linux-stable.git/drivers/input/misc, branch linux-3.14.y Linux kernel stable tree Input: uinput - handle compat ioctl for UI_SET_PHYS 2016-06-08T00:21:57+00:00 Ricky Liang jcliang@chromium.org 2016-05-20T17:58:59+00:00 79925b261448de46f9b4a63fd7bc957953dda170 commit affa80bd97f7ca282d1faa91667b3ee9e4c590e6 upstream. When running a 32-bit userspace on a 64-bit kernel, the UI_SET_PHYS ioctl needs to be treated with special care, as it has the pointer size encoded in the command. Signed-off-by: Ricky Liang <jcliang@chromium.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit affa80bd97f7ca282d1faa91667b3ee9e4c590e6 upstream.

When running a 32-bit userspace on a 64-bit kernel, the UI_SET_PHYS
ioctl needs to be treated with special care, as it has the pointer
size encoded in the command.

Signed-off-by: Ricky Liang <jcliang@chromium.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Input: max8997-haptic - fix NULL pointer dereference 2016-05-19T00:03:59+00:00 Marek Szyprowski m.szyprowski@samsung.com 2016-05-09T16:31:47+00:00 9a048abff4355201ca945d2e9ebe64ec4755c446 commit 6ae645d5fa385f3787bf1723639cd907fe5865e7 upstream. NULL pointer derefence happens when booting with DTB because the platform data for haptic device is not set in supplied data from parent MFD device. The MFD device creates only platform data (from Device Tree) for itself, not for haptic child. Unable to handle kernel NULL pointer dereference at virtual address 0000009c pgd = c0004000 [0000009c] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM (max8997_haptic_probe) from [<c03f9cec>] (platform_drv_probe+0x4c/0xb0) (platform_drv_probe) from [<c03f8440>] (driver_probe_device+0x214/0x2c0) (driver_probe_device) from [<c03f8598>] (__driver_attach+0xac/0xb0) (__driver_attach) from [<c03f67ac>] (bus_for_each_dev+0x68/0x9c) (bus_for_each_dev) from [<c03f7a38>] (bus_add_driver+0x1a0/0x218) (bus_add_driver) from [<c03f8db0>] (driver_register+0x78/0xf8) (driver_register) from [<c0101774>] (do_one_initcall+0x90/0x1d8) (do_one_initcall) from [<c0a00dbc>] (kernel_init_freeable+0x15c/0x1fc) (kernel_init_freeable) from [<c06bb5b4>] (kernel_init+0x8/0x114) (kernel_init) from [<c0107938>] (ret_from_fork+0x14/0x3c) Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Fixes: 104594b01ce7 ("Input: add driver support for MAX8997-haptic") [k.kozlowski: Write commit message, add CC-stable] Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 6ae645d5fa385f3787bf1723639cd907fe5865e7 upstream.

NULL pointer derefence happens when booting with DTB because the
platform data for haptic device is not set in supplied data from parent
MFD device.

The MFD device creates only platform data (from Device Tree) for itself,
not for haptic child.

Unable to handle kernel NULL pointer dereference at virtual address 0000009c
pgd = c0004000
	[0000009c] *pgd=00000000
	Internal error: Oops: 5 [#1] PREEMPT SMP ARM
	(max8997_haptic_probe) from [<c03f9cec>] (platform_drv_probe+0x4c/0xb0)
	(platform_drv_probe) from [<c03f8440>] (driver_probe_device+0x214/0x2c0)
	(driver_probe_device) from [<c03f8598>] (__driver_attach+0xac/0xb0)
	(__driver_attach) from [<c03f67ac>] (bus_for_each_dev+0x68/0x9c)
	(bus_for_each_dev) from [<c03f7a38>] (bus_add_driver+0x1a0/0x218)
	(bus_add_driver) from [<c03f8db0>] (driver_register+0x78/0xf8)
	(driver_register) from [<c0101774>] (do_one_initcall+0x90/0x1d8)
	(do_one_initcall) from [<c0a00dbc>] (kernel_init_freeable+0x15c/0x1fc)
	(kernel_init_freeable) from [<c06bb5b4>] (kernel_init+0x8/0x114)
	(kernel_init) from [<c0107938>] (ret_from_fork+0x14/0x3c)

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Fixes: 104594b01ce7 ("Input: add driver support for MAX8997-haptic")
[k.kozlowski: Write commit message, add CC-stable]
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Input: ati_remote2 - fix crashes on detecting device with invalid descriptor 2016-04-12T16:12:48+00:00 Vladis Dronov vdronov@redhat.com 2016-03-23T18:53:46+00:00 52844be6f96c447577de40ea7d2f4019457a7dd9 commit 950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d upstream. The ati_remote2 driver expects at least two interfaces with one endpoint each. If given malicious descriptor that specify one interface or no endpoints, it will crash in the probe function. Ensure there is at least two interfaces and one endpoint for each interface before using it. The full disclosure: http://seclists.org/bugtraq/2016/Mar/90 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d upstream.

The ati_remote2 driver expects at least two interfaces with one
endpoint each. If given malicious descriptor that specify one
interface or no endpoints, it will crash in the probe function.
Ensure there is at least two interfaces and one endpoint for each
interface before using it.

The full disclosure: http://seclists.org/bugtraq/2016/Mar/90

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Input: ims-pcu - sanity check against missing interfaces 2016-04-12T16:12:48+00:00 Oliver Neukum oneukum@suse.com 2016-03-17T21:00:17+00:00 665bbcb66051e1176a159d270e53d439f9dc8c80 commit a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff upstream. A malicious device missing interface can make the driver oops. Add sanity checking. Signed-off-by: Oliver Neukum <ONeukum@suse.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff upstream.

A malicious device missing interface can make the driver oops.
Add sanity checking.

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Input: powermate - fix oops with malicious USB descriptors 2016-04-12T16:12:42+00:00 Josh Boyer jwboyer@fedoraproject.org 2016-03-14T16:33:40+00:00 5c91a520b0d6d2700c96d3b8198d7e3cfddce538 commit 9c6ba456711687b794dcf285856fc14e2c76074f upstream. The powermate driver expects at least one valid USB endpoint in its probe function. If given malicious descriptors that specify 0 for the number of endpoints, it will crash. Validate the number of endpoints on the interface before using them. The full report for this issue can be found here: http://seclists.org/bugtraq/2016/Mar/85 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 9c6ba456711687b794dcf285856fc14e2c76074f upstream.

The powermate driver expects at least one valid USB endpoint in its
probe function.  If given malicious descriptors that specify 0 for
the number of endpoints, it will crash.  Validate the number of
endpoints on the interface before using them.

The full report for this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/85

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2014-03-28T20:03:00+00:00 Linus Torvalds torvalds@linux-foundation.org 2014-03-28T20:03:00+00:00 2946369ee277fa9fcc3372aabddc9c15dfabf744 Pull input subsystem fixes from Dmitry Torokhov: "Updates to Synaptics touchpad to better cope with devices in Lenovo laptops, and a couple more fixes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: synaptics - add manual min/max quirk for ThinkPad X240 Input: synaptics - add manual min/max quirk Input: cypress_ps2 - don't report as a button pads Input: da9052_onkey - use correct register bit for key status Input: adp5588-keys - get value from data out when dir is out 
Pull input subsystem fixes from Dmitry Torokhov:
 "Updates to Synaptics touchpad to better cope with devices in Lenovo
  laptops, and a couple more fixes"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: synaptics - add manual min/max quirk for ThinkPad X240
  Input: synaptics - add manual min/max quirk
  Input: cypress_ps2 - don't report as a button pads
  Input: da9052_onkey - use correct register bit for key status
  Input: adp5588-keys - get value from data out when dir is out
ASoC: dapm: Add locking to snd_soc_dapm_xxxx_pin functions 2014-02-20T09:40:07+00:00 Charles Keepax ckeepax@opensource.wolfsonmicro.com 2014-02-18T15:22:14+00:00 113911006442a36c2b4669faf1699d9042ef80ab The snd_soc_dapm_xxxx_pin all require the dapm_mutex to be held when they are called as they edit the dirty list, however very few of the callers do so. This patch adds unlocked versions of all the functions replacing the existing implementations with one that holds the lock internally. We also fix up the places where the lock was actually held on the caller side. Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> Signed-off-by: Mark Brown <broonie@linaro.org> Cc: stable@vger.kernel.org 
The snd_soc_dapm_xxxx_pin all require the dapm_mutex to be held when
they are called as they edit the dirty list, however very few of the
callers do so.

