linux.git/drivers/hid/wacom_sys.c, branch v5.16

HID: wacom: fix problems when device is not a valid USB device

2021-12-02T14:36:12+00:00

The wacom driver accepts devices of more than just USB types, but some
code paths can cause problems if the device being controlled is not a
USB device due to a lack of checking.  Add the needed checks to ensure
that the USB device accesses are only happening on a "real" USB device,
and not one on some other bus.

Cc: Jiri Kosina 
Cc: Benjamin Tissoires 
Cc: linux-input@vger.kernel.org
Cc: stable@vger.kernel.org
Tested-by: Benjamin Tissoires 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Benjamin Tissoires 
Link: https://lore.kernel.org/r/20211201183503.2373082-2-gregkh@linuxfoundation.org

HID: add hid_is_usb() function to make it simpler for USB detection

2021-12-02T14:35:57+00:00

A number of HID drivers already call hid_is_using_ll_driver() but only
for the detection of if this is a USB device or not.  Make this more
obvious by creating hid_is_usb() and calling the function that way.

Also converts the existing hid_is_using_ll_driver() functions to use the
new call.

Cc: Jiri Kosina 
Cc: Benjamin Tissoires 
Cc: linux-input@vger.kernel.org
Cc: stable@vger.kernel.org
Tested-by: Benjamin Tissoires 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Benjamin Tissoires 
Link: https://lore.kernel.org/r/20211201183503.2373082-1-gregkh@linuxfoundation.org

HID: wacom: Make use of the helper function devm_add_action_or_reset()

2021-10-27T08:14:05+00:00

The helper function devm_add_action_or_reset() will internally
call devm_add_action(), and if devm_add_action() fails then it will
execute the action mentioned and return the error code. So
use devm_add_action_or_reset() instead of devm_add_action()
to simplify the error handling, reduce the code.

Signed-off-by: Cai Huoqing 
Signed-off-by: Jiri Kosina

HID: wacom: Shrink critical section in `wacom_add_shared_data`

2021-10-27T08:13:57+00:00

The size of the critical section in this function appears to be larger
than necessary. The `wacom_udev_list_lock` exists to ensure that one
interface cannot begin checking if a shared object exists while a second
interface is doing the same (otherwise both could determine that no
object exists yet and create their own independent objects rather than
sharing just one). It should be safe for the critical section to end
once a fresly-allocated shared object would be found by other threads
(i.e., once it has been added to `wacom_udev_list`, which is looped
over by `wacom_get_hdev_data`).

This commit is a necessary pre-requisite for a later change to swap the
use of `devm_add_action` with `devm_add_action_or_reset`, which would
otherwise deadlock in its error case.

Signed-off-by: Jason Gerecke 
Signed-off-by: Jiri Kosina

HID: wacom: Short-circuit processing of touch when it is disabled

2021-07-28T09:45:40+00:00

Avoid doing unnecessary work when touch is disabled by detecting this
condition and returning early. Note that the probe process sends GET
FEATURE requests to discover e.g. HID_DG_CONTACTMAX, so we can't start
ignoring touch reports until probe finishes.

Signed-off-by: Ping Cheng 
Signed-off-by: Jason Gerecke 
Signed-off-by: Jiri Kosina

HID: wacom: set initial hardware touch switch state to 'off'

2021-07-28T09:45:40+00:00

Wacom touch devices have two types of touch switches: softkey touch
toggle and hardware touch switch. For softkey toggle, we assume
touch is on by default in the driver. However the hardware touch
switch is controlled by end users. We don't know if it's on or off
before getting the status event.

This patch sets touch off for devices with a hardware switch until we
get the status. This is a bit safer for users who leave the switch "off"
and don't want any accidental touches. The tradeoff is a slight delay
between device connection and touch becoming enabled for users who
leave the switch "on".

Signed-off-by: Ping Cheng 
Reviewed-by: Jason Gerecke 
Tested-by: Jason Gerecke 
Signed-off-by: Jiri Kosina

HID: wacom_sys: Demote kernel-doc abuse

2021-04-07T16:46:20+00:00

Fixes the following W=1 kernel build warning(s):

 drivers/hid/wacom_sys.c:1505: warning: Function parameter or member 'wacom' not described in 'wacom_led_next'
 drivers/hid/wacom_sys.c:1505: warning: Function parameter or member 'cur' not described in 'wacom_led_next'

Cc: Jiri Kosina 
Cc: Benjamin Tissoires 
Cc: linux-input@vger.kernel.org
Signed-off-by: Lee Jones 
Signed-off-by: Benjamin Tissoires

HID: wacom: convert sysfs sprintf/snprintf family to sysfs_emit

2021-02-05T09:16:45+00:00

Fix the following coccicheck warning:

./drivers/hid/wacom_sys.c:1828:8-16: WARNING: use scnprintf or sprintf.

Reported-by: Abaci Robot
Signed-off-by: Jiapeng Chong 
Signed-off-by: Jiri Kosina

HID: wacom: Correct NULL dereference on AES pen proximity

2021-01-26T10:53:53+00:00

The recent commit to fix a memory leak introduced an inadvertant NULL
pointer dereference. The `wacom_wac->pen_fifo` variable was never
intialized, resuling in a crash whenever functions tried to use it.
Since the FIFO is only used by AES pens (to buffer events from pen
proximity until the hardware reports the pen serial number) this would
have been easily overlooked without testing an AES device.

This patch converts `wacom_wac->pen_fifo` over to a pointer (since the
call to `devres_alloc` allocates memory for us) and ensures that we assign
it to point to the allocated and initalized `pen_fifo` before the function
returns.

Link: https://github.com/linuxwacom/input-wacom/issues/230
Fixes: 37309f47e2f5 ("HID: wacom: Fix memory leakage caused by kfifo_alloc")
CC: stable@vger.kernel.org # v4.19+
Signed-off-by: Jason Gerecke 
Tested-by: Ping Cheng 
Signed-off-by: Jiri Kosina

HID: wacom: Fix memory leakage caused by kfifo_alloc

2020-12-22T09:26:54+00:00

As reported by syzbot below, kfifo_alloc'd memory would not be freed
if a non-zero return value is triggered in wacom_probe. This patch
creates and uses devm_kfifo_alloc to allocate and free itself.

BUG: memory leak
unreferenced object 0xffff88810dc44a00 (size 512):
  comm "kworker/1:2", pid 3674, jiffies 4294943617 (age 14.100s)
  hex dump (first 32 bytes):
   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
   [<0000000023e1afac>] kmalloc_array include/linux/slab.h:592 [inline]
   [<0000000023e1afac>] __kfifo_alloc+0xad/0x100 lib/kfifo.c:43
   [<00000000c477f737>] wacom_probe+0x1a1/0x3b0 drivers/hid/wacom_sys.c:2727
   [<00000000b3109aca>] hid_device_probe+0x16b/0x210 drivers/hid/hid-core.c:2281
   [<00000000aff7c640>] really_probe+0x159/0x480 drivers/base/dd.c:554
   [<00000000778d0bc3>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
   [<000000005108dbb5>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
   [<00000000efb7c59e>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
   [<0000000024ab1590>] __device_attach+0x122/0x250 drivers/base/dd.c:912
   [<000000004c7ac048>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
   [<00000000b93050a3>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
   [<00000000e5b46ea5>] hid_add_device+0x151/0x390 drivers/hid/hid-core.c:2437
   [<00000000c6add147>] usbhid_probe+0x412/0x560 drivers/hid/usbhid/hid-core.c:1407
   [<00000000c33acdb4>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
   [<00000000aff7c640>] really_probe+0x159/0x480 drivers/base/dd.c:554
   [<00000000778d0bc3>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
   [<000000005108dbb5>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844

https://syzkaller.appspot.com/bug?extid=5b49c9695968d7250a26

Reported-by: syzbot+5b49c9695968d7250a26@syzkaller.appspotmail.com
Signed-off-by: Ping Cheng 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina