linux-stable.git/drivers/input/misc, branch v3.18.46

Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delay

2016-07-12T12:47:46+00:00

[ Upstream commit eda5ecc0a6b865561997e177c393f0b0136fe3b7 ]

The trigger delay algorithm that converts from microseconds to
the register value looks incorrect. According to most of the PMIC
documentation, the equation is

	delay (Seconds) = (1 / 1024) * 2 ^ (x + 4)

except for one case where the documentation looks to have a
formatting issue and the equation looks like

	delay (Seconds) = (1 / 1024) * 2 x + 4

Most likely this driver was written with the improper
documentation to begin with. According to the downstream sources
the valid delays are from 2 seconds to 1/64 second, and the
latter equation just doesn't make sense for that. Let's fix the
algorithm and the range check to match the documentation and the
downstream sources.

Reported-by: Bjorn Andersson 
Fixes: 92d57a73e410 ("input: Add support for Qualcomm PMIC8XXX power key")
Signed-off-by: Stephen Boyd 
Tested-by: John Stultz 
Acked-by: Bjorn Andersson 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: uinput - handle compat ioctl for UI_SET_PHYS

2016-06-06T23:11:09+00:00

[ Upstream commit affa80bd97f7ca282d1faa91667b3ee9e4c590e6 ]

When running a 32-bit userspace on a 64-bit kernel, the UI_SET_PHYS
ioctl needs to be treated with special care, as it has the pointer
size encoded in the command.

Signed-off-by: Ricky Liang 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: max8997-haptic - fix NULL pointer dereference

2016-05-18T01:56:34+00:00

[ Upstream commit 6ae645d5fa385f3787bf1723639cd907fe5865e7 ]

NULL pointer derefence happens when booting with DTB because the
platform data for haptic device is not set in supplied data from parent
MFD device.

The MFD device creates only platform data (from Device Tree) for itself,
not for haptic child.

Unable to handle kernel NULL pointer dereference at virtual address 0000009c
pgd = c0004000
	[0000009c] *pgd=00000000
	Internal error: Oops: 5 [#1] PREEMPT SMP ARM
	(max8997_haptic_probe) from [] (platform_drv_probe+0x4c/0xb0)
	(platform_drv_probe) from [] (driver_probe_device+0x214/0x2c0)
	(driver_probe_device) from [] (__driver_attach+0xac/0xb0)
	(__driver_attach) from [] (bus_for_each_dev+0x68/0x9c)
	(bus_for_each_dev) from [] (bus_add_driver+0x1a0/0x218)
	(bus_add_driver) from [] (driver_register+0x78/0xf8)
	(driver_register) from [] (do_one_initcall+0x90/0x1d8)
	(do_one_initcall) from [] (kernel_init_freeable+0x15c/0x1fc)
	(kernel_init_freeable) from [] (kernel_init+0x8/0x114)
	(kernel_init) from [] (ret_from_fork+0x14/0x3c)

Signed-off-by: Marek Szyprowski 
Cc: 
Fixes: 104594b01ce7 ("Input: add driver support for MAX8997-haptic")
[k.kozlowski: Write commit message, add CC-stable]
Signed-off-by: Krzysztof Kozlowski 
Signed-off-by: Dmitry Torokhov 

Signed-off-by: Sasha Levin

Input: ati_remote2 - fix crashes on detecting device with invalid descriptor

2016-04-18T12:49:39+00:00

[ Upstream commit 950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d ]

The ati_remote2 driver expects at least two interfaces with one
endpoint each. If given malicious descriptor that specify one
interface or no endpoints, it will crash in the probe function.
Ensure there is at least two interfaces and one endpoint for each
interface before using it.

The full disclosure: http://seclists.org/bugtraq/2016/Mar/90

Reported-by: Ralf Spenneberg 
Signed-off-by: Vladis Dronov 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: ims-pcu - sanity check against missing interfaces

2016-04-18T12:49:34+00:00

[ Upstream commit a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff ]

A malicious device missing interface can make the driver oops.
Add sanity checking.

Signed-off-by: Oliver Neukum 
CC: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: powermate - fix oops with malicious USB descriptors

2016-04-18T12:49:30+00:00

[ Upstream commit 9c6ba456711687b794dcf285856fc14e2c76074f ]

The powermate driver expects at least one valid USB endpoint in its
probe function.  If given malicious descriptors that specify 0 for
the number of endpoints, it will crash.  Validate the number of
endpoints on the interface before using them.

The full report for this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/85

Reported-by: Ralf Spenneberg 
Cc: stable 
Signed-off-by: Josh Boyer 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2014-11-14T22:31:54+00:00

Pull input subsystem updates from Dmitry Torokhov:
 "Mostly small fixups to PS/2 tochpad drivers (ALPS, Elantech,
  Synaptics) to better deal with specific hardware"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: elantech - update the documentation
  Input: elantech - provide a sysfs knob for crc_enabled
  Input: elantech - report the middle button of the touchpad
  Input: alps - ignore bad data on Dell Latitudes E6440 and E7440
  Input: alps - allow up to 2 invalid packets without resetting device
  Input: alps - ignore potential bare packets when device is out of sync
  Input: elantech - fix crc_enabled for Fujitsu H730
  Input: elantech - use elantech_report_trackpoint for hardware v4 too
  Input: twl4030-pwrbutton - ensure a wakeup event is recorded.
  Input: synaptics - add min/max quirk for Lenovo T440s

Input: twl4030-pwrbutton - ensure a wakeup event is recorded.

2014-11-08T08:26:44+00:00

This button is treated as a wakeup source, so we need to initialise it
correctly.

Without the device_init_wakeup() call, dev->power.wakeup will
be NULL, and pm_wakeup_event() will do nothing.

Signed-off-by: NeilBrown 
Signed-off-by: Dmitry Torokhov

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2014-11-01T02:51:11+00:00

Pull input updates from Dmitry Torokhov:
 "A bunch of fixes for minor defects reported by Coverity, a few driver
  fixups and revert of i8042.nomux change so that we are once again
  enable active MUX mode if box claims to support it"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Revert "Input: i8042 - disable active multiplexing by default"
  Input: altera_ps2 - use correct type for irq return value
  Input: altera_ps2 - write to correct register when disabling interrupts
  Input: max77693-haptic - fix potential overflow
  Input: psmouse - remove unneeded check in psmouse_reconnect()
  Input: vsxxxaa - fix code dropping bytes from queue
  Input: ims-pcu - fix dead code in ims_pcu_ofn_reg_addr_store()
  Input: opencores-kbd - fix error handling
  Input: wm97xx - adapt parameters to tosa touchscreen.
  Input: i8042 - quirks for Fujitsu Lifebook A544 and Lifebook AH544
  Input: stmpe-keypad - fix valid key line bitmask
  Input: soc_button_array - update calls to gpiod_get*()

Input: max77693-haptic - fix potential overflow

2014-10-31T16:30:44+00:00

Expression haptic->pwm_dev->period * haptic->magnitude is of type
'unsigned int' and may overflow. We need to convert one of the operands
to u64 before multiplying, instead of casting result (potentially
overflown) to u64.

Reported by Coverity: CID 1248753

Acked-by : Jaewon Kim 
Reviewed-by: Chanwoo Choi 
Signed-off-by: Dmitry Torokhov