linux-stable.git/drivers/input/touchscreen, branch linux-6.3.y

Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync()

2023-07-11T17:39:33+00:00

[ Upstream commit dbe836576f12743a7d2d170ad4ad4fd324c4d47a ]

The watchdog_timer can schedule tx_timeout_task and watchdog_work
can also arm watchdog_timer. The process is shown below:

----------- timer schedules work ------------
cyttsp4_watchdog_timer() //timer handler
  schedule_work(&cd->watchdog_work)

----------- work arms timer ------------
cyttsp4_watchdog_work() //workqueue callback function
  cyttsp4_start_wd_timer()
    mod_timer(&cd->watchdog_timer, ...)

Although del_timer_sync() and cancel_work_sync() are called in
cyttsp4_remove(), the timer and workqueue could still be rearmed.
As a result, the possible use after free bugs could happen. The
process is shown below:

  (cleanup routine)           |  (timer and workqueue routine)
cyttsp4_remove()              | cyttsp4_watchdog_timer() //timer
  cyttsp4_stop_wd_timer()     |   schedule_work()
    del_timer_sync()          |
                              | cyttsp4_watchdog_work() //worker
                              |   cyttsp4_start_wd_timer()
                              |     mod_timer()
    cancel_work_sync()        |
                              | cyttsp4_watchdog_timer() //timer
                              |   schedule_work()
    del_timer_sync()          |
  kfree(cd) //FREE            |
                              | cyttsp4_watchdog_work() // reschedule!
                              |   cd-> //USE

This patch changes del_timer_sync() to timer_shutdown_sync(),
which could prevent rearming of the timer from the workqueue.

Fixes: 17fb1563d69b ("Input: cyttsp4 - add core driver for Cypress TMA4XX touchscreen devices")
Signed-off-by: Duoming Zhou 
Link: https://lore.kernel.org/r/20230421082919.8471-1-duoming@zju.edu.cn
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: cyttsp5 - fix array length

2023-06-14T09:16:53+00:00

commit 529de2f1ca3f0898c0d905b7d355a43dce1de7dc upstream.

The cmd array should be initialized with the proper command size and not
with the actual command value that is sent to the touchscreen.

Signed-off-by: Maximilian Weigand 
Reviewed-by: Alistair Francis 
Link: https://lore.kernel.org/r/20230501113010.891786-2-mweigand@mweigand.net
Fixes: 5b0c03e24a06 ("Input: Add driver for Cypress Generation 5 touchscreen")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe

2023-05-11T14:17:33+00:00

[ Upstream commit 5bca3688bdbc3b58a2894b8671a8e2378efe28bd ]

rpi_firmware_get() take reference, we need to release it in error paths
as well. Use devm_rpi_firmware_get() helper to handling the resources.
Also remove the existing rpi_firmware_put().

Fixes: 0b9f28fed3f7 ("Input: add official Raspberry Pi's touchscreen driver")
Fixes: 3b8ddff780b7 ("input: raspberrypi-ts: Release firmware handle when not needed")
Signed-off-by: Miaoqian Lin 
Reviewed-by: Mattijs Korpershoek 
Link: https://lore.kernel.org/r/20221223074657.810346-1-linmq006@gmail.com
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Merge tag 'input-for-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2023-04-23T14:46:52+00:00

Pull input fixes from Dmitry Torokhov:

 - a check in pegasus-notetaker driver to validate the type of pipe when
   probing a new device

 - a fix for Cypress touch controller to correctly parse maximum number
   of touches.

* tag 'input-for-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: cyttsp5 - fix sensing configuration data structure
  Input: pegasus-notetaker - check pipe type when probing

Input: cyttsp5 - fix sensing configuration data structure

2023-04-14T06:44:12+00:00

Prior to this patch, the sensing configuration data was not parsed
correctly, breaking detection of max_tch. The vendor driver includes
this field. This change informs the driver about the correct maximum
number of simultaneous touch inputs.

Tested on a Pine64 PineNote with a modified touch screen controller
firmware.

Signed-off-by: hrdl 
Reviewed-by: Alistair Francis 
Link: https://lore.kernel.org/r/20230411211651.3791304-1-git@hrdl.eu
Signed-off-by: Dmitry Torokhov

Merge tag 'input-for-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2023-04-01T21:09:51+00:00

Pull input fixes from Dmitry Torokhov:

 - fixes to ALPS and Focaltech PS/2 drivers dealing with the breakage of
   switching to -funsigned-char

 - quirks to i8042 to better handle Lifebook A574/H and TUXEDO devices

 - a quirk to Goodix touchscreen driver to handle Yoga Book X90F

 - a fix for incorrectly merged patch to xpad game controller driver

* tag 'input-for-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: i8042 - add TUXEDO devices to i8042 quirk tables for partial fix
  Input: alps - fix compatibility with -funsigned-char
  Input: focaltech - use explicitly signed char type
  Input: xpad - fix incorrectly applied patch for MAP_PROFILE_BUTTON
  Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table
  Input: i8042 - add quirk for Fujitsu Lifebook A574/H

Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table

2023-03-17T10:24:40+00:00

The Android Lenovo Yoga Book X90F / X90L uses the same goodix touchscreen
with 9 bytes touch reports for its touch keyboard as the already supported
Windows Lenovo Yoga Book X91F/L, add a DMI match for this to
the nine_bytes_report DMI table.

When the quirk for the X91F/L was initially added it was written to
also apply to the X90F/L but this does not work because the Android
version of the Yoga Book uses completely different DMI strings.
Also adjust the X91F/L quirk to reflect that it only applies to
the X91F/L models.

Signed-off-by: Hans de Goede 
Reviewed-by: Bastien Nocera 
Link: https://lore.kernel.org/r/20230315134442.71787-1-hdegoede@redhat.com
Signed-off-by: Dmitry Torokhov

Merge tag 'input-for-v6.3-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2023-02-25T23:01:32+00:00

Pull input updates from Dmitry Torokhov:

 - a set of tweaks to iqs269a touch controller driver

 - a fix for ads7846 driver to properly handle 7845 chip

 - cap11xx driver will support cap1203, cap1293 and cap1298 models

 - xpad driver will support 8BitDo Pro 2 Wired Controller

 - input drivers have been switched to DEFINE_SIMPLE_DEV_PM_OPS() and
   pm_sleep_ptr()

 - other miscellaneous fixes and tweaks

* tag 'input-for-v6.3-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (113 commits)
  dt-bindings: input: iqs626a: Redefine trackpad property types
  Input: iqs626a - drop unused device node references
  dt-bindings: input: touchscreen: st,stmfts: convert to dtschema
  Input: cyttsp5 - fix bitmask for touch buttons
  Input: exc3000 - properly stop timer on shutdown
  Input: synaptics-rmi4 - fix SPI device ID
  Input: cap11xx - add support for cap1203, cap1293 and cap1298
  dt-bindings: input: microchip,cap11xx: add cap1203, cap1293 and cap1298
  Input: pmic8xxx-keypad - fix a Kconfig spelling mistake & hyphenation
  Input: edt-ft5x06 - fix typo in a comment
  Input: tegra-kbc - use devm_platform_get_and_ioremap_resource()
  Input: st-keyscan - use devm_platform_get_and_ioremap_resource()
  Input: spear-keyboard - use devm_platform_get_and_ioremap_resource()
  Input: olpc_apsp - use devm_platform_get_and_ioremap_resource()
  Input: arc_ps2 - use devm_platform_get_and_ioremap_resource()
  Input: apbps2 - use devm_platform_get_and_ioremap_resource()
  Input: altera_ps2 - use devm_platform_get_and_ioremap_resource()
  Input: ads7846 - don't check penirq immediately for 7845
  Input: ads7846 - always set last command to PWRDOWN
  Input: ads7846 - don't report pressure for ads7845
  ...

Input: cyttsp5 - fix bitmask for touch buttons

2023-02-04T00:59:15+00:00

Prior to this patch, the bitmask ends up being 0x3, as opposed to 0x1
which likely was the intention. The erroneous bit results in the driver
reporting 2 different button activations in designs with 2 or more
buttons.

To detect which button has been pressed, cyttsp5_btn_attention() uses a
for loop to iterate through the input buffer, while shifting and
applying a bitmask to determine the state for each button.
Unfortunately, when the bitmask is 0x3 and there are multiple buttons,
this procedure falls apart.

Consider a design with 3 buttons. Pressing the third button will result
in a call to cyttsp5_btn_attention() with the input buffer containing
0x4 (binary 0100). In the first iteration of the for loop cur_btn_state
will be:

(0x4 >> 0 * 1) & 0x3 = 0x4 & 0x3 = 0x0

This is correct. However, in the next iteration this happens:

(0x4 >> 1 * 1) & 0x3 = 0x2 & 0x3 = 0x2

Which means that a key event for key 1 is generated, even though it's
not really active. In the third iteration, the loop detects the button
that was actually pressed:

(0x4 >> 2 * 1) & 0x3 = 0x1 & 0x3 = 0x1

This key event is the only one that should have been detected, but it is
accompanied by the preceding key. Ensuring the applied mask is 0x1
solves this problem.

Signed-off-by: Richard Kjerstadius 
Reviewed-by: Alistair Francis 
Link: https://lore.kernel.org/r/20230127102903.3317089-1-richard.kjerstadius@teledyne.com
Signed-off-by: Dmitry Torokhov

Input: exc3000 - properly stop timer on shutdown

2023-02-04T00:58:44+00:00

We need to stop the timer on driver unbind or probe failures, otherwise
we get UAF/Oops.

Fixes: 7e577a17f2ee ("Input: add I2C attached EETI EXC3000 multi touch driver")
Reported-by: "Stahl, Michael" 
Link: https://lore.kernel.org/r/Y9dK57BFqtlf8NmN@google.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov