linux-stable.git/drivers/input/misc, branch linux-6.5.y

Input: powermate - fix use-after-free in powermate_config_complete

2023-10-19T21:11:05+00:00

commit 5c15c60e7be615f05a45cd905093a54b11f461bc upstream.

syzbot has found a use-after-free bug [1] in the powermate driver. This
happens when the device is disconnected, which leads to a memory free from
the powermate_device struct.  When an asynchronous control message
completes after the kfree and its callback is invoked, the lock does not
exist anymore and hence the bug.

Use usb_kill_urb() on pm->config to cancel any in-progress requests upon
device disconnection.

[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e

Signed-off-by: Javier Carrasco 
Reported-by: syzbot+0434ac83f907a1dbdd1e@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20230916-topic-powermate_use_after_free-v3-1-64412b81a7a2@gmail.com
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

Input: iqs7222 - configure power mode before triggering ATI

2023-09-19T10:30:13+00:00

[ Upstream commit 2e00b8bf5624767f6be7427b6eb532524793463e ]

If the device drops into ultra-low-power mode before being placed
into normal-power mode as part of ATI being triggered, the device
does not assert any interrupts until the ATI routine is restarted
two seconds later.

Solve this problem by adopting the vendor's recommendation, which
calls for the device to be placed into normal-power mode prior to
being configured and ATI being triggered.

The original implementation followed this sequence, but the order
was inadvertently changed as part of the resolution of a separate
erratum.

Fixes: 1e4189d8af27 ("Input: iqs7222 - protect volatile registers")
Signed-off-by: Jeff LaBundy 
Link: https://lore.kernel.org/r/ZKrpHc2Ji9qR25r2@nixie71
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Merge tag 'input-for-v6.5-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2023-06-29T17:29:46+00:00

Pull input updates from Dmitry Torokhov:

 - improvements to PS/2 handling for case when EC has already latched a
   scancode in the data register, but the kernel expects to receive an
   ACK to a command it sent to a device (such as keyboard LED toggle)

 - input drivers for devices connected over I2C bus have been switched
   back to using [new] .probe()

 - uinput allows userspace to inject timestamps for input events

 - support for capacitive keys in Atmel touch controller driver

 - assorted fixes to drv260x, pwm-vibra, ili210x, adxl34x, and other
   drivers

* tag 'input-for-v6.5-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (40 commits)
  Input: pm8941-powerkey - fix debounce on gen2+ PMICs
  MAINTAINERS: Adjust Qualcomm driver globbing
  Input: gameport - provide default trigger() and read()
  Input: tps65219-pwrbutton - use regmap_set_bits()
  Input: tps65219-pwrbutton - convert to .remove_new()
  Input: tests - add test to cover all input_grab_device() function
  Input: gpio-keys - use input_report_key()
  Input: xpad - spelling fixes for "Xbox"
  Input: add HAS_IOPORT dependencies
  Input: libps2 - do not discard non-ack bytes when controlling LEDs
  Input: libps2 - introduce common interrupt handler
  Input: libps2 - fix aborting PS/2 commands
  Input: libps2 - fix NAK handling
  Input: libps2 - rework handling of command response
  Input: libps2 - remove special handling of ACK for command byte
  Input: libps2 - attach ps2dev instances as serio port's drvdata
  Input: Switch i2c drivers back to use .probe()
  dt-bindings: input: cypress,cyapa: convert to dtschema
  Input: adxl34x - do not hardcode interrupt trigger type
  Input: pwm-vibra - add support for enable GPIO
  ...

Merge branch 'next' into for-linus

2023-06-26T22:18:13+00:00

Prepare input updates for 6.5 merge window.

Add Renesas PMIC RAA215300 and built-in RTC

2023-06-24T00:57:59+00:00

Merge series from Biju Das :

This patch series aims to add support for Renesas PMIC RAA215300 and
built-in RTC found on this PMIC device.

The details of PMIC can be found here[1].

Renesas PMIC RAA215300 exposes two separate i2c devices, one for the main
device and another for rtc device.

Input: pm8941-powerkey - fix debounce on gen2+ PMICs

2023-06-06T19:11:15+00:00

Since PM8998/PM660, the power key debounce register was redefined to
support shorter debounce times. On PM8941 the shortest debounce time
(represented by register value 0) was 15625us, on PM8998 the shortest
debounce time is 62us, with the default being 2ms.

Adjust the bit shift to correctly program debounce on PM8998 and newer.

Fixes: 68c581d5e7d8 ("Input: add Qualcomm PM8941 power key driver")
Signed-off-by: Caleb Connolly 
Link: https://lore.kernel.org/r/20230529-pm8941-pwrkey-debounce-v1-2-c043a6d5c814@linaro.org
Signed-off-by: Dmitry Torokhov

Input: tps65219-pwrbutton - use regmap_set_bits()

2023-06-06T18:11:58+00:00

regmap_set_bits() is equivalent to regmap_update_bits() if mask == val.
The probe function uses regmap_clear_bits() to enable irqs, so
symmetrically make use of regmap_set_bits() to disable them. There is no
semantic difference.

Signed-off-by: Uwe Kleine-König 
Reviewed-by: Markus Schneider-Pargmann 
Link: https://lore.kernel.org/r/20230605161458.117361-2-u.kleine-koenig@pengutronix.de
Signed-off-by: Dmitry Torokhov

Input: tps65219-pwrbutton - convert to .remove_new()

2023-06-06T18:11:57+00:00

The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart from
emitting a warning).

To improve here there is a quest to make the remove callback return void.
In the first step of this quest all drivers are converted to .remove_new()
which already returns void. Eventually after all drivers are converted,
.remove_new() is renamed to .remove().

Before this driver might have returned an error. In this case emit a
warning that tells more about the problem than the generic warning by
the core, and instead of making the remove callback return zero
unconditionally, convert to .remove_new() which is equivalent.

Signed-off-by: Uwe Kleine-König 
Reviewed-by: Markus Schneider-Pargmann 
Link: https://lore.kernel.org/r/20230605161458.117361-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Dmitry Torokhov

Input: Switch i2c drivers back to use .probe()

2023-05-17T16:59:11+00:00

After commit b8a1a4cd5a98 ("i2c: Provide a temporary .probe_new()
call-back type"), all drivers being converted to .probe_new() and then
03c835f498b5 ("i2c: Switch .probe() to not take an id parameter") convert
back to (the new) .probe() to be able to eventually drop .probe_new() from
struct i2c_driver.

Signed-off-by: Uwe Kleine-König 
Link: https://lore.kernel.org/r/20230517164645.162294-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Dmitry Torokhov

mfd: rk808: Split into core and i2c

2023-05-15T15:19:03+00:00

Split rk808 into a core and an i2c part in preparation for
SPI support.

Acked-by: Alexandre Belloni  # for RTC
Tested-by: Diederik de Haas  # Rock64, Quartz64 Model A + B
Tested-by: Vincent Legoll  # Pine64 QuartzPro64
Signed-off-by: Sebastian Reichel 
Link: https://lore.kernel.org/r/20230504173618.142075-6-sebastian.reichel@collabora.com
Signed-off-by: Lee Jones