linux-stable.git/drivers/input, branch v4.1.26

Input: pwm-beeper - fix - scheduling while atomic

2016-06-06T23:12:35+00:00

[ Upstream commit f49cf3b8b4c841457244c461c66186a719e13bcc ]

Pwm config may sleep so defer it using a worker.

On a Freescale i.MX53 based board we ran into "BUG: scheduling while
atomic" because input_inject_event locks interrupts, but
imx_pwm_config_v2 sleeps.

Tested on Freescale i.MX53 SoC with 4.6.0.

Signed-off-by: Manfred Schlaegl 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: uinput - handle compat ioctl for UI_SET_PHYS

2016-06-06T23:12:32+00:00

[ Upstream commit affa80bd97f7ca282d1faa91667b3ee9e4c590e6 ]

When running a 32-bit userspace on a 64-bit kernel, the UI_SET_PHYS
ioctl needs to be treated with special care, as it has the pointer
size encoded in the command.

Signed-off-by: Ricky Liang 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: max8997-haptic - fix NULL pointer dereference

2016-05-17T17:43:06+00:00

[ Upstream commit 6ae645d5fa385f3787bf1723639cd907fe5865e7 ]

NULL pointer derefence happens when booting with DTB because the
platform data for haptic device is not set in supplied data from parent
MFD device.

The MFD device creates only platform data (from Device Tree) for itself,
not for haptic child.

Unable to handle kernel NULL pointer dereference at virtual address 0000009c
pgd = c0004000
	[0000009c] *pgd=00000000
	Internal error: Oops: 5 [#1] PREEMPT SMP ARM
	(max8997_haptic_probe) from [] (platform_drv_probe+0x4c/0xb0)
	(platform_drv_probe) from [] (driver_probe_device+0x214/0x2c0)
	(driver_probe_device) from [] (__driver_attach+0xac/0xb0)
	(__driver_attach) from [] (bus_for_each_dev+0x68/0x9c)
	(bus_for_each_dev) from [] (bus_add_driver+0x1a0/0x218)
	(bus_add_driver) from [] (driver_register+0x78/0xf8)
	(driver_register) from [] (do_one_initcall+0x90/0x1d8)
	(do_one_initcall) from [] (kernel_init_freeable+0x15c/0x1fc)
	(kernel_init_freeable) from [] (kernel_init+0x8/0x114)
	(kernel_init) from [] (ret_from_fork+0x14/0x3c)

Signed-off-by: Marek Szyprowski 
Cc: 
Fixes: 104594b01ce7 ("Input: add driver support for MAX8997-haptic")
[k.kozlowski: Write commit message, add CC-stable]
Signed-off-by: Krzysztof Kozlowski 
Signed-off-by: Dmitry Torokhov 

Signed-off-by: Sasha Levin

Input: gtco - fix crash on detecting device without endpoints

2016-05-08T12:08:58+00:00

[ Upstream commit 162f98dea487206d9ab79fc12ed64700667a894d ]

The gtco driver expects at least one valid endpoint. If given malicious
descriptors that specify 0 for the number of endpoints, it will crash in
the probe function. Ensure there is at least one endpoint on the interface
before using it.

Also let's fix a minor coding style issue.

The full correct report of this issue can be found in the public
Red Hat Bugzilla:

https://bugzilla.redhat.com/show_bug.cgi?id=1283385

Reported-by: Ralf Spenneberg 
Signed-off-by: Vladis Dronov 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: ati_remote2 - fix crashes on detecting device with invalid descriptor

2016-04-18T12:51:08+00:00

[ Upstream commit 950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d ]

The ati_remote2 driver expects at least two interfaces with one
endpoint each. If given malicious descriptor that specify one
interface or no endpoints, it will crash in the probe function.
Ensure there is at least two interfaces and one endpoint for each
interface before using it.

The full disclosure: http://seclists.org/bugtraq/2016/Mar/90

Reported-by: Ralf Spenneberg 
Signed-off-by: Vladis Dronov 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: synaptics - handle spurious release of trackstick buttons, again

2016-04-18T12:51:02+00:00

[ Upstream commit 82be788c96ed5978d3cb4a00079e26b981a3df3f ]

Looks like the fimware 8.2 still has the extra buttons spurious release
bug.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=114321
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: ims-pcu - sanity check against missing interfaces

2016-04-18T12:51:01+00:00

[ Upstream commit a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff ]

A malicious device missing interface can make the driver oops.
Add sanity checking.

Signed-off-by: Oliver Neukum 
CC: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: powermate - fix oops with malicious USB descriptors

2016-04-18T12:50:57+00:00

[ Upstream commit 9c6ba456711687b794dcf285856fc14e2c76074f ]

The powermate driver expects at least one valid USB endpoint in its
probe function.  If given malicious descriptors that specify 0 for
the number of endpoints, it will crash.  Validate the number of
endpoints on the interface before using them.

The full report for this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/85

Reported-by: Ralf Spenneberg 
Cc: stable 
Signed-off-by: Josh Boyer 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: vmmouse - fix absolute device registration

2016-02-23T05:49:36+00:00

[ Upstream commit d4f1b06d685d11ebdaccf11c0db1cb3c78736862 ]

We should set device's capabilities first, and then register it,
otherwise various handlers already present in the kernel will not be
able to connect to the device.

Reported-by: Lauri Kasanen 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

Input: elantech - mark protocols v2 and v3 as semi-mt

2016-02-03T19:01:46+00:00

[ Upstream commit 6544a1df11c48c8413071aac3316792e4678fbfb ]

When using a protocol v2 or v3 hardware, elantech uses the function
elantech_report_semi_mt_data() to report data. This devices are rather
creepy because if num_finger is 3, (x2,y2) is (0,0). Yes, only one valid
touch is reported.

Anyway, userspace (libinput) is now confused by these (0,0) touches,
and detect them as palm, and rejects them.

Commit 3c0213d17a09 ("Input: elantech - fix semi-mt protocol for v3 HW")
was sufficient enough for xf86-input-synaptics and libinput before it has
palm rejection. Now we need to actually tell libinput that this device is
a semi-mt one and it should not rely on the actual values of the 2 touches.

Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin