linux-stable.git/drivers/input/misc/bma150.c, branch linux-4.9.y

Input: bma150 - register input device after setting private data

2019-02-20T09:18:32+00:00

commit 90cc55f067f6ca0e64e5e52883ece47d8af7b67b upstream.

Otherwise we introduce a race condition where userspace can request input
before we're ready leading to null pointer dereference such as

input: bma150 as /devices/platform/i2c-gpio-2/i2c-5/5-0038/input/input3
Unable to handle kernel NULL pointer dereference at virtual address 00000018
pgd = (ptrval)
[00000018] *pgd=55dac831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] PREEMPT ARM
Modules linked in: bma150 input_polldev [last unloaded: bma150]
CPU: 0 PID: 2870 Comm: accelerometer Not tainted 5.0.0-rc3-dirty #46
Hardware name: Samsung S5PC110/S5PV210-based board
PC is at input_event+0x8/0x60
LR is at bma150_report_xyz+0x9c/0xe0 [bma150]
pc : [<80450f70>]    lr : [<7f0a614c>]    psr: 800d0013
sp : a4c1fd78  ip : 00000081  fp : 00020000
r10: 00000000  r9 : a5e2944c  r8 : a7455000
r7 : 00000016  r6 : 00000101  r5 : a7617940  r4 : 80909048
r3 : fffffff2  r2 : 00000000  r1 : 00000003  r0 : 00000000
Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 10c5387d  Table: 54e34019  DAC: 00000051
Process accelerometer (pid: 2870, stack limit = 0x(ptrval))
Stackck: (0xa4c1fd78 to 0xa4c20000)
fd60:                                                       fffffff3 fc813f6c
fd80: 40410581 d7530ce3 a5e2817c a7617f00 a5e29404 a5e2817c 00000000 7f008324
fda0: a5e28000 8044f59c a5fdd9d0 a5e2945c a46a4a00 a5e29668 a7455000 80454f10
fdc0: 80909048 a5e29668 a5fdd9d0 a46a4a00 806316d0 00000000 a46a4a00 801df5f0
fde0: 00000000 d7530ce3 a4c1fec0 a46a4a00 00000000 a5fdd9d0 a46a4a08 801df53c
fe00: 00000000 801d74bc a4c1fec0 00000000 a4c1ff70 00000000 a7038da8 00000000
fe20: a46a4a00 801e91fc a411bbe0 801f2e88 00000004 00000000 80909048 00000041
fe40: 00000000 00020000 00000000 dead4ead a6a88da0 00000000 ffffe000 806fcae8
fe60: a4c1fec8 00000000 80909048 00000002 a5fdd9d0 a7660110 a411bab0 00000001
fe80: dead4ead ffffffff ffffffff a4c1fe8c a4c1fe8c d7530ce3 20000013 80909048
fea0: 80909048 a4c1ff70 00000001 fffff000 a4c1e000 00000005 00026038 801eabd8
fec0: a7660110 a411bab0 b9394901 00000006 a696201b 76fb3000 00000000 a7039720
fee0: a5fdd9d0 00000101 00000002 00000096 00000000 00000000 00000000 a4c1ff00
ff00: a6b310f4 805cb174 a6b310f4 00000010 00000fe0 00000010 a4c1e000 d7530ce3
ff20: 00000003 a5f41400 a5f41424 00000000 a6962000 00000000 00000003 00000002
ff40: ffffff9c 000a0000 80909048 d7530ce3 a6962000 00000003 80909048 ffffff9c
ff60: a6962000 801d890c 00000000 00000000 00020000 a7590000 00000004 00000100
ff80: 00000001 d7530ce3 000288b8 00026320 000288b8 00000005 80101204 a4c1e000
ffa0: 00000005 80101000 000288b8 00026320 000288b8 000a0000 00000000 00000000
ffc0: 000288b8 00026320 000288b8 00000005 7eef3bac 000264e8 00028ad8 00026038
ffe0: 00000005 7eef3300 76f76e91 76f78546 800d0030 000288b8 00000000 00000000
[<80450f70>] (input_event) from [] (0xa5e2817c)
Code: e1a08148 eaffffa8 e351001f 812fff1e (e590c018)
---[ end trace 1c691ee85f2ff243 ]---

Signed-off-by: Jonathan Bakker 
Signed-off-by: Paweł Chmiel 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

Input: bma150 - constify bma150_cfg structure

2016-01-03T05:08:52+00:00

The bma150_cfg structure is never modified, so declare it as const.

Done with the help of Coccinelle.

Signed-off-by: Julia Lawall 
Signed-off-by: Dmitry Torokhov

Input: drop owner assignment from i2c_driver

2015-07-17T23:57:00+00:00

i2c_driver does not need to set an owner because i2c_register_driver()
will set it.

Signed-off-by: Krzysztof Kozlowski 
Signed-off-by: Dmitry Torokhov

Input: bma150 - use sign_extend32() for sign extending

2015-07-07T18:32:35+00:00

Despite it's name, sign_extend32() is used for 16 bit values aswell.

Signed-off-by: Martin Kepplinger 
Signed-off-by: Dmitry Torokhov

Input: bma150 - extend chip detection for bma180

2014-04-25T06:53:10+00:00

This driver has been used while on the OpenPhoenux GTA04 with a BMA180.

Signed-off-by: H. Nikolaus Schaller 
Signed-off-by: Dmitry Torokhov

Input: use dev_get_platdata()

2013-12-06T10:06:29+00:00

Use the wrapper function for retrieving the platform data instead
of accessing dev->platform_data directly. This is a cosmetic change
to make the code simpler and enhance the readability.

Signed-off-by: Jingoo Han 
Acked-by: Fugang Duan 
Signed-off-by: Dmitry Torokhov

Input: bma150 - make some defines public and fix some comments

2013-02-16T02:52:45+00:00

Make the constants referring to range and bandwidth public so they can
be used when initializing the platform data fields in the platform code.

Fix also some comments regarding the unit of measurement to use for the
range and bandwidth fields, the values are not actually expected to be
in G or HZ, the code in bma150.c just uses the BMA150_RANGE_xxx and
BMA150_BW_xxx constants like they are with no translation from actual
values in G or HZ.

Signed-off-by: Michael Trimarchi 
Signed-off-by: Antonio Ospite 
Signed-off-by: Dmitry Torokhov

Input: bma150 - fix checking pm_runtime_get_sync() return value

2013-02-16T02:52:39+00:00

When PM_RUNTIME is not defined, pm_runtime_get_sync() returns 1, see
include/linux/pm_runtime.c::__pm_runtime_resume(), and the check of the
return value was overlooking this, in this case bma150_open() would
return 1 which is not expected by upper layers.

Maybe the check for != -ENOSYS (Function not implemented) was meant to
cover this, but pm_runtime_get_sync() does not return this value.

For now fix the issue locally by checking explicitly for negative return
values.

Signed-off-by: Michael Trimarchi 
Signed-off-by: Antonio Ospite 
Signed-off-by: Dmitry Torokhov

Input: remove use of __devexit

2012-11-24T08:05:38+00:00

CONFIG_HOTPLUG is going away as an option so __devexit is no
longer needed.

Signed-off-by: Bill Pemberton 
Acked-by: Mark Brown 
Signed-off-by: Dmitry Torokhov

Input: remove use of __devinit

2012-11-24T08:05:19+00:00

CONFIG_HOTPLUG is going away as an option so __devinit is no longer
needed.

Signed-off-by: Bill Pemberton 
Acked-by: Mark Brown 
Acked-by: Javier Martinez Canillas 
Signed-off-by: Dmitry Torokhov