linux-stable.git/drivers/input/rmi4, branch v6.8

Merge tag 'input-for-v6.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2024-03-08T21:06:35+00:00

Pull input updates from Dmitry Torokhov:

 - a revert of endpoint checks in bcm5974 - the driver is being naughty
   and pokes at unclaimed USB interface, so the check fails. We need to
   fix the driver to claim both interfaces, and then re-implement the
   endpoints check

 - a fix to Synaptics RMI driver to avoid UAF on driver unload or device
   unbinding

 - a few new VID/PIDs added to xpad game controller driver

 - a change to gpio_keys_polled driver to quiet it when GPIO causes
   probe deferral.

* tag 'input-for-v6.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
  Input: gpio_keys_polled - suppress deferred probe error for gpio
  Revert "Input: bcm5974 - check endpoint type before starting traffic"
  Input: xpad - add additional HyperX Controller Identifiers

Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal

2024-03-07T23:29:52+00:00

Calling irq_domain_remove() will lead to freeing the IRQ domain
prematurely. The domain is still referenced and will be attempted to get
used via rmi_free_function_list() -> rmi_unregister_function() ->
irq_dispose_mapping() -> irq_get_irq_data()'s ->domain pointer.

With PaX's MEMORY_SANITIZE this will lead to an access fault when
attempting to dereference embedded pointers, as in Torsten's report that
was faulting on the 'domain->ops->unmap' test.

Fix this by releasing the IRQ domain only after all related IRQs have
been deactivated.

Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain")
Reported-by: Torsten Hilbrich 
Signed-off-by: Mathias Krause 
Link: https://lore.kernel.org/r/20240222142654.856566-1-minipli@grsecurity.net
Signed-off-by: Dmitry Torokhov

Merge tag 'input-for-v6.8-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2024-01-19T01:21:35+00:00

Pull input updates from Dmitry Torokhov:

 - a new driver for Adafruit Seesaw gamepad device

 - Zforce touchscreen will handle standard device properties for axis
   swap/inversion

 - handling of advanced sensitivity settings in Microchip CAP11xx
   capacitive sensor driver

 - more drivers have been converted to use newer gpiod API

 - support for dedicated wakeup IRQs in gpio-keys dirver

 - support for slider gestures and OTP variants in iqs269a driver

 - atkbd will report keyboard version as 0xab83 in cases when GET ID
   command was skipped (to deal with problematic firmware on newer
   laptops), restoring the previous behavior

 - other assorted cleanups and changes

* tag 'input-for-v6.8-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (44 commits)
  Input: atkbd - use ab83 as id when skipping the getid command
  Input: driver for Adafruit Seesaw Gamepad
  dt-bindings: input: bindings for Adafruit Seesaw Gamepad
  Input: da9063_onkey - avoid explicitly setting input's parent
  Input: da9063_onkey - avoid using OF-specific APIs
  Input: iqs269a - add support for OTP variants
  dt-bindings: input: iqs269a: Add bindings for OTP variants
  Input: iqs269a - add support for slider gestures
  dt-bindings: input: iqs269a: Add bindings for slider gestures
  Input: gpio-keys - filter gpio_keys -EPROBE_DEFER error messages
  Input: zforce_ts - accept standard touchscreen properties
  dt-bindings: touchscreen: neonode,zforce: Use standard properties
  dt-bindings: touchscreen: convert neonode,zforce to json-schema
  dt-bindings: input: convert drv266x to json-schema
  Input: da9063 - use dev_err_probe()
  Input: da9063 - drop redundant prints in probe()
  Input: da9063 - simplify obtaining OF match data
  Input: as5011 - convert to GPIO descriptor
  Input: omap-keypad - drop optional GPIO support
  Input: tca6416-keypad - drop unused include
  ...

Merge branch 'next' into for-linus

2024-01-14T05:54:39+00:00

Prepare input updates for 6.8 merge window.

Input: synaptics-rmi4 - use sysfs_emit() to instead of scnprintf()

2023-12-14T05:26:12+00:00

Replace calls to scnprintf() in the methods showing device attributes
with sysfs_emit() to simplify the code.

Signed-off-by: ye xingchen 
Link: https://lore.kernel.org/r/202212011551429834598@zte.com.cn
Signed-off-by: Dmitry Torokhov

treewide, spi: Get rid of SPI_MASTER_HALF_DUPLEX

2023-11-16T11:47:45+00:00

The SPI_MASTER_HALF_DUPLEX is the legacy name of a definition
for a half duplex flag. Since all others had been replaced with
the respective SPI_CONTROLLER prefix get rid of the last one
as well. There is no functional change intended.

Signed-off-by: Andy Shevchenko 
Acked-by: Greg Kroah-Hartman 
Acked-by: Ulf Hansson  # For MMC
Acked-by: Dmitry Torokhov  # for input
Acked-by: Paolo Abeni 
Link: https://lore.kernel.org/r/20231113111249.3982461-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Mark Brown

Merge branch 'next' into for-linus

2023-11-06T23:42:08+00:00

Prepare input updates for 6.7 merge window.

Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()

2023-10-29T02:54:52+00:00

The put_device() calls rmi_release_function() which frees "fn" so the
dereference on the next line "fn->num_of_irqs" is a use after free.
Move the put_device() to the end to fix this.

Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain")
Signed-off-by: Dan Carpenter 
Link: https://lore.kernel.org/r/706efd36-7561-42f3-adfa-dd1d0bd4f5a1@moroto.mountain
Signed-off-by: Dmitry Torokhov

Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport

2023-10-14T00:59:19+00:00

Touch controllers need some time after receiving reset command for the
firmware to finish re-initializing and be ready to respond to commands
from the host. The driver already had handling for the post-reset delay
for I2C and SPI transports, this change adds the handling to
SMBus-connected devices.

SMBus devices are peculiar because they implement legacy PS/2
compatibility mode, so reset is actually issued by psmouse driver on the
associated serio port, after which the control is passed to the RMI4
driver with SMBus companion device.

Note that originally the delay was added to psmouse driver in
92e24e0e57f7 ("Input: psmouse - add delay when deactivating for SMBus
mode"), but that resulted in an unwanted delay in "fast" reconnect
handler for the serio port, so it was decided to revert the patch and
have the delay being handled in the RMI4 driver, similar to the other
transports.

Tested-by: Jeffery Miller 
Link: https://lore.kernel.org/r/ZR1yUFJ8a9Zt606N@penguin
Signed-off-by: Dmitry Torokhov

Input: synaptics-rmi4 - replace deprecated strncpy

2023-09-30T16:24:15+00:00

`strncpy` is deprecated for use on NUL-terminated destination strings [1]

Let's use memcpy() as the bounds have already been checked and this
decays into a simple byte copy from one buffer to another removing any
ambiguity that strncpy has.

Signed-off-by: Justin Stitt 
Reviewed-by: Kees Cook 
Link: https://lore.kernel.org/r/20230921-strncpy-drivers-input-rmi4-rmi_f34-c-v1-1-4aef2e84b8d2@google.com
Signed-off-by: Dmitry Torokhov