linux-stable.git/drivers/input, branch v3.16.52

Input: ims-psu - check if CDC union descriptor is sane

2018-01-01T20:52:08+00:00

commit ea04efee7635c9120d015dcdeeeb6988130cb67a upstream.

Before trying to use CDC union descriptor, try to validate whether that it
is sane by checking that intf->altsetting->extra is big enough and that
descriptor bLength is not too big and not too small.

Reported-by: Andrey Konovalov 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: ti_am335x_tsc - fix incorrect step config for 5 wire touchscreen

2018-01-01T20:51:56+00:00

commit cf5dd48907bebaefdb43a8ca079be77e8da2cb20 upstream.

Step config setting for 5 wire touchscreen is incorrect for Y coordinates.
It was broken while we moved to DT. If you look close at the offending
commit bb76dc09ddfc ("input: ti_am33x_tsc: Order of TSC wires, made
configurable"), the change was:

- STEPCONFIG_XNP | STEPCONFIG_YPN;
+ ts_dev->bit_xn | ts_dev->bit_yp;

while bit_xn = STEPCONFIG_XNN and bit_yp = STEPCONFIG_YNN. Not quite the
same.

Fixes: bb76dc09ddfc ("input: ti_am33x_tsc: Order of TSC wires, made configurable")
Signed-off-by: Jeff Lance 
[vigneshr@ti.com: Rebase to v4.14-rc1]
Signed-off-by: Vignesh R 
Reviewed-by: Michael Nazzareno Trimarchi 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: uinput - avoid crash when sending FF request to device going away

2018-01-01T20:51:36+00:00

commit 6b4877c7bdc6ae39ce03716df7caeecf204697eb upstream.

If FF request comes in while uinput device is going away,
uinput_request_send() will fail with -ENODEV, and uinput_request_submit()
will attempt to mark the slot as unused by calling uinput_request_done().
Unfortunately in this case we haven't initialized request->done completion
yet, and we get a crash:

[   39.402036] BUG: spinlock bad magic on CPU#1, fftest/3108
[   39.402046]  lock: 0xffff88006a93bb00, .magic: 00000000, .owner: /39, .owner_cpu: 1217155072
[   39.402055] CPU: 1 PID: 3108 Comm: fftest Tainted: G        W 4.13.0+ #15
[   39.402059] Hardware name: LENOVO 20HQS0EG02/20HQS0EG02, BIOS N1MET37W (1.22 ) 07/04/2017
[   39.402064]  0000000000000086 f0fad82f3ceaa120 ffff88006a93b9a0 ffffffff9de941bb
[   39.402077]  ffff88026df8ae00 ffff88006a93bb00 ffff88006a93b9c0 ffffffff9dca62b7
[   39.402088]  ffff88006a93bb00 ffff88006a93baf8 ffff88006a93b9e0 ffffffff9dca62e7
[   39.402099] Call Trace:
[   39.402112]  [] dump_stack+0x4d/0x63
[   39.402123]  [] spin_dump+0x97/0x9c
[   39.402130]  [] spin_bug+0x2b/0x2d
[   39.402138]  [] do_raw_spin_lock+0x28/0xfd
[   39.402147]  [] _raw_spin_lock_irqsave+0x19/0x1f
[   39.402154]  [] complete+0x1d/0x48
[   39.402162]  [] 0xffffffffc04f30af
[   39.402167]  [] 0xffffffffc04f468c
[   39.402177]  [] ? __slab_free+0x22f/0x359
[   39.402184]  [] ? tk_clock_read+0xc/0xe
[   39.402189]  [] 0xffffffffc04f471f
[   39.402195]  [] ? __wake_up+0x44/0x4b
[   39.402200]  [] ? 0xffffffffc04f3240
[   39.402207]  [] erase_effect+0xa1/0xd2
[   39.402214]  [] input_ff_flush+0x43/0x5c
[   39.402219]  [] 0xffffffffc04f32ad
[   39.402227]  [] input_flush_device+0x3d/0x51
[   39.402234]  [] evdev_flush+0x49/0x5c
[   39.402243]  [] filp_close+0x3f/0x65
[   39.402253]  [] put_files_struct+0x66/0xc1
[   39.402261]  [] exit_files+0x47/0x4e
[   39.402270]  [] do_exit+0x483/0x969
[   39.402278]  [] ? recalc_sigpending_tsk+0x3d/0x44
[   39.402285]  [] do_group_exit+0x42/0xb0
[   39.402293]  [] get_signal+0x58d/0x5bf
[   39.402300]  [] do_signal+0x37/0x53e
[   39.402307]  [] ? evdev_ioctl_handler+0xac8/0xb04
[   39.402314]  [] ? evdev_ioctl+0x10/0x12
[   39.402321]  [] ? do_vfs_ioctl+0x42e/0x501
[   39.402328]  [] prepare_exit_to_usermode+0x66/0x90
[   39.402333]  [] syscall_return_slowpath+0xe3/0xec
[   39.402339]  [] int_ret_from_sys_call+0x25/0x8f

While we could solve this by simply initializing the completion earlier, we
are better off rearranging the code a bit so we avoid calling complete() on
requests that we did not send out. This patch consolidates marking request
slots as free in one place (in uinput_request_submit(), the same place
where we acquire them) and having everyone else simply signal completion
of the requests.

Fixes: 00ce756ce53a ("Input: uinput - mark failed submission requests as free")
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: uinput - avoid FF flush when destroying device

2018-01-01T20:51:36+00:00

commit e8b95728f724797f958912fd9b765a695595d3a6 upstream.

Normally, when input device supporting force feedback effects is being
destroyed, we try to "flush" currently playing effects, so that the
physical device does not continue vibrating (or executing other effects).
Unfortunately this does not work well for uinput as flushing of the effects
deadlocks with the destroy action:

- if device is being destroyed because the file descriptor is being closed,
  then there is noone to even service FF requests;

- if device is being destroyed because userspace sent UI_DEV_DESTROY,
  while theoretically it could be possible to service FF requests,
  userspace is unlikely to do so (they'd need to make sure FF handling
  happens on a separate thread) even if kernel solves the issue with FF
  ioctls deadlocking with UI_DEV_DESTROY ioctl on udev->mutex.

To avoid lockups like the one below, let's install a custom input device
flush handler, and avoid trying to flush force feedback effects when we
destroying the device, and instead rely on uinput to shut off the device
properly.

NMI watchdog: Watchdog detected hard LOCKUP on cpu 3
...
 <>  [] _raw_spin_lock_irqsave+0x37/0x40
 [] complete+0x1d/0x50
 [] uinput_request_done+0x3c/0x40 [uinput]
 [] uinput_request_submit.part.7+0x47/0xb0 [uinput]
 [] uinput_dev_erase_effect+0x5b/0x76 [uinput]
 [] erase_effect+0xad/0xf0
 [] flush_effects+0x4d/0x90
 [] input_flush_device+0x40/0x60
 [] evdev_cleanup+0xac/0xc0
 [] evdev_disconnect+0x2b/0x60
 [] __input_unregister_device+0xac/0x150
 [] input_unregister_device+0x47/0x70
 [] uinput_destroy_device+0xb5/0xc0 [uinput]
 [] uinput_ioctl_handler.isra.9+0x65e/0x740 [uinput]
 [] ? do_futex+0x12b/0xad0
 [] uinput_ioctl+0x18/0x20 [uinput]
 [] do_vfs_ioctl+0x298/0x480
 [] ? security_file_ioctl+0x43/0x60
 [] SyS_ioctl+0x79/0x90
 [] entry_SYSCALL_64_fastpath+0x12/0x71

Reported-by: Rodrigo Rivas Costa 
Reported-by: Clément VUCHENER 
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=193741
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: gtco - fix potential out-of-bound access

2017-11-26T13:50:39+00:00

commit a50829479f58416a013a4ccca791336af3c584c7 upstream.

parse_hid_report_descriptor() has a while (i < length) loop, which
only guarantees that there's at least 1 byte in the buffer, but the
loop body can read multiple bytes which causes out-of-bounds access.

Reported-by: Andrey Konovalov 
Reviewed-by: Andrey Konovalov 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: i8042 - add Gigabyte P57 to the keyboard reset table

2017-11-26T13:50:38+00:00

commit 697c5d8a36768b36729533fb44622b35d56d6ad0 upstream.

Similar to other Gigabyte laptops, the touchpad on P57 requires a
keyboard reset to detect Elantech touchpad correctly.

BugLink: https://bugs.launchpad.net/bugs/1594214
Signed-off-by: Kai-Heng Feng 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: xpad - validate USB endpoint type during probe

2017-11-26T13:50:36+00:00

commit 122d6a347329818419b032c5a1776e6b3866d9b9 upstream.

We should only see devices with interrupt endpoints. Ignore any other
endpoints that we find, so we don't send try to send them interrupt URBs
and trigger a WARN down in the USB stack.

Reported-by: Andrey Konovalov 
Tested-by: Andrey Konovalov 
Signed-off-by: Cameron Gutman 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: xpad - don't depend on endpoint order

2017-11-26T13:50:36+00:00

commit c01b5e7464f0cf20936d7467c7528163c4e2782d upstream.

The order of endpoints is well defined on official Xbox pads, but
we have found at least one 3rd-party pad that doesn't follow the
standard ("Titanfall 2 Xbox One controller" 0e6f:0165).

Fortunately, we get lucky with this specific pad because it uses
endpoint addresses that differ only by direction. We know that
there are other pads out where this is not true, so let's go
ahead and fix this.

Signed-off-by: Cameron Gutman 
Signed-off-by: Dmitry Torokhov 
[bwh: Backported to 3.16:
 - Use 'fail3' label in case of failure
 - Adjust context]
Signed-off-by: Ben Hutchings

Input: xpad - add support for Xbox One controllers

2017-11-26T13:50:36+00:00

commit 1a48ff81b3912be5fadae3fafde6c2f632246a4c upstream.

Xbox One controllers require an initialization message to start sending
data, so xpad_init_output becomes a required function. The Xbox One
controller does not have LEDs like the Xbox 360 controller, so that
functionality is not implemented. The format of messages controlling rumble
is currently undocumented, so rumble support is not yet implemented.

Note that Xbox One controller advertises three interfaces with the same
interface class, subclass and protocol, so we have to also match against
interface number.

Signed-off-by: Ted Mielczarek 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: ucb1400_ts - fix suspend and resume handling

2017-11-26T13:50:36+00:00

commit 39467fc1054a91efa697162a94e5b0e1a4b7b580 upstream.

Instead of stopping the touchscreen we were starting it in suspend, and
disabling it in resume.

Fixes: c899afedf168 ("Input: ucb1400_ts - convert to threaded IRQ")
Reported-by: Anton Volkov 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings