linux-stable.git/drivers/input/misc, branch v3.16.65

Input: twl6040-vibra - fix child-node lookup

2018-03-03T15:52:17+00:00

commit dcaf12a8b0bbdbfcfa2be8dff2c4948d9844b4ad upstream.

Fix child-node lookup during probe, which ended up searching the whole
device tree depth-first starting at parent rather than just matching on
its children.

Later sanity checks on node properties (which would likely be missing)
should prevent this from causing much trouble however, especially as the
original premature free of the parent node has already been fixed
separately (but that "fix" was apparently never backported to stable).

Fixes: e7ec014a47e4 ("Input: twl6040-vibra - update for device tree support")
Fixes: c52c545ead97 ("Input: twl6040-vibra - fix DT node memory management")
Signed-off-by: Johan Hovold 
Acked-by: Peter Ujfalusi 
Tested-by: H. Nikolaus Schaller  (on Pyra OMAP5 hardware)
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: twl6040-vibra - fix DT node memory management

2018-03-03T15:52:17+00:00

commit c52c545ead97fcc2f4f8ea38f1ae3c23211e09a8 upstream.

commit e7ec014a47e4 ("Input: twl6040-vibra - update for device tree support")

made the separate vibra DT node to a subnode of the twl6040.

It now calls of_find_node_by_name() to locate the "vibra" subnode.
This function has a side effect to call of_node_put on() for the twl6040
parent node passed in as a parameter. This causes trouble later on.

Solution: we must call of_node_get() before of_find_node_by_name()

Signed-off-by: H. Nikolaus Schaller 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: twl4030-vibra - fix sibling-node lookup

2018-03-03T15:52:17+00:00

commit 5b189201993ab03001a398de731045bfea90c689 upstream.

A helper purported to look up a child node based on its name was using
the wrong of-helper and ended up prematurely freeing the parent of-node
while searching the whole device tree depth-first starting at the parent
node.

Fixes: 64b9e4d803b1 ("input: twl4030-vibra: Support for DT booted kernel")
Fixes: e661d0a04462 ("Input: twl4030-vibra - fix ERROR: Bad of_node_put() warning")
Signed-off-by: Johan Hovold 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: twl4030-vibra - fix ERROR: Bad of_node_put() warning

2018-03-03T15:52:16+00:00

commit e661d0a04462dd98667f8947141bd8defab5b34a upstream.

Fix following:
[    8.862274] ERROR: Bad of_node_put() on /ocp/i2c@48070000/twl@48/audio
[    8.869293] CPU: 0 PID: 1003 Comm: modprobe Not tainted 4.2.0-rc2-letux+ #1175
[    8.876922] Hardware name: Generic OMAP36xx (Flattened Device Tree)
[    8.883514] [] (unwind_backtrace) from [] (show_stack+0x10/0x14)
[    8.891693] [] (show_stack) from [] (dump_stack+0x78/0x94)
[    8.899322] [] (dump_stack) from [] (kobject_release+0x68/0x7c)
[    8.907409] [] (kobject_release) from [] (twl4030_vibra_probe+0x74/0x188 [twl4030_vibra])
[    8.917877] [] (twl4030_vibra_probe [twl4030_vibra]) from [] (platform_drv_probe+0x48/0x90)
[    8.928497] [] (platform_drv_probe) from [] (really_probe+0xd4/0x238)
[    8.937103] [] (really_probe) from [] (driver_probe_device+0x30/0x48)
[    8.945678] [] (driver_probe_device) from [] (__driver_attach+0x68/0x8c)
[    8.954589] [] (__driver_attach) from [] (bus_for_each_dev+0x50/0x84)
[    8.963226] [] (bus_for_each_dev) from [] (bus_add_driver+0xcc/0x1e4)
[    8.971832] [] (bus_add_driver) from [] (driver_register+0x9c/0xe0)
[    8.980255] [] (driver_register) from [] (do_one_initcall+0x100/0x1b8)
[    8.988983] [] (do_one_initcall) from [] (do_init_module+0x58/0x1c0)
[    8.997497] [] (do_init_module) from [] (SyS_init_module+0x54/0x64)
[    9.005950] [] (SyS_init_module) from [] (ret_fast_syscall+0x0/0x54)
[    9.015838] input: twl4030:vibrator as /devices/platform/68000000.ocp/48070000.i2c/i2c-0/0-0048/48070000.i2c:twl@48:audio/input/input2

node passed to of_find_node_by_name is put inside that function and new node
is returned if found. Free returned node not already freed node.

Signed-off-by: Marek Belisko 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: adxl34x - do not treat FIFO_MODE() as boolean

2018-02-13T18:42:02+00:00

commit 1dbc080c9ef6bcfba652ef0d6ae919b8c7c85a1d upstream.

FIFO_MODE() is a macro expression with a '<<' operator, which gcc points
out could be misread as a '<':

drivers/input/misc/adxl34x.c: In function 'adxl34x_probe':
drivers/input/misc/adxl34x.c:799:36: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context]

While utility of this warning is being disputed (Chief Penguin: "This
warning is clearly pure garbage.") FIFO_MODE() extracts range of values,
with 0 being FIFO_BYPASS, and not something that is logically boolean.

This converts the test to an explicit comparison with FIFO_BYPASS,
making it clearer to gcc and the reader what is intended.

Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: ims-psu - check if CDC union descriptor is sane

2018-01-01T20:52:08+00:00

commit ea04efee7635c9120d015dcdeeeb6988130cb67a upstream.

Before trying to use CDC union descriptor, try to validate whether that it
is sane by checking that intf->altsetting->extra is big enough and that
descriptor bLength is not too big and not too small.

Reported-by: Andrey Konovalov 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: uinput - avoid crash when sending FF request to device going away

2018-01-01T20:51:36+00:00

commit 6b4877c7bdc6ae39ce03716df7caeecf204697eb upstream.

If FF request comes in while uinput device is going away,
uinput_request_send() will fail with -ENODEV, and uinput_request_submit()
will attempt to mark the slot as unused by calling uinput_request_done().
Unfortunately in this case we haven't initialized request->done completion
yet, and we get a crash:

[   39.402036] BUG: spinlock bad magic on CPU#1, fftest/3108
[   39.402046]  lock: 0xffff88006a93bb00, .magic: 00000000, .owner: /39, .owner_cpu: 1217155072
[   39.402055] CPU: 1 PID: 3108 Comm: fftest Tainted: G        W 4.13.0+ #15
[   39.402059] Hardware name: LENOVO 20HQS0EG02/20HQS0EG02, BIOS N1MET37W (1.22 ) 07/04/2017
[   39.402064]  0000000000000086 f0fad82f3ceaa120 ffff88006a93b9a0 ffffffff9de941bb
[   39.402077]  ffff88026df8ae00 ffff88006a93bb00 ffff88006a93b9c0 ffffffff9dca62b7
[   39.402088]  ffff88006a93bb00 ffff88006a93baf8 ffff88006a93b9e0 ffffffff9dca62e7
[   39.402099] Call Trace:
[   39.402112]  [] dump_stack+0x4d/0x63
[   39.402123]  [] spin_dump+0x97/0x9c
[   39.402130]  [] spin_bug+0x2b/0x2d
[   39.402138]  [] do_raw_spin_lock+0x28/0xfd
[   39.402147]  [] _raw_spin_lock_irqsave+0x19/0x1f
[   39.402154]  [] complete+0x1d/0x48
[   39.402162]  [] 0xffffffffc04f30af
[   39.402167]  [] 0xffffffffc04f468c
[   39.402177]  [] ? __slab_free+0x22f/0x359
[   39.402184]  [] ? tk_clock_read+0xc/0xe
[   39.402189]  [] 0xffffffffc04f471f
[   39.402195]  [] ? __wake_up+0x44/0x4b
[   39.402200]  [] ? 0xffffffffc04f3240
[   39.402207]  [] erase_effect+0xa1/0xd2
[   39.402214]  [] input_ff_flush+0x43/0x5c
[   39.402219]  [] 0xffffffffc04f32ad
[   39.402227]  [] input_flush_device+0x3d/0x51
[   39.402234]  [] evdev_flush+0x49/0x5c
[   39.402243]  [] filp_close+0x3f/0x65
[   39.402253]  [] put_files_struct+0x66/0xc1
[   39.402261]  [] exit_files+0x47/0x4e
[   39.402270]  [] do_exit+0x483/0x969
[   39.402278]  [] ? recalc_sigpending_tsk+0x3d/0x44
[   39.402285]  [] do_group_exit+0x42/0xb0
[   39.402293]  [] get_signal+0x58d/0x5bf
[   39.402300]  [] do_signal+0x37/0x53e
[   39.402307]  [] ? evdev_ioctl_handler+0xac8/0xb04
[   39.402314]  [] ? evdev_ioctl+0x10/0x12
[   39.402321]  [] ? do_vfs_ioctl+0x42e/0x501
[   39.402328]  [] prepare_exit_to_usermode+0x66/0x90
[   39.402333]  [] syscall_return_slowpath+0xe3/0xec
[   39.402339]  [] int_ret_from_sys_call+0x25/0x8f

While we could solve this by simply initializing the completion earlier, we
are better off rearranging the code a bit so we avoid calling complete() on
requests that we did not send out. This patch consolidates marking request
slots as free in one place (in uinput_request_submit(), the same place
where we acquire them) and having everyone else simply signal completion
of the requests.

Fixes: 00ce756ce53a ("Input: uinput - mark failed submission requests as free")
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: uinput - avoid FF flush when destroying device

2018-01-01T20:51:36+00:00

commit e8b95728f724797f958912fd9b765a695595d3a6 upstream.

Normally, when input device supporting force feedback effects is being
destroyed, we try to "flush" currently playing effects, so that the
physical device does not continue vibrating (or executing other effects).
Unfortunately this does not work well for uinput as flushing of the effects
deadlocks with the destroy action:

- if device is being destroyed because the file descriptor is being closed,
  then there is noone to even service FF requests;

- if device is being destroyed because userspace sent UI_DEV_DESTROY,
  while theoretically it could be possible to service FF requests,
  userspace is unlikely to do so (they'd need to make sure FF handling
  happens on a separate thread) even if kernel solves the issue with FF
  ioctls deadlocking with UI_DEV_DESTROY ioctl on udev->mutex.

To avoid lockups like the one below, let's install a custom input device
flush handler, and avoid trying to flush force feedback effects when we
destroying the device, and instead rely on uinput to shut off the device
properly.

NMI watchdog: Watchdog detected hard LOCKUP on cpu 3
...
 <>  [] _raw_spin_lock_irqsave+0x37/0x40
 [] complete+0x1d/0x50
 [] uinput_request_done+0x3c/0x40 [uinput]
 [] uinput_request_submit.part.7+0x47/0xb0 [uinput]
 [] uinput_dev_erase_effect+0x5b/0x76 [uinput]
 [] erase_effect+0xad/0xf0
 [] flush_effects+0x4d/0x90
 [] input_flush_device+0x40/0x60
 [] evdev_cleanup+0xac/0xc0
 [] evdev_disconnect+0x2b/0x60
 [] __input_unregister_device+0xac/0x150
 [] input_unregister_device+0x47/0x70
 [] uinput_destroy_device+0xb5/0xc0 [uinput]
 [] uinput_ioctl_handler.isra.9+0x65e/0x740 [uinput]
 [] ? do_futex+0x12b/0xad0
 [] uinput_ioctl+0x18/0x20 [uinput]
 [] do_vfs_ioctl+0x298/0x480
 [] ? security_file_ioctl+0x43/0x60
 [] SyS_ioctl+0x79/0x90
 [] entry_SYSCALL_64_fastpath+0x12/0x71

Reported-by: Rodrigo Rivas Costa 
Reported-by: Clément VUCHENER 
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=193741
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: twl4030-pwrbutton - use correct device for irq request

2017-08-26T01:14:42+00:00

commit 3071e9dd6cd3f2290d770117330f2c8b2e9a97e4 upstream.

The interrupt should be requested for the platform device
and not for the input device.

Fixes: 7f9ce649d267 ("Input: twl4030-pwrbutton - simplify driver using devm_*")
Signed-off-by: Sebastian Reichel 
Signed-off-by: Dmitry Torokhov 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

Input: yealink - validate number of endpoints before using them

2017-07-18T17:40:17+00:00

commit 5cc4a1a9f5c179795c8a1f2b0f4361829d6a070e upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.

Fixes: aca951a22a1d ("[PATCH] input-driver-yealink-P1K-usb-phone")
Signed-off-by: Johan Hovold 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings