at           (null)
 [   79.691532] IP: [] __i2c_hid_command+0x49/0x310 [i2c_hid]
 ...
 [   79.693467] Call Trace:
 [   79.693494]  [] ? __unmask_ioapic+0x21/0x30
 [   79.693537]  [] ? unmask_ioapic+0x25/0x40
 [   79.693581]  [] ? i2c_hid_set_power+0x4b/0xa0 [i2c_hid]
 [   79.693632]  [] ? i2c_hid_runtime_resume+0x1f/0x30 [i2c_hid]
 [   79.693689]  [] ? __rpm_callback+0x2b/0x70
 [   79.693733]  [] ? rpm_callback+0x21/0x90
 [   79.693776]  [] ? rpm_resume+0x41c/0x600
 [   79.693820]  [] ? __pm_runtime_resume+0x4c/0x80
 [   79.693868]  [] ? __device_release_driver+0x28/0x100
 [   79.693917]  [] ? driver_detach+0xa0/0xb0
 [   79.693959]  [] ? bus_remove_driver+0x4c/0xb0
 [   79.694006]  [] ? SyS_delete_module+0x11d/0x1d0
 [   79.694054]  [] ? int_signal+0x12/0x17
 [   79.694095]  [] ? system_call_fastpath+0x12/0x17

Fix this so that we only free buffers when the i2c-hid driver itself is
removed.

Fixes: 34f439e4afcd ("HID: i2c-hid: add runtime PM support")
Reported-by: Gabriele Mazzotta 
Signed-off-by: Mika Westerberg 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: roccat: potential out of bounds in pyra_sysfs_write_settings()

2015-01-16T14:59:49+00:00

commit 606185b20caf4c57d7e41e5a5ea4aff460aef2ab upstream.

This is a static checker fix.  We write some binary settings to the
sysfs file.  One of the settings is the "->startup_profile".  There
isn't any checking to make sure it fits into the
pyra->profile_settings[] array in the profile_activated() function.

I added a check to pyra_sysfs_write_settings() in both places because
I wasn't positive that the other callers were correct.

Signed-off-by: Dan Carpenter 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: i2c-hid: prevent buffer overflow in early IRQ

2015-01-16T14:59:48+00:00

commit d1c7e29e8d276c669e8790bb8be9f505ddc48888 upstream.

Before ->start() is called, bufsize size is set to HID_MIN_BUFFER_SIZE,
64 bytes. While processing the IRQ, we were asking to receive up to
wMaxInputLength bytes, which can be bigger than 64 bytes.

Later, when ->start is run, a proper bufsize will be calculated.

Given wMaxInputLength is said to be unreliable in other part of the
code, set to receive only what we can even if it results in truncated
reports.

Signed-off-by: Gwendal Grignou 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: i2c-hid: fix race condition reading reports

2015-01-16T14:59:48+00:00

commit 6296f4a8eb86f9abcc370fb7a1a116b8441c17fd upstream.

Current driver uses a common buffer for reading reports either
synchronously in i2c_hid_get_raw_report() and asynchronously in
the interrupt handler.
There is race condition if an interrupt arrives immediately after
the report is received in i2c_hid_get_raw_report(); the common
buffer is modified by the interrupt handler with the new report
and then i2c_hid_get_raw_report() proceed using wrong data.

Fix it by using a separate buffers for synchronous reports.

Signed-off-by: Jean-Baptiste Maneyrol 
[Antonio Borneo: cleanup, rebase to v3.17, submit mainline]
Signed-off-by: Antonio Borneo 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: wacom: fix freeze on open when autosuspend is on

2015-01-16T14:59:48+00:00

commit dff674168878fe7b6d8b9ad60d62295ec517de79 upstream.

Since the conversion from USB to HID (in v3.17), some people reported a
freeze on boot with the wacom driver. Hans managed to get a stacktrace:

[  240.272331] Call Trace:
[  240.272338]  [] ? usb_hcd_submit_urb+0xa9/0xb10
[  240.272347]  [] schedule+0x29/0x70
[  240.272355]  [] schedule_preempt_disabled+0x16/0x20
[  240.272363]  [] __mutex_lock_slowpath+0xe5/0x230
[  240.272372]  [] mutex_lock+0x17/0x30
[  240.272380]  [] wacom_resume+0x22/0x50 [wacom]
[  240.272396]  [] hid_resume_common+0xba/0x110 [usbhid]
[  240.272404]  [] ? usb_runtime_suspend+0x80/0x80
[  240.272417]  [] hid_resume+0x3d/0x70 [usbhid]
[  240.272425]  [] usb_resume_interface.isra.6+0xb6/0x120
[  240.272432]  [] usb_resume_both+0x74/0x140
[  240.272439]  [] usb_runtime_resume+0x1a/0x20
[  240.272446]  [] __rpm_callback+0x32/0x70
[  240.272453]  [] rpm_callback+0x26/0xa0
[  240.272460]  [] rpm_resume+0x4b1/0x690
[  240.272468]  [] ? radix_tree_lookup_slot+0x22/0x50
[  240.272475]  [] rpm_resume+0x35a/0x690
[  240.272482]  [] ? zone_statistics+0x89/0xa0
[  240.272489]  [] __pm_runtime_resume+0x40/0x60
[  240.272497]  [] usb_autopm_get_interface+0x22/0x60
[  240.272509]  [] usbhid_open+0x59/0xe0 [usbhid]
[  240.272517]  [] wacom_open+0x35/0x50 [wacom]
[  240.272525]  [] input_open_device+0x79/0xa0
[  240.272534]  [] evdev_open+0x1b1/0x200 [evdev]
[  240.272543]  [] chrdev_open+0xae/0x1f0
[  240.272549]  [] ? cdev_put+0x30/0x30
[  240.272556]  [] do_dentry_open+0x1d2/0x320
[  240.272562]  [] finish_open+0x31/0x50
[  240.272571]  [] do_last.isra.36+0x652/0xe50
[  240.272579]  [] path_openat+0xc7/0x6f0
[  240.272586]  [] ? final_putname+0x22/0x50
[  240.272594]  [] ? user_path_at_empty+0x72/0xd0
[  240.272602]  [] do_filp_open+0x4d/0xc0
[...]

So here, wacom_open is called, and then wacom_resume is called by the
PM system. However, wacom_open already took the lock when wacom_resume
tries to get it. Freeze.

A little bit of history shows that this already happened in the past
- commit f6cd378372bf ("Input: wacom - fix runtime PM related deadlock"),
and the solution was to call first the PM function before taking the lock.

The lock was introduced in commit commit e722409445fb ("Input: wacom -
implement suspend and autosuspend") when the autosuspend feature has
been added. Given that usbhid already takes care of this very same
locking between suspend/resume, I think we can simply kill the lock
in open/close.

The lock is now used also with LEDs, so we can not remove it completely.

Reported-by: Hans Spath 
Tested-by: Hans Spath 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: wacom: re-add accidentally dropped Lenovo PID

2015-01-16T14:59:48+00:00

commit 00d6f227a5905be47006abcc1f417d069ecc3711 upstream.

Dropped in the following commit:

commit a3e6f6543d19 ("Input: wacom - keep wacom_ids ordered")

Reported-by: Hans Spath 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: yet another buggy ELAN touchscreen

2015-01-16T14:59:48+00:00

commit a32c99e7ab8410bae7c276a7e94ca84d108de034 upstream.

The touchscreen needs the same quirk as the other models.

Signed-off-by: Oliver Neukum 
Reported-by: Bryan Poling 
Acked-by: Greg Kroah-Hartman 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

2014-11-14T00:19:14+00:00

Pull HID fixes from Jiri Kosina:

 - fix for an oops in HID core upon repeated subdriver insertion/removal
   under certain circumstances, by Benjamin Tissoires

 - quirk for another Elan Touchscreen device, by Adel Gadllah

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: core: cleanup .claimed field on disconnect
  HID: usbhid: enable always-poll quirk for Elan Touchscreen 0103