summaryrefslogtreecommitdiff
path: root/drivers/input/misc
AgeCommit message (Collapse)Author
2020-04-28Input: keyspan-remote - fix control-message timeoutsJohan Hovold
commit ba9a103f40fc4a3ec7558ec9b0b97d4f92034249 upstream. The driver was issuing synchronous uninterruptible control requests without using a timeout. This could lead to the driver hanging on probe due to a malfunctioning (or malicious) device until the device is physically disconnected. While sleeping in probe the driver prevents other devices connected to the same hub from being added to (or removed from) the bus. The USB upper limit of five seconds per request should be more than enough. Fixes: 99f83c9c9ac9 ("[PATCH] USB: add driver for Keyspan Digital Remote") Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20200113171715.30621-1-johan@kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2019-10-05Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOADAndrey Smirnov
commit 7c7da40da1640ce6814dab1e8031b44e19e5a3f6 upstream. In the case of compat syscall ioctl numbers for UI_BEGIN_FF_UPLOAD and UI_END_FF_UPLOAD need to be adjusted before being passed on uinput_ioctl_handler() since code built with -m32 will be passing slightly different values. Extend the code already covering UI_SET_PHYS to cover UI_BEGIN_FF_UPLOAD and UI_END_FF_UPLOAD as well. Reported-by: Pierre-Loup A. Griffais <pgriffais@valvesoftware.com> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2019-05-02Input: bma150 - register input device after setting private dataJonathan Bakker
commit 90cc55f067f6ca0e64e5e52883ece47d8af7b67b upstream. Otherwise we introduce a race condition where userspace can request input before we're ready leading to null pointer dereference such as input: bma150 as /devices/platform/i2c-gpio-2/i2c-5/5-0038/input/input3 Unable to handle kernel NULL pointer dereference at virtual address 00000018 pgd = (ptrval) [00000018] *pgd=55dac831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] PREEMPT ARM Modules linked in: bma150 input_polldev [last unloaded: bma150] CPU: 0 PID: 2870 Comm: accelerometer Not tainted 5.0.0-rc3-dirty #46 Hardware name: Samsung S5PC110/S5PV210-based board PC is at input_event+0x8/0x60 LR is at bma150_report_xyz+0x9c/0xe0 [bma150] pc : [<80450f70>] lr : [<7f0a614c>] psr: 800d0013 sp : a4c1fd78 ip : 00000081 fp : 00020000 r10: 00000000 r9 : a5e2944c r8 : a7455000 r7 : 00000016 r6 : 00000101 r5 : a7617940 r4 : 80909048 r3 : fffffff2 r2 : 00000000 r1 : 00000003 r0 : 00000000 Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 54e34019 DAC: 00000051 Process accelerometer (pid: 2870, stack limit = 0x(ptrval)) Stackck: (0xa4c1fd78 to 0xa4c20000) fd60: fffffff3 fc813f6c fd80: 40410581 d7530ce3 a5e2817c a7617f00 a5e29404 a5e2817c 00000000 7f008324 fda0: a5e28000 8044f59c a5fdd9d0 a5e2945c a46a4a00 a5e29668 a7455000 80454f10 fdc0: 80909048 a5e29668 a5fdd9d0 a46a4a00 806316d0 00000000 a46a4a00 801df5f0 fde0: 00000000 d7530ce3 a4c1fec0 a46a4a00 00000000 a5fdd9d0 a46a4a08 801df53c fe00: 00000000 801d74bc a4c1fec0 00000000 a4c1ff70 00000000 a7038da8 00000000 fe20: a46a4a00 801e91fc a411bbe0 801f2e88 00000004 00000000 80909048 00000041 fe40: 00000000 00020000 00000000 dead4ead a6a88da0 00000000 ffffe000 806fcae8 fe60: a4c1fec8 00000000 80909048 00000002 a5fdd9d0 a7660110 a411bab0 00000001 fe80: dead4ead ffffffff ffffffff a4c1fe8c a4c1fe8c d7530ce3 20000013 80909048 fea0: 80909048 a4c1ff70 00000001 fffff000 a4c1e000 00000005 00026038 801eabd8 fec0: a7660110 a411bab0 b9394901 00000006 a696201b 76fb3000 00000000 a7039720 fee0: a5fdd9d0 00000101 00000002 00000096 00000000 00000000 00000000 a4c1ff00 ff00: a6b310f4 805cb174 a6b310f4 00000010 00000fe0 00000010 a4c1e000 d7530ce3 ff20: 00000003 a5f41400 a5f41424 00000000 a6962000 00000000 00000003 00000002 ff40: ffffff9c 000a0000 80909048 d7530ce3 a6962000 00000003 80909048 ffffff9c ff60: a6962000 801d890c 00000000 00000000 00020000 a7590000 00000004 00000100 ff80: 00000001 d7530ce3 000288b8 00026320 000288b8 00000005 80101204 a4c1e000 ffa0: 00000005 80101000 000288b8 00026320 000288b8 000a0000 00000000 00000000 ffc0: 000288b8 00026320 000288b8 00000005 7eef3bac 000264e8 00028ad8 00026038 ffe0: 00000005 7eef3300 76f76e91 76f78546 800d0030 000288b8 00000000 00000000 [<80450f70>] (input_event) from [<a5e2817c>] (0xa5e2817c) Code: e1a08148 eaffffa8 e351001f 812fff1e (e590c018) ---[ end trace 1c691ee85f2ff243 ]--- Signed-off-by: Jonathan Bakker <xc-racer2@live.ca> Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2018-03-03Input: twl6040-vibra - fix child-node lookupJohan Hovold
commit dcaf12a8b0bbdbfcfa2be8dff2c4948d9844b4ad upstream. Fix child-node lookup during probe, which ended up searching the whole device tree depth-first starting at parent rather than just matching on its children. Later sanity checks on node properties (which would likely be missing) should prevent this from causing much trouble however, especially as the original premature free of the parent node has already been fixed separately (but that "fix" was apparently never backported to stable). Fixes: e7ec014a47e4 ("Input: twl6040-vibra - update for device tree support") Fixes: c52c545ead97 ("Input: twl6040-vibra - fix DT node memory management") Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Tested-by: H. Nikolaus Schaller <hns@goldelico.com> (on Pyra OMAP5 hardware) Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2018-03-03Input: twl6040-vibra - fix DT node memory managementH. Nikolaus Schaller
commit c52c545ead97fcc2f4f8ea38f1ae3c23211e09a8 upstream. commit e7ec014a47e4 ("Input: twl6040-vibra - update for device tree support") made the separate vibra DT node to a subnode of the twl6040. It now calls of_find_node_by_name() to locate the "vibra" subnode. This function has a side effect to call of_node_put on() for the twl6040 parent node passed in as a parameter. This causes trouble later on. Solution: we must call of_node_get() before of_find_node_by_name() Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2018-03-03Input: twl4030-vibra - fix sibling-node lookupJohan Hovold
commit 5b189201993ab03001a398de731045bfea90c689 upstream. A helper purported to look up a child node based on its name was using the wrong of-helper and ended up prematurely freeing the parent of-node while searching the whole device tree depth-first starting at the parent node. Fixes: 64b9e4d803b1 ("input: twl4030-vibra: Support for DT booted kernel") Fixes: e661d0a04462 ("Input: twl4030-vibra - fix ERROR: Bad of_node_put() warning") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2018-03-03Input: twl4030-vibra - fix ERROR: Bad of_node_put() warningMarek Belisko
commit e661d0a04462dd98667f8947141bd8defab5b34a upstream. Fix following: [ 8.862274] ERROR: Bad of_node_put() on /ocp/i2c@48070000/twl@48/audio [ 8.869293] CPU: 0 PID: 1003 Comm: modprobe Not tainted 4.2.0-rc2-letux+ #1175 [ 8.876922] Hardware name: Generic OMAP36xx (Flattened Device Tree) [ 8.883514] [<c00159e0>] (unwind_backtrace) from [<c0012488>] (show_stack+0x10/0x14) [ 8.891693] [<c0012488>] (show_stack) from [<c05cb810>] (dump_stack+0x78/0x94) [ 8.899322] [<c05cb810>] (dump_stack) from [<c02cfd5c>] (kobject_release+0x68/0x7c) [ 8.907409] [<c02cfd5c>] (kobject_release) from [<bf0040c4>] (twl4030_vibra_probe+0x74/0x188 [twl4030_vibra]) [ 8.917877] [<bf0040c4>] (twl4030_vibra_probe [twl4030_vibra]) from [<c03816ac>] (platform_drv_probe+0x48/0x90) [ 8.928497] [<c03816ac>] (platform_drv_probe) from [<c037feb4>] (really_probe+0xd4/0x238) [ 8.937103] [<c037feb4>] (really_probe) from [<c0380160>] (driver_probe_device+0x30/0x48) [ 8.945678] [<c0380160>] (driver_probe_device) from [<c03801e0>] (__driver_attach+0x68/0x8c) [ 8.954589] [<c03801e0>] (__driver_attach) from [<c037ea60>] (bus_for_each_dev+0x50/0x84) [ 8.963226] [<c037ea60>] (bus_for_each_dev) from [<c037f828>] (bus_add_driver+0xcc/0x1e4) [ 8.971832] [<c037f828>] (bus_add_driver) from [<c0380b60>] (driver_register+0x9c/0xe0) [ 8.980255] [<c0380b60>] (driver_register) from [<c00097e0>] (do_one_initcall+0x100/0x1b8) [ 8.988983] [<c00097e0>] (do_one_initcall) from [<c00b8008>] (do_init_module+0x58/0x1c0) [ 8.997497] [<c00b8008>] (do_init_module) from [<c00b8cac>] (SyS_init_module+0x54/0x64) [ 9.005950] [<c00b8cac>] (SyS_init_module) from [<c000ed20>] (ret_fast_syscall+0x0/0x54) [ 9.015838] input: twl4030:vibrator as /devices/platform/68000000.ocp/48070000.i2c/i2c-0/0-0048/48070000.i2c:twl@48:audio/input/input2 node passed to of_find_node_by_name is put inside that function and new node is returned if found. Free returned node not already freed node. Signed-off-by: Marek Belisko <marek@goldelico.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2018-02-13Input: adxl34x - do not treat FIFO_MODE() as booleanArnd Bergmann
commit 1dbc080c9ef6bcfba652ef0d6ae919b8c7c85a1d upstream. FIFO_MODE() is a macro expression with a '<<' operator, which gcc points out could be misread as a '<': drivers/input/misc/adxl34x.c: In function 'adxl34x_probe': drivers/input/misc/adxl34x.c:799:36: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context] While utility of this warning is being disputed (Chief Penguin: "This warning is clearly pure garbage.") FIFO_MODE() extracts range of values, with 0 being FIFO_BYPASS, and not something that is logically boolean. This converts the test to an explicit comparison with FIFO_BYPASS, making it clearer to gcc and the reader what is intended. Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2018-01-01Input: ims-psu - check if CDC union descriptor is saneDmitry Torokhov
commit ea04efee7635c9120d015dcdeeeb6988130cb67a upstream. Before trying to use CDC union descriptor, try to validate whether that it is sane by checking that intf->altsetting->extra is big enough and that descriptor bLength is not too big and not too small. Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2018-01-01Input: uinput - avoid crash when sending FF request to device going awayDmitry Torokhov
commit 6b4877c7bdc6ae39ce03716df7caeecf204697eb upstream. If FF request comes in while uinput device is going away, uinput_request_send() will fail with -ENODEV, and uinput_request_submit() will attempt to mark the slot as unused by calling uinput_request_done(). Unfortunately in this case we haven't initialized request->done completion yet, and we get a crash: [ 39.402036] BUG: spinlock bad magic on CPU#1, fftest/3108 [ 39.402046] lock: 0xffff88006a93bb00, .magic: 00000000, .owner: /39, .owner_cpu: 1217155072 [ 39.402055] CPU: 1 PID: 3108 Comm: fftest Tainted: G W 4.13.0+ #15 [ 39.402059] Hardware name: LENOVO 20HQS0EG02/20HQS0EG02, BIOS N1MET37W (1.22 ) 07/04/2017 [ 39.402064] 0000000000000086 f0fad82f3ceaa120 ffff88006a93b9a0 ffffffff9de941bb [ 39.402077] ffff88026df8ae00 ffff88006a93bb00 ffff88006a93b9c0 ffffffff9dca62b7 [ 39.402088] ffff88006a93bb00 ffff88006a93baf8 ffff88006a93b9e0 ffffffff9dca62e7 [ 39.402099] Call Trace: [ 39.402112] [<ffffffff9de941bb>] dump_stack+0x4d/0x63 [ 39.402123] [<ffffffff9dca62b7>] spin_dump+0x97/0x9c [ 39.402130] [<ffffffff9dca62e7>] spin_bug+0x2b/0x2d [ 39.402138] [<ffffffff9dca6373>] do_raw_spin_lock+0x28/0xfd [ 39.402147] [<ffffffff9e3055cd>] _raw_spin_lock_irqsave+0x19/0x1f [ 39.402154] [<ffffffff9dca05b7>] complete+0x1d/0x48 [ 39.402162] [<ffffffffc04f30af>] 0xffffffffc04f30af [ 39.402167] [<ffffffffc04f468c>] 0xffffffffc04f468c [ 39.402177] [<ffffffff9dd59c16>] ? __slab_free+0x22f/0x359 [ 39.402184] [<ffffffff9dcc13e9>] ? tk_clock_read+0xc/0xe [ 39.402189] [<ffffffffc04f471f>] 0xffffffffc04f471f [ 39.402195] [<ffffffff9dc9ffe5>] ? __wake_up+0x44/0x4b [ 39.402200] [<ffffffffc04f3240>] ? 0xffffffffc04f3240 [ 39.402207] [<ffffffff9e0f57f3>] erase_effect+0xa1/0xd2 [ 39.402214] [<ffffffff9e0f58c6>] input_ff_flush+0x43/0x5c [ 39.402219] [<ffffffffc04f32ad>] 0xffffffffc04f32ad [ 39.402227] [<ffffffff9e0f174f>] input_flush_device+0x3d/0x51 [ 39.402234] [<ffffffff9e0f69ae>] evdev_flush+0x49/0x5c [ 39.402243] [<ffffffff9dd62d6e>] filp_close+0x3f/0x65 [ 39.402253] [<ffffffff9dd7dcf7>] put_files_struct+0x66/0xc1 [ 39.402261] [<ffffffff9dd7ddeb>] exit_files+0x47/0x4e [ 39.402270] [<ffffffff9dc6b329>] do_exit+0x483/0x969 [ 39.402278] [<ffffffff9dc73211>] ? recalc_sigpending_tsk+0x3d/0x44 [ 39.402285] [<ffffffff9dc6c7a2>] do_group_exit+0x42/0xb0 [ 39.402293] [<ffffffff9dc767e1>] get_signal+0x58d/0x5bf [ 39.402300] [<ffffffff9dc03701>] do_signal+0x37/0x53e [ 39.402307] [<ffffffff9e0f8401>] ? evdev_ioctl_handler+0xac8/0xb04 [ 39.402314] [<ffffffff9e0f8464>] ? evdev_ioctl+0x10/0x12 [ 39.402321] [<ffffffff9dd74cfa>] ? do_vfs_ioctl+0x42e/0x501 [ 39.402328] [<ffffffff9dc0170e>] prepare_exit_to_usermode+0x66/0x90 [ 39.402333] [<ffffffff9dc0181b>] syscall_return_slowpath+0xe3/0xec [ 39.402339] [<ffffffff9e305b7b>] int_ret_from_sys_call+0x25/0x8f While we could solve this by simply initializing the completion earlier, we are better off rearranging the code a bit so we avoid calling complete() on requests that we did not send out. This patch consolidates marking request slots as free in one place (in uinput_request_submit(), the same place where we acquire them) and having everyone else simply signal completion of the requests. Fixes: 00ce756ce53a ("Input: uinput - mark failed submission requests as free") Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2018-01-01Input: uinput - avoid FF flush when destroying deviceDmitry Torokhov
commit e8b95728f724797f958912fd9b765a695595d3a6 upstream. Normally, when input device supporting force feedback effects is being destroyed, we try to "flush" currently playing effects, so that the physical device does not continue vibrating (or executing other effects). Unfortunately this does not work well for uinput as flushing of the effects deadlocks with the destroy action: - if device is being destroyed because the file descriptor is being closed, then there is noone to even service FF requests; - if device is being destroyed because userspace sent UI_DEV_DESTROY, while theoretically it could be possible to service FF requests, userspace is unlikely to do so (they'd need to make sure FF handling happens on a separate thread) even if kernel solves the issue with FF ioctls deadlocking with UI_DEV_DESTROY ioctl on udev->mutex. To avoid lockups like the one below, let's install a custom input device flush handler, and avoid trying to flush force feedback effects when we destroying the device, and instead rely on uinput to shut off the device properly. NMI watchdog: Watchdog detected hard LOCKUP on cpu 3 ... <<EOE>> [<ffffffff817a0307>] _raw_spin_lock_irqsave+0x37/0x40 [<ffffffff810e633d>] complete+0x1d/0x50 [<ffffffffa00ba08c>] uinput_request_done+0x3c/0x40 [uinput] [<ffffffffa00ba587>] uinput_request_submit.part.7+0x47/0xb0 [uinput] [<ffffffffa00bb62b>] uinput_dev_erase_effect+0x5b/0x76 [uinput] [<ffffffff815d91ad>] erase_effect+0xad/0xf0 [<ffffffff815d929d>] flush_effects+0x4d/0x90 [<ffffffff815d4cc0>] input_flush_device+0x40/0x60 [<ffffffff815daf1c>] evdev_cleanup+0xac/0xc0 [<ffffffff815daf5b>] evdev_disconnect+0x2b/0x60 [<ffffffff815d74ac>] __input_unregister_device+0xac/0x150 [<ffffffff815d75f7>] input_unregister_device+0x47/0x70 [<ffffffffa00bac45>] uinput_destroy_device+0xb5/0xc0 [uinput] [<ffffffffa00bb2de>] uinput_ioctl_handler.isra.9+0x65e/0x740 [uinput] [<ffffffff811231ab>] ? do_futex+0x12b/0xad0 [<ffffffffa00bb3f8>] uinput_ioctl+0x18/0x20 [uinput] [<ffffffff81241248>] do_vfs_ioctl+0x298/0x480 [<ffffffff81337553>] ? security_file_ioctl+0x43/0x60 [<ffffffff812414a9>] SyS_ioctl+0x79/0x90 [<ffffffff817a04ee>] entry_SYSCALL_64_fastpath+0x12/0x71 Reported-by: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com> Reported-by: Clément VUCHENER <clement.vuchener@gmail.com> Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=193741 Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2017-08-26Input: twl4030-pwrbutton - use correct device for irq requestSebastian Reichel
commit 3071e9dd6cd3f2290d770117330f2c8b2e9a97e4 upstream. The interrupt should be requested for the platform device and not for the input device. Fixes: 7f9ce649d267 ("Input: twl4030-pwrbutton - simplify driver using devm_*") Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2017-07-18Input: yealink - validate number of endpoints before using themJohan Hovold
commit 5cc4a1a9f5c179795c8a1f2b0f4361829d6a070e upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints. Fixes: aca951a22a1d ("[PATCH] input-driver-yealink-P1K-usb-phone") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2017-07-18Input: ims-pcu - validate number of endpoints before using themJohan Hovold
commit 1916d319271664241b7aa0cd2b05e32bdb310ce9 upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack control-interface endpoints. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2017-07-18Input: cm109 - validate number of endpoints before using themJohan Hovold
commit ac2ee9ba953afe88f7a673e1c0c839227b1d7891 upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints. Fixes: c04148f915e5 ("Input: add driver for USB VoIP phones with CM109...") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2016-08-22Input: pwm-beeper - fix - scheduling while atomicManfred Schlaegl
commit f49cf3b8b4c841457244c461c66186a719e13bcc upstream. Pwm config may sleep so defer it using a worker. On a Freescale i.MX53 based board we ran into "BUG: scheduling while atomic" because input_inject_event locks interrupts, but imx_pwm_config_v2 sleeps. Tested on Freescale i.MX53 SoC with 4.6.0. Signed-off-by: Manfred Schlaegl <manfred.schlaegl@gmx.at> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2016-08-22Input: pwm-beeper - remove useless call to pwm_config()Olivier Sobrie
commit d1b12075ffa808dce33dd46b7ad035bebf8da215 upstream. Calling pwm_config() with a period equal to zero always results in error (-EINVAL) and pwm chip config method is never called. Signed-off-by: Olivier Sobrie <olivier@sobrie.be> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2016-08-22Input: uinput - handle compat ioctl for UI_SET_PHYSRicky Liang
commit affa80bd97f7ca282d1faa91667b3ee9e4c590e6 upstream. When running a 32-bit userspace on a 64-bit kernel, the UI_SET_PHYS ioctl needs to be treated with special care, as it has the pointer size encoded in the command. Signed-off-by: Ricky Liang <jcliang@chromium.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2016-06-15Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delayStephen Boyd
commit eda5ecc0a6b865561997e177c393f0b0136fe3b7 upstream. The trigger delay algorithm that converts from microseconds to the register value looks incorrect. According to most of the PMIC documentation, the equation is delay (Seconds) = (1 / 1024) * 2 ^ (x + 4) except for one case where the documentation looks to have a formatting issue and the equation looks like delay (Seconds) = (1 / 1024) * 2 x + 4 Most likely this driver was written with the improper documentation to begin with. According to the downstream sources the valid delays are from 2 seconds to 1/64 second, and the latter equation just doesn't make sense for that. Let's fix the algorithm and the range check to match the documentation and the downstream sources. Reported-by: Bjorn Andersson <bjorn.andersson@linaro.org> Fixes: 92d57a73e410 ("input: Add support for Qualcomm PMIC8XXX power key") Signed-off-by: Stephen Boyd <sboyd@codeaurora.org> Tested-by: John Stultz <john.stultz@linaro.org> Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2016-05-01Input: ims-pcu - sanity check against missing interfacesOliver Neukum
commit a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff upstream. A malicious device missing interface can make the driver oops. Add sanity checking. Signed-off-by: Oliver Neukum <ONeukum@suse.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2016-03-30Input: ati_remote2 - fix crashes on detecting device with invalid descriptorVladis Dronov
commit 950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d upstream. The ati_remote2 driver expects at least two interfaces with one endpoint each. If given malicious descriptor that specify one interface or no endpoints, it will crash in the probe function. Ensure there is at least two interfaces and one endpoint for each interface before using it. The full disclosure: http://seclists.org/bugtraq/2016/Mar/90 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Cc: Moritz Muehlenhoff <jmm@inutil.org> Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
2016-03-29Input: powermate - fix oops with malicious USB descriptorsJosh Boyer
commit 9c6ba456711687b794dcf285856fc14e2c76074f upstream. The powermate driver expects at least one valid USB endpoint in its probe function. If given malicious descriptors that specify 0 for the number of endpoints, it will crash. Validate the number of endpoints on the interface before using them. The full report for this issue can be found here: http://seclists.org/bugtraq/2016/Mar/85 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Cc: Moritz Muehlenhoff <jmm@inutil.org> Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
2015-05-06Input: twl4030-pwrbutton - ensure a wakeup event is recorded.NeilBrown
commit c42bfd7f6cd26e8f712fc184460e32845d928d17 upstream. This button is treated as a wakeup source, so we need to initialise it correctly. Without the device_init_wakeup() call, dev->power.wakeup will be NULL, and pm_wakeup_event() will do nothing. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
2014-07-18Input: sirfsoc-onkey - fix GPL v2 license string typoBjorn Helgaas
Per license_is_gpl_compatible(), the MODULE_LICENSE() string for GPL v2 is "GPL v2", not "GPLv2". Use "GPL v2" so this module doesn't taint the kernel. Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-06-07Input: max8997_haptic - add error handling for regulator and pwmSachin Kamat
Let's start checking return value of regulator_enable and pwm_enable to avoid errors. Fixes the following warning: drivers/input/misc/max8997_haptic.c:185:19: warning: ignoring return value of ‘regulator_enable’, declared with attribute warn_unused_result [-Wunused-result] Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-05-29Input: ab8500-ponkey - switch to using managed resourcesHimangi Saraogi
Let's switch the driver to use managed resources, this will simplify error handling and driver unbinding logic. Signed-off-by: Himangi Saraogi <himangi774@gmail.com> Acked-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-05-29Input: max8925_onkey - switch to using managed resourcesHimangi Saraogi
Let's switch the driver to use managed resources, this will simplify error handling and driver unbinding logic. Signed-off-by: Himangi Saraogi <himangi774@gmail.com> Acked-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-05-29Input: 88pm860x_onkey - switch to using managed resourcesHimangi Saraogi
Let's switch the driver to use managed resources, this will simplify error handling and driver unbinding logic. Signed-off-by: Himangi Saraogi <himangi774@gmail.com> Acked-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-05-28Input: soc_button_array - remove duplicate inclusion of input.hSachin Kamat
input.h was included twice. Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-05-18Input: ims-pcu - fix uninitialized use of 'error' in ims_pcu_buffers_alloc()Christian Engelmayer
In case allocation via usb_alloc_coherent() fails in ims_pcu_buffers_alloc(), the function jumps to the exit path without initializing local variable 'error' that is used as return value. Detected by Coverity - CID 1016531. Signed-off-by: Christian Engelmayer <cengelma@gmx.at> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-05-14Merge tag 'v3.15-rc5' into nextDmitry Torokhov
Merge with Linux 3.15-rc5 to sync up Wacom and other changes.
2014-05-14Input: pmic8xxx-pwrkey - set sane default for debounce timeStephen Boyd
If the debounce time is 0 our usage of ilog2() later on in this driver will cause undefined behavior. If CONFIG_OF=n this fact is evident to the compiler, and it emits a call to ____ilog2_NaN() which doesn't exist. Fix this by setting a sane default for debounce and failing to probe if debounce is 0 in the DT. Reported-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Stephen Boyd <sboyd@codeaurora.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-05-14Input: rotary_encoder - make of_device_id array constJingoo Han
Make of_device_id array const, because all OF functions handle it as const. Signed-off-by: Jingoo Han <jg1.han@samsung.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-05-14Input: gpio-beeper - make of_device_id array constJingoo Han
Make of_device_id array const, because all OF functions handle it as const. Signed-off-by: Jingoo Han <jg1.han@samsung.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-05-14Input: gpio-beeper - simplify GPIO handlingAlexander Shiyan
This patch simplifies GPIO handling in the driver by using GPIO functions based on descriptors. As a result this driver now can be used for boards without DT support. Signed-off-by: Alexander Shiyan <shc_work@mail.ru> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-05-14Input: twl6040-vibra - use devm functionsFabio Estevam
Using devm_regulator_bulk_get() and devm_input_allocate_device() can make the code cleaner and smaller as we do not need to manually free resources the error and remove paths. Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-05-08Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input subsystem fixes from Dmitry Torokhov: "Just a few fixups to various drivers" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: elantech - fix touchpad initialization on Gigabyte U2442 Input: tca8418 - fix loading this driver as a module from a device tree Input: bma150 - extend chip detection for bma180 Input: atkbd - fix keyboard not working on some LG laptops Input: synaptics - add min/max quirk for ThinkPad Edge E431
2014-04-24Input: bma150 - extend chip detection for bma180Dr. H. Nikolaus Schaller
This driver has been used while on the OpenPhoenux GTA04 with a BMA180. Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-04-23Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: "The main change is that we now publish "firmware ID" for the serio devices to help userspace figure out the kind of touchpads it is dealing with: i8042 will export PS/2 port's PNP IDs as firmware IDs. You will also get more quirks for Synaptics touchpads in various Lenovo laptops, a change to elantech driver to recognize even more models, and fixups to wacom and couple other drivers" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: elantech - add support for newer elantech touchpads Input: soc_button_array - fix a crash during rmmod Input: synaptics - add min/max quirk for ThinkPad T431s, L440, L540, S1 Yoga and X1 Input: synaptics - report INPUT_PROP_TOPBUTTONPAD property Input: Add INPUT_PROP_TOPBUTTONPAD device property Input: i8042 - add firmware_id support Input: serio - add firmware_id sysfs attribute Input: wacom - handle 1024 pressure levels in wacom_tpc_pen Input: wacom - references to 'wacom->data' should use 'unsigned char*' Input: wacom - override 'pressure_max' with value from HID_USAGE_PRESSURE Input: wacom - use full 32-bit HID Usage value in switch statement Input: wacom - missed the last bit of expresskey for DTU-1031 Input: ads7846 - fix device usage within attribute show Input: da9055_onkey - remove use of regmap_irq_get_virq()
2014-04-22Input: soc_button_array - fix a crash during rmmodLejun Zhu
When the system has zero or one button available, trying to rmmod soc_button_array will cause crash. Fix this by properly handling -ENODEV in probe(). Signed-off-by: Lejun Zhu <lejun.zhu@linux.intel.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-04-19Input: da9055_onkey - remove use of regmap_irq_get_virq()Adam Thomson
Using platform_get_irq_byname() to retrieve the IRQ number returns the VIRQ number rather than the local IRQ number for the device. Passing that value then into regmap_irq_get_virq() causes a failure because the function is expecting the local IRQ number (e.g. 0, 1, 2, 3, etc). This patch removes use of regmap_irq_get_virq() to prevent this failure from happening. Signed-off-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-04-05Merge tag 'pwm/for-3.15-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm changes from Thierry Reding: "The legacy HAVE_PWM Kconfig symbol is finally being retired. Thanks a lot to Sascha Hauer for doing that. Three new drivers are added: Freescale FTM, Cirrus Logic CLPS711X and Intel Low Power Subsystem. An assortment of fixes and cleanups rounds things off for this release cycle" * tag 'pwm/for-3.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: pwm: pxa: Constify OF match table pwm: pxa: Fix typo "pwm" -> "PWM" Revert "pwm: pxa: Use of_match_ptr()" pwm: add support for Intel Low Power Subsystem PWM pwm: Add CLPS711X PWM support pwm: atmel: correct CDTY calculation pwm: atmel: Fix polarity handling Documentation: Add device tree bindings for Freescale FTM PWM. pwm: Add Freescale FTM PWM driver support pwm: pxa: Use of_match_ptr() pwm: samsung: Use SIMPLE_DEV_PM_OPS macro pwm: renesas-tpu: Add dependency on HAS_IOMEM pwm: Remove obsolete HAVE_PWM Kconfig symbol
2014-04-05Merge tag 'cleanup-3.15' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC cleanups from Arnd Bergmann: "These cleanup patches are mainly move stuff around and should all be harmless. They are mainly split out so that other branches can be based on top to avoid conflicts. Notable changes are: - We finally remove all mach/timex.h, after CLOCK_TICK_RATE is no longer used (Uwe Kleine-König) - The Qualcomm MSM platform is split out into legacy mach-msm and new-style mach-qcom, to allow easier maintainance of the new hardware support without regressions (Kumar Gala) - A rework of some of the Kconfig logic to simplify multiplatform support (Rob Herring) - Samsung Exynos gets closer to supporting multiplatform (Sachin Kamat and others) - mach-bcm3528 gets merged into mach-bcm (Stephen Warren) - at91 gains some common clock framework support (Alexandre Belloni, Jean-Jacques Hiblot and other French people)" * tag 'cleanup-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (89 commits) ARM: hisi: select HAVE_ARM_SCU only for SMP ARM: efm32: allow uncompress debug output ARM: prima2: build reset code standalone ARM: at91: add PWM clock ARM: at91: move sam9261 SoC to common clk ARM: at91: prepare common clk transition for sam9261 SoC ARM: at91: updated the at91_dt_defconfig with support for the ADS7846 ARM: at91: dt: sam9261: Device Tree support for the at91sam9261ek ARM: at91: dt: defconfig: Added the sam9261 to the list of DT-enabled SOCs ARM: at91: dt: Add at91sam9261 dt SoC support ARM: at91: switch sam9rl to common clock framework ARM: at91/dt: define main clk frequency of at91sam9rlek ARM: at91/dt: define at91sam9rl clocks ARM: at91: prepare common clk transition for sam9rl SoCs ARM: at91: prepare sam9 dt boards transition to common clk ARM: at91: dt: sam9rl: Device Tree for the at91sam9rlek ARM: at91/defconfig: Add the sam9rl to the list of DT-enabled SOCs ARM: at91: Add at91sam9rl DT SoC support ARM: at91: prepare at91sam9rl DT transition ARM: at91/defconfig: refresh at91sam9260_9g20_defconfig ...
2014-04-03Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: "The first round of updates for the input subsystem. Just new drivers and existing driver fixes, no core changes except for the new uinput IOCTL to allow userspace to fetch sysfs name of the input device that was created" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (43 commits) Input: edt-ft5x06 - add a missing condition Input: appletouch - fix jumps when additional fingers are detected Input: appletouch - implement sensor data smoothing Input: add driver for SOC button array Input: pm8xxx-vibrator - add DT match table Input: pmic8xxx-pwrkey - migrate to DT Input: pmic8xxx-keypad - migrate to DT Input: pmic8xxx-keypad - migrate to regmap APIs Input: pmic8xxx-keypad - migrate to devm_* APIs Input: pmic8xxx-keypad - fix build by removing gpio configuration Input: add new driver for ARM CLPS711X keypad Input: edt-ft5x06 - add support for M09 firmware version Input: edt-ft5x06 - ignore touchdown events Input: edt-ft5x06 - adjust delays to conform datasheet Input: edt-ft5x06 - add DT support Input: edt-ft5x06 - several cleanups; no functional change Input: appletouch - dial back fuzz setting Input: remove obsolete tnetv107x drivers Input: sirfsoc-onkey - set the capability of reporting KEY_POWER Input: da9052_onkey - use correct register bit for key status ...
2014-03-30Input: add driver for SOC button arrayLejun Zhu
This patch adds support for the GPIO buttons on some Intel Bay Trail tablets originally running Windows 8. The ACPI description of these buttons follows "Windows ACPI Design Guide for SoC Platforms". Signed-off-by: Lejun Zhu <lejun.zhu@linux.intel.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-03-30Input: pm8xxx-vibrator - add DT match tableStephen Boyd
The driver is only supported on DT enabled platforms. Convert the driver to DT so that it can probe properly. Signed-off-by: Stephen Boyd <sboyd@codeaurora.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-03-30Input: pmic8xxx-pwrkey - migrate to DTStephen Boyd
The driver is only supported on DT enabled platforms. Convert the driver to DT so that it can probe properly. Signed-off-by: Stephen Boyd <sboyd@codeaurora.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-03-28Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input subsystem fixes from Dmitry Torokhov: "Updates to Synaptics touchpad to better cope with devices in Lenovo laptops, and a couple more fixes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: synaptics - add manual min/max quirk for ThinkPad X240 Input: synaptics - add manual min/max quirk Input: cypress_ps2 - don't report as a button pads Input: da9052_onkey - use correct register bit for key status Input: adp5588-keys - get value from data out when dir is out
2014-03-28Input: sirfsoc-onkey - set the capability of reporting KEY_POWERXianglong Du
commit a1a7521064428fc1cf8 moved to report EV_KEY event(KEY_POWER) instead of reporting EV_PWR event(KEY_SUSPEND), but it didn't enable the capability, so the KEY_POWER will not be reported to userspace by input core. this patch fixes the issue. Signed-off-by: Xianglong Du <Xianglong.Du@csr.com> Signed-off-by: Barry Song <Baohua.Song@csr.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-03-26Input: da9052_onkey - use correct register bit for key statusAnthony Olech
The wrong register bit of the DA9052/3 PMIC registers was used to determine the status on the ONKEY. Also a failure in reading the status register will no longer result in the work queue being rescheduled as that would result in a (potentially) endless retry. Signed-off-by: Anthony Olech <anthony.olech.opensource@diasemi.com> Acked-by: David Dajun Chen <david.chen@diasemi.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-29 08:01:39 +0000