1. 14 Mar, 2018 2 commits
  2. 10 Mar, 2018 1 commit
  3. 08 Mar, 2018 1 commit
  4. 07 Mar, 2018 1 commit
    • Arkadiusz Hiler's avatar
      Revert "Input: synaptics - Lenovo Thinkpad T460p devices should use RMI" · 5444a992
      Arkadiusz Hiler authored
      This reverts commit 48282969 which
      caused the following issues:
      
      1. On T460p with BIOS version 2.22 touchpad and trackpoint stop working
      after suspend-resume cycle. Due to strange state of the device another
      suspend is impossible.
      
      The following dmesg errors can be observed:
      thinkpad_acpi: EC reports that Thermal Table has changed
      rmi4_smbus 7-002c: failed to get SMBus version number!
      rmi4_physical rmi4-00: rmi_driver_reset_handler: Failed to read current IRQ mask.
      rmi4_f01 rmi4-00.fn01: Failed to restore normal operation: -16.
      rmi4_f01 rmi4-00.fn01: Resume failed with code -16.
      rmi4_physical rmi4-00: Failed to suspend functions: -16
      rmi4_smbus 7-002c: Failed to resume device: -16
      PM: resume devices took 0.640 seconds
      rmi4_f03 rmi4-00.fn03: rmi_f03_pt_write: Failed to write to F03 TX register (-16).
      rmi4_physical rmi4-00: rmi_driver_clear_irq_bits: Failed to change enabled interrupts!
      rmi4_physical rmi4-00: rmi_driver_set_irq_bits: Failed to change enabled interrupts!
      psmouse: probe of serio3 failed with error -1
      
      2. On another T460p with BIOS version 2.15 two finger scrolling gesture
      on the touchpad stops working after suspend-resume cycle (about 75%
      reproducibility, when it still works, the scrolling gesture becomes
      laggy). Nothing suspicious appears in the dmesg.
      
      Analysis form Richard Schütz:
      
      "RMI is unreliable on the ThinkPad T460p because the device is affected
      by the firmware behavior addressed in a7ae8195 ("i2c: i801: Allow
      ACPI SystemIO OpRegion to conflict with PCI BAR")."
      
      The affected devices often show:
      
      i801_smbus 0000:00:1f.4: BIOS is accessing SMBus registers
      i801_smbus 0000:00:1f.4: Driver SMBus register access inhibited
      Reported-by: default avatarRichard Schütz <rschuetz@uni-koblenz.de>
      Signed-off-by: default avatarArkadiusz Hiler <arkadiusz.hiler@intel.com>
      Tested-by: default avatarMartin Peres <martin.peres@linux.intel.com>
      Tested-by: default avatarArkadiusz Hiler <arkadiusz.hiler@intel.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      5444a992
  5. 10 Feb, 2018 1 commit
  6. 03 Feb, 2018 2 commits
  7. 01 Feb, 2018 1 commit
  8. 31 Jan, 2018 2 commits
    • Marcin Niestroj's avatar
      Input: goodix - use generic touchscreen_properties · fafef982
      Marcin Niestroj authored
      Use touchscreen_properties structure instead of implementing all
      properties by our own. It allows us to reuse generic code for parsing
      device-tree properties (which was implemented manually in the driver for
      now). Additionally, it allows us to report events using generic
      touchscreen_report_pos(), which automatically handles inverted and
      swapped axes.
      
      This fixes the issue with the custom code incorrectly handling case where
      ts->inverted_x and ts->swapped_x_y were true, but ts->inverted_y was
      false. Assuming we have 720x1280 touch panel, ts->abs_x_max == 1279 and
      ts->abs_y_max == 719 (because we inverted that in goodix_read_config()).
      Now let's assume that we received event from (0:0) position (in touch
      panel original coordinates). In function goodix_ts_report_touch() we
      calculate input_x as 1279, but after swapping input_y takes that value
      (which is more that maximum 719 value reported during initialization).
      
      Note that since touchscreen coordinates are 0-indexed, we now report
      touchscreen range as (0:size-1).
      
      Developed and tested on custom DT-based device with gt1151 touch
      panel.
      Signed-off-by: default avatarMarcin Niestroj <m.niestroj@grinn-global.com>
      [dtor: fix endianness annotation reported by sparse, handle errors when
       initializing MT slots]
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      fafef982
    • Andi Shyti's avatar
      Input: mms114 - fix typo in definition · 13e94540
      Andi Shyti authored
      It's 'MMS114_INFORMATION', not 'MMS114_INFOMATION'
      Signed-off-by: default avatarAndi Shyti <andi.shyti@samsung.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      13e94540
  9. 30 Jan, 2018 2 commits
  10. 26 Jan, 2018 4 commits
  11. 24 Jan, 2018 2 commits
  12. 23 Jan, 2018 12 commits
  13. 22 Jan, 2018 2 commits
  14. 19 Jan, 2018 2 commits
  15. 18 Jan, 2018 3 commits
    • Nick Desaulniers's avatar
      Input: synaptics-rmi4 - prevent UAF reported by KASAN · 55edde9f
      Nick Desaulniers authored
      KASAN found a UAF due to dangling pointer. As the report below says,
      rmi_f11_attention() accesses drvdata->attn_data.data, which was freed in
      rmi_irq_fn.
      
      [  311.424062] BUG: KASAN: use-after-free in rmi_f11_attention+0x526/0x5e0 [rmi_core]
      [  311.424067] Read of size 27 at addr ffff88041fd610db by task irq/131-i2c_hid/1162
      [  311.424075] CPU: 0 PID: 1162 Comm: irq/131-i2c_hid Not tainted 4.15.0-rc8+ #2
      [  311.424076] Hardware name: Razer Blade Stealth/Razer, BIOS 6.05 01/26/2017
      [  311.424078] Call Trace:
      [  311.424086]  dump_stack+0xae/0x12d
      [  311.424090]  ? _atomic_dec_and_lock+0x103/0x103
      [  311.424094]  ? show_regs_print_info+0xa/0xa
      [  311.424099]  ? input_handle_event+0x10b/0x810
      [  311.424104]  print_address_description+0x65/0x229
      [  311.424108]  kasan_report.cold.5+0xa7/0x281
      [  311.424117]  rmi_f11_attention+0x526/0x5e0 [rmi_core]
      [  311.424123]  ? memcpy+0x1f/0x50
      [  311.424132]  ? rmi_f11_attention+0x526/0x5e0 [rmi_core]
      [  311.424143]  ? rmi_f11_probe+0x1e20/0x1e20 [rmi_core]
      [  311.424153]  ? rmi_process_interrupt_requests+0x220/0x2a0 [rmi_core]
      [  311.424163]  ? rmi_irq_fn+0x22c/0x270 [rmi_core]
      [  311.424173]  ? rmi_process_interrupt_requests+0x2a0/0x2a0 [rmi_core]
      [  311.424177]  ? free_irq+0xa0/0xa0
      [  311.424180]  ? irq_finalize_oneshot.part.39+0xeb/0x180
      [  311.424190]  ? rmi_process_interrupt_requests+0x2a0/0x2a0 [rmi_core]
      [  311.424193]  ? irq_thread_fn+0x3d/0x80
      [  311.424197]  ? irq_finalize_oneshot.part.39+0x180/0x180
      [  311.424200]  ? irq_thread+0x21d/0x290
      [  311.424203]  ? irq_thread_check_affinity+0x170/0x170
      [  311.424207]  ? remove_wait_queue+0x150/0x150
      [  311.424212]  ? kasan_unpoison_shadow+0x30/0x40
      [  311.424214]  ? __init_waitqueue_head+0xa0/0xd0
      [  311.424218]  ? task_non_contending.cold.55+0x18/0x18
      [  311.424221]  ? irq_forced_thread_fn+0xa0/0xa0
      [  311.424226]  ? irq_thread_check_affinity+0x170/0x170
      [  311.424230]  ? kthread+0x19e/0x1c0
      [  311.424233]  ? kthread_create_worker_on_cpu+0xc0/0xc0
      [  311.424237]  ? ret_from_fork+0x32/0x40
      
      [  311.424244] Allocated by task 899:
      [  311.424249]  kasan_kmalloc+0xbf/0xe0
      [  311.424252]  __kmalloc_track_caller+0xd9/0x1f0
      [  311.424255]  kmemdup+0x17/0x40
      [  311.424264]  rmi_set_attn_data+0xa4/0x1b0 [rmi_core]
      [  311.424269]  rmi_raw_event+0x10b/0x1f0 [hid_rmi]
      [  311.424278]  hid_input_report+0x1a8/0x2c0 [hid]
      [  311.424283]  i2c_hid_irq+0x146/0x1d0 [i2c_hid]
      [  311.424286]  irq_thread_fn+0x3d/0x80
      [  311.424288]  irq_thread+0x21d/0x290
      [  311.424291]  kthread+0x19e/0x1c0
      [  311.424293]  ret_from_fork+0x32/0x40
      
      [  311.424296] Freed by task 1162:
      [  311.424300]  kasan_slab_free+0x71/0xc0
      [  311.424303]  kfree+0x90/0x190
      [  311.424311]  rmi_irq_fn+0x1b2/0x270 [rmi_core]
      [  311.424319]  rmi_irq_fn+0x257/0x270 [rmi_core]
      [  311.424322]  irq_thread_fn+0x3d/0x80
      [  311.424324]  irq_thread+0x21d/0x290
      [  311.424327]  kthread+0x19e/0x1c0
      [  311.424330]  ret_from_fork+0x32/0x40
      
      [  311.424334] The buggy address belongs to the object at ffff88041fd610c0 which belongs to the cache kmalloc-64 of size 64
      [  311.424340] The buggy address is located 27 bytes inside of 64-byte region [ffff88041fd610c0, ffff88041fd61100)
      [  311.424344] The buggy address belongs to the page:
      [  311.424348] page:ffffea00107f5840 count:1 mapcount:0 mapping: (null) index:0x0
      [  311.424353] flags: 0x17ffffc0000100(slab)
      [  311.424358] raw: 0017ffffc0000100 0000000000000000 0000000000000000 00000001802a002a
      [  311.424363] raw: dead000000000100 dead000000000200 ffff8804228036c0 0000000000000000
      [  311.424366] page dumped because: kasan: bad access detected
      
      [  311.424369] Memory state around the buggy address:
      [  311.424373]  ffff88041fd60f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  311.424377]  ffff88041fd61000: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb
      [  311.424381] >ffff88041fd61080: fb fb fb fb fc fc fc fc fb fb fb fb fb fb fb fb
      [  311.424384]                                                     ^
      [  311.424387]  ffff88041fd61100: fc fc fc fc fb fb fb fb fb fb fb fb fc fc fc fc
      [  311.424391]  ffff88041fd61180: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarNick Desaulniers <nick.desaulniers@gmail.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      55edde9f
    • Colin Ian King's avatar
      Input: cyapa - remove redundant assignment to 'pwr_cmd' · deb106be
      Colin Ian King authored
      The variable pwr_cmd is being assigned to cyapa->suspend_power_mode
      twice, once during the declaration and once after taking an
      interruptible mutex lock.  Remove the redundant first assignment
      since the value is never read and it is outside the mutex lock.
      
      Cleans up clang warning:
      drivers/input/mouse/cyapa.c:743:5: warning: Value stored to 'pwr_cmd'
      during its initialization is never read
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      deb106be
    • Corentin Labbe's avatar
      Input: remove at32psif · 0de45027
      Corentin Labbe authored
      Since AVR32 arch is gone, at32psif driver is useless.
      Signed-off-by: default avatarCorentin Labbe <clabbe.montjoie@gmail.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      0de45027
  16. 17 Jan, 2018 2 commits