linux-stable.git/drivers/input/touchscreen, branch v4.1.41

Input: sur40 - validate number of endpoints before using them

2017-05-17T19:07:02+00:00

[ Upstream commit 92461f5d723037530c1f36cce93640770037812c ]

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory that lie beyond the end of the endpoint
array should a malicious device lack the expected endpoints.

Fixes: bdb5c57f209c ("Input: add sur40 driver for Samsung SUR40... ")
Signed-off-by: Johan Hovold 
Cc: stable@vger.kernel.org	# 3.13
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: elants_i2c - avoid divide by 0 errors on bad touchscreen data

2017-03-06T22:29:11+00:00

[ Upstream commit 1c3415a06b1016a596bfe59e0cfee56c773aa958 ]

The following crash may be seen if bad data is received from the
touchscreen.

[ 2189.425150] elants_i2c i2c-ELAN0001:00: unknown packet ff ff ff ff
[ 2189.430738] divide error: 0000 [#1] PREEMPT SMP
[ 2189.434679] gsmi: Log Shutdown Reason 0x03
[ 2189.434689] Modules linked in: ip6t_REJECT nf_reject_ipv6 rfcomm evdi
uinput uvcvideo cmac videobuf2_vmalloc videobuf2_memops snd_hda_codec_hdmi
i2c_dev videobuf2_core snd_soc_sst_cht_bsw_rt5645 snd_hda_intel
snd_intel_sst_acpi btusb btrtl btbcm btintel bluetooth snd_soc_sst_acpi
snd_hda_codec snd_intel_sst_core snd_hwdep snd_soc_sst_mfld_platform
snd_hda_core snd_soc_rt5645 memconsole_x86_legacy memconsole zram snd_soc_rl6231
fuse ip6table_filter iwlmvm iwlwifi iwl7000_mac80211 cfg80211 iio_trig_sysfs
joydev cros_ec_sensors cros_ec_sensors_core industrialio_triggered_buffer
kfifo_buf industrialio snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq
snd_seq_device ppp_async ppp_generic slhc tun
[ 2189.434866] CPU: 0 PID: 106 Comm: irq/184-ELAN000 Tainted: G        W
3.18.0-13101-g57e8190 #1
[ 2189.434883] Hardware name: GOOGLE Ultima, BIOS Google_Ultima.7287.131.43 07/20/2016
[ 2189.434898] task: ffff88017a0b6d80 ti: ffff88017a2bc000 task.ti: ffff88017a2bc000
[ 2189.434913] RIP: 0010:[]  [] elants_i2c_irq+0x190/0x200
[ 2189.434937] RSP: 0018:ffff88017a2bfd98  EFLAGS: 00010293
[ 2189.434948] RAX: 0000000000000000 RBX: ffff88017a967828 RCX: ffff88017a9678e8
[ 2189.434962] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000000
[ 2189.434975] RBP: ffff88017a2bfdd8 R08: 00000000000003e8 R09: 0000000000000000
[ 2189.434989] R10: 0000000000000000 R11: 000000000044a2bd R12: ffff88017a991800
[ 2189.435001] R13: ffffffffbe8a2a53 R14: ffff88017a0b6d80 R15: ffff88017a0b6d80
[ 2189.435011] FS:  0000000000000000(0000) GS:ffff88017fc00000(0000) knlGS:0000000000000000
[ 2189.435022] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 2189.435030] CR2: 00007f678d94b000 CR3: 000000003f41a000 CR4: 00000000001007f0
[ 2189.435039] Stack:
[ 2189.435044]  ffff88017a2bfda8 ffff88017a9678e8 646464647a2bfdd8 0000000006e09574
[ 2189.435060]  0000000000000000 ffff88017a088b80 ffff88017a921000 ffffffffbe8a2a53
[ 2189.435074]  ffff88017a2bfe08 ffffffffbe8a2a73 ffff88017a0b6d80 0000000006e09574
[ 2189.435089] Call Trace:
[ 2189.435101]  [] ? irq_thread_dtor+0xa9/0xa9
[ 2189.435112]  [] irq_thread_fn+0x20/0x40
[ 2189.435123]  [] irq_thread+0x14e/0x222
[ 2189.435135]  [] ? __schedule+0x3b3/0x57a
[ 2189.435145]  [] ? wake_threads_waitq+0x2d/0x2d
[ 2189.435156]  [] ? irq_thread_fn+0x40/0x40
[ 2189.435168]  [] kthread+0x10e/0x116
[ 2189.435178]  [] ? __kthread_parkme+0x67/0x67
[ 2189.435189]  [] ret_from_fork+0x7c/0xb0
[ 2189.435199]  [] ? __kthread_parkme+0x67/0x67
[ 2189.435208] Code: ff ff eb 73 0f b6 bb c1 00 00 00 83 ff 03 7e 13 49 8d 7c
24 20 ba 04 00 00 00 48 c7 c6 8a cd 21 bf eb 4d 0f b6 83 c2 00 00 00 99  ff
83 f8 37 75 15 48 6b f7 37 4c 8d a3 c4 00 00 00 4c 8d ac
[ 2189.435312] RIP  [] elants_i2c_irq+0x190/0x200
[ 2189.435323]  RSP 
[ 2189.435350] ---[ end trace f4945345a75d96dd ]---
[ 2189.443841] Kernel panic - not syncing: Fatal exception
[ 2189.444307] Kernel Offset: 0x3d800000 from 0xffffffff81000000
	(relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 2189.444519] gsmi: Log Shutdown Reason 0x02

The problem was seen with a 3.18 based kernel, but there is no reason
to believe that the upstream code is safe.

Fixes: 66aee90088da2 ("Input: add support for Elan eKTH I2C touchscreens")
Signed-off-by: Guenter Roeck 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: zforce_ts - fix dual touch recognition

2016-07-11T03:07:18+00:00

[ Upstream commit 6984ab1ab35f422292b7781c65284038bcc0f6a6 ]

A wrong decoding of the touch coordinate message causes a wrong touch
ID. Touch ID for dual touch must be 0 or 1.

According to the actual Neonode nine byte touch coordinate coding,
the state is transported in the lower nibble and the touch ID in
the higher nibble of payload byte five.

Signed-off-by: Knut Wohlrab 
Signed-off-by: Oleksij Rempel 
Signed-off-by: Dirk Behme 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: wacom_w8001 - w8001_MAX_LENGTH should be 13

2016-07-11T00:20:02+00:00

[ Upstream commit 12afb34400eb2b301f06b2aa3535497d14faee59 ]

Somehow the patch that added two-finger touch support forgot to update
W8001_MAX_LENGTH from 11 to 13.

Signed-off-by: Ping Cheng 
Reviewed-by: Peter Hutterer 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen

2015-08-10T19:21:56+00:00

commit 968491709e5b1aaf429428814fff3d932fa90b60 upstream.

This patch fixes a problem in the usbtouchscreen driver for DMC TSC-30
touch screen.  Due to a missing delay between the RESET and SET_RATE
commands, the touch screen may become unresponsive during system startup or
driver loading.

According to the DMC documentation, a delay is needed after the RESET
command to allow the chip to complete its internal initialization. As this
delay is not guaranteed, we had a system where the touch screen
occasionally did not send any touch data. There was no other indication of
the problem.

The patch fixes the problem by adding a 150ms delay between the RESET and
SET_RATE commands.

Suggested-by: Jakob Mustafa 
Signed-off-by: Bernhard Bender 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

Input: pixcir_i2c_ts - fix receive error

2015-07-21T17:10:06+00:00

commit 469d7d22cea146e40efe8c330e5164b4d8f13934 upstream.

The i2c_master_recv() uses readsize to receive data from i2c but compares
to size of rdbuf which is always 27. This would cause problem when the
max_fingers is not 5. Change the comparison value to readsize instead.

Fixes: 36874c7e219 ("Input: pixcir_i2c_ts - support up to 5 fingers and
hardware tracking IDs:)

Signed-off-by: Frodo Lai 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2015-05-22T21:49:55+00:00

Pull input fixes from Dmitry Torokhov:
 "Updates for the input subsystem.

  The main change is that we tell joydev not to touch "absolute mice",
  such as VMware virtual mouse, as that produced bad result (cursor
  stuck in upper right corner) with games"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: smtpe-ts - wait 50mS until polling for pen-up
  Input: smtpe-ts - use msecs_to_jiffies() instead of HZ
  Input: joydev - don't classify the vmmouse as a joystick
  Input: vmmouse - do not reference non-existing version of X driver
  Input: alps - fix finger jumps on lifting 2 fingers on v7 touchpad
  Input: elantech - fix semi-mt protocol for v3 HW
  Input: sx8654 - fix memory allocation check

Input: smtpe-ts - wait 50mS until polling for pen-up

2015-05-22T00:06:13+00:00

Wait a little bit longer, 50mS instead of 20mS, until the driver starts
polling for pen-up. The problematic behavior before this patch is applied
is as follows. The behavior was observed on the STMPE610QTR controller.

Upon a physical pen-down event, the touchscreen reports one set of x-y-p
coordinates and a pen-down event. After that, the pen-up polling is
triggered and since the controller is not ready yet, the polling mistakenly
detects a pen-up event while the physical state is still such that the pen
is down on the touch surface.

The pen-up handling flushes the controller FIFO, so after that, all the
samples in the controller are discarded. The controller becomes ready
shortly after this bogus pen-up handling and does generate again a pen-down
interrupt. This time, the controller contains x-y-p samples which all read
as zero. Since pressure value is zero, this set of samples is effectively
ignored by userland.

In the end, the driver just bounces between pen-down and bogus pen-up
handling, generating no useful results. Fix this by giving the controller a
bit more time before polling it for pen-up.

Signed-off-by: Marek Vasut 
Reviewed-by: Viresh Kumar 
Signed-off-by: Dmitry Torokhov

Input: smtpe-ts - use msecs_to_jiffies() instead of HZ

2015-05-22T00:05:48+00:00

Use msecs_to_jiffies(20) instead of plain (HZ / 50), as the former is much
more explicit about it's behavior. We want to schedule the task 20 mS from
now, so make it explicit in the code.

Signed-off-by: Marek Vasut 
Reviewed-by: Viresh Kumar 
Signed-off-by: Dmitry Torokhov

Input: sx8654 - fix memory allocation check

2015-05-13T17:29:33+00:00

We have been testing wrong variable when trying to make sure that input
allocation succeeded.

Reported by Coverity (CID 1295918).

Acked-by: Sébastien Szymanski 
Signed-off-by: Dmitry Torokhov