This patch adds unlocked versions of all the functions replacing the
existing implementations with one that holds the lock internally. We
also fix up the places where the lock was actually held on the caller
side.

Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org
Input - arizona-haptics: Fix double lock of dapm_mutex 2014-02-20T09:37:13+00:00 Charles Keepax ckeepax@opensource.wolfsonmicro.com 2014-02-18T15:22:12+00:00 c4204960e9d0ba99459dbf1db918f99a45e7a62a snd_soc_dapm_sync takes the dapm_mutex internally, but we currently take it externally as well. This patch fixes this. Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> Signed-off-by: Mark Brown <broonie@linaro.org> Cc: stable@vger.kernel.org 
snd_soc_dapm_sync takes the dapm_mutex internally, but we currently take
it externally as well. This patch fixes this.

Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org
Input: da9052_onkey - use correct register bit for key status 2014-02-17T19:29:01+00:00 Anthony Olech anthony.olech.opensource@diasemi.com 2014-02-17T19:23:39+00:00 70b0052425ffd549bb27fb08649a4d30daaf40e4 The wrong register bit of the DA9052/3 PMIC registers was used to determine the status on the ONKEY. Also a failure in reading the status register will no longer result in the work queue being rescheduled as that would result in a (potentially) endless retry. Signed-off-by: Anthony Olech <anthony.olech.opensource@diasemi.com> Acked-by: David Dajun Chen <david.chen@diasemi.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
The wrong register bit of the DA9052/3 PMIC registers was
used to determine the status on the ONKEY.

Also a failure in reading the status register will no longer
result in the work queue being rescheduled as that would result
in a (potentially) endless retry.

Signed-off-by: Anthony Olech <anthony.olech.opensource@diasemi.com>
Acked-by: David Dajun Chen <david.chen@diasemi.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2014-01-25T01:17:30+00:00 Linus Torvalds torvalds@linux-foundation.org 2014-01-25T01:17:30+00:00 1b59bab55e36082b1db3dc81bb32475616487a98 Pull input subsystem updates from Dmitry Torokhov: "Just a swath of driver fixes and cleanups, no new drivers this time (although ALPS now supports one of the newer protocols, more to come)" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (57 commits) Input: wacom - add support for DTU-1031 Input: wacom - fix wacom->shared guards for dual input devices Input: edt_ft5x06 - use devm_* functions where appropriate Input: hyperv-keyboard - pass through 0xE1 prefix Input: logips2pp - fix spelling s/reciver/receiver/ Input: delete non-required instances of include <linux/init.h> Input: twl4030-keypad - convert to using managed resources Input: twl6040-vibra - remove unneeded check for CONFIG_OF Input: twl4030-keypad - add device tree support Input: twl6040-vibra - add missing of_node_put Input: twl4030-vibra - add missing of_node_put Input: i8042 - cleanup SERIO_I8042 dependencies Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO on x86 Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO on unicore32 Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO on sparc Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO for SH_CAYMAN Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO on powerpc Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO on mips Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO on IA64 Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO on ARM/Footbridge ... 
Pull input subsystem updates from Dmitry Torokhov:
 "Just a swath of driver fixes and cleanups, no new drivers this time
  (although ALPS now supports one of the newer protocols, more to come)"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (57 commits)
  Input: wacom - add support for DTU-1031
  Input: wacom - fix wacom->shared guards for dual input devices
  Input: edt_ft5x06 - use devm_* functions where appropriate
  Input: hyperv-keyboard - pass through 0xE1 prefix
  Input: logips2pp - fix spelling s/reciver/receiver/
  Input: delete non-required instances of include <linux/init.h>
  Input: twl4030-keypad - convert to using managed resources
  Input: twl6040-vibra - remove unneeded check for CONFIG_OF
  Input: twl4030-keypad - add device tree support
  Input: twl6040-vibra - add missing of_node_put
  Input: twl4030-vibra - add missing of_node_put
  Input: i8042 - cleanup SERIO_I8042 dependencies
  Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO on x86
  Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO on unicore32
  Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO on sparc
  Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO for SH_CAYMAN
  Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO on powerpc
  Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO on mips
  Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO on IA64
  Input: i8042 - select ARCH_MIGHT_HAVE_PC_SERIO on ARM/Footbridge
  ...