1. 15 Oct, 2020 8 commits
  2. 30 Sep, 2020 1 commit
  3. 26 Sep, 2020 1 commit
  4. 25 Sep, 2020 1 commit
    • Jason Gerecke's avatar
      HID: wacom: Avoid entering wacom_wac_pen_report for pad / battery · d9216d75
      Jason Gerecke authored
      It has recently been reported that the "heartbeat" report from devices
      like the 2nd-gen Intuos Pro (PTH-460, PTH-660, PTH-860) or the 2nd-gen
      Bluetooth-enabled Intuos tablets (CTL-4100WL, CTL-6100WL) can cause the
      driver to send a spurious BTN_TOUCH=0 once per second in the middle of
      drawing. This can result in broken lines while drawing on Chrome OS.
      
      The source of the issue has been traced back to a change which modified
      the driver to only call `wacom_wac_pad_report()` once per report instead
      of once per collection. As part of this change, pad-handling code was
      removed from `wacom_wac_collection()` under the assumption that the
      `WACOM_PEN_FIELD` and `WACOM_TOUCH_FIELD` checks would not be satisfied
      when a pad or battery collection was being processed.
      
      To be clear, the macros `WACOM_PAD_FIELD` and `WACOM_PEN_FIELD` do not
      currently check exclusive conditions. In fact, most "pad" fields will
      also appear to be "pen" fields simply due to their presence inside of
      a Digitizer application collection. Because of this, the removal of
      the check from `wacom_wac_collection()` just causes pad / battery
      collections to instead trigger a call to `wacom_wac_pen_report()`
      instead. The pen report function in turn resets the tip switch state
      just prior to exiting, resulting in the observed BTN_TOUCH=0 symptom.
      
      To correct this, we restore a version of the `WACOM_PAD_FIELD` check
      in `wacom_wac_collection()` and return early. This effectively prevents
      pad / battery collections from being reported until the very end of the
      report as originally intended.
      
      Fixes: d4b8efeb ("HID: wacom: generic: Correct pad syncing")
      Cc: stable@vger.kernel.org # v4.17+
      Signed-off-by: default avatarJason Gerecke <jason.gerecke@wacom.com>
      Reviewed-by: default avatarPing Cheng <ping.cheng@wacom.com>
      Tested-by: default avatarPing Cheng <ping.cheng@wacom.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      d9216d75
  5. 23 Sep, 2020 2 commits
    • Xiaofei Tan's avatar
      HID: i2c-hid: fix kerneldoc warnings in i2c-hid-core.c · ca43ab1e
      Xiaofei Tan authored
      Fix following warnings caused by mismatch bewteen function parameters
      and comments.
      drivers/hid/i2c-hid/i2c-hid-core.c:331: warning: Function parameter or member 'data_len' not described in 'i2c_hid_set_or_send_report'
      drivers/hid/i2c-hid/i2c-hid-core.c:331: warning: Excess function parameter 'len' description in 'i2c_hid_set_or_send_report'
      Signed-off-by: default avatarXiaofei Tan <tanxiaofei@huawei.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      ca43ab1e
    • Xiaofei Tan's avatar
      HID: core: fix kerneldoc warnings in hid-core.c · 5f94e9c8
      Xiaofei Tan authored
      Fix following warnings caused by mismatch bewteen function parameters
      and comments.
      drivers/hid/hid-core.c:931: warning: Function parameter or member 'hid' not described in 'hid_parse_report'
      drivers/hid/hid-core.c:931: warning: Excess function parameter 'device' description in 'hid_parse_report'
      drivers/hid/hid-core.c:961: warning: Function parameter or member 'hid' not described in 'hid_validate_values'
      drivers/hid/hid-core.c:961: warning: Excess function parameter 'device' description in 'hid_validate_values'
      drivers/hid/hid-core.c:1452: warning: Function parameter or member 'report' not described in 'hid_match_report'
      drivers/hid/hid-core.c:1452: warning: Excess function parameter 'report_type' description in 'hid_match_report'
      drivers/hid/hid-core.c:2132: warning: Function parameter or member 'drv' not described in 'new_id_store'
      drivers/hid/hid-core.c:2132: warning: Excess function parameter 'driver' description in 'new_id_store'
      Signed-off-by: default avatarXiaofei Tan <tanxiaofei@huawei.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      5f94e9c8
  6. 22 Sep, 2020 4 commits
  7. 09 Sep, 2020 4 commits
    • Laurent Gauthier's avatar
      HID: hid-debug: fix nonblocking read semantics wrt EIO/ERESTARTSYS · c27e0882
      Laurent Gauthier authored
      When the file has been open in non-blocking mode, EIO or ERESTARTSYS
      would never be returned even if they should (for example when device
      has been unplugged, you want EIO and not EAGAIN to be returned).
      
      Move the O_NONBLOCK check after other checks have been performed.
      
      Based on similar to patches hidraw and hiddev by Founder Fang
      <founder.fang@gmail.com> and Jiri Kosina <jkosina@suse.cz>.
      Signed-off-by: default avatarLaurent Gauthier <laurent.gauthier@soccasys.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      c27e0882
    • Douglas Anderson's avatar
      HID: i2c-hid: Prefer asynchronous probe · eafb2203
      Douglas Anderson authored
      Adding printouts to the i2c_hid_probe() function shows that it takes
      quite some time.  It used to take about 70 ms, but after commit
      eef40162 ("HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON
      commands") it takes about 190 ms.  This is not tons of time but it's
      not trivial.  Because we haven't yet specified that we'd prefer
      asynchronous probe for this driver then, if the driver is builtin to
      the kernel, we'll wait for this driver to finish before we start
      probes for more drivers.  Let's set the flag to enable asynchronous
      for this driver so that other drivers aren't blocked from probing
      until we finish.
      
      Since this driver can be configured as a module and modules are
      always asynchronously probed this is quite a safe change and will
      benefit anyone who has a reason to build this driver into the kernel
      instead of using it as a module.
      
      [jkosina@suse.cz: drop spurious whitespace addition]
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      eafb2203
    • Hans de Goede's avatar
      HID: ite: Add USB id match for Acer One S1003 keyboard dock · 5bf2f2f3
      Hans de Goede authored
      The Acer One S1003 2-in-1 keyboard dock uses a Synaptics S910xx touchpad
      which is connected to an ITE 8910 USB keyboard controller chip.
      
      This keyboard has the same quirk for its rfkill / airplane mode hotkey as
      other keyboards with ITE keyboard chips, it only sends a single release
      event when pressed and released, it never sends a press event.
      
      This commit adds this keyboards USB id to the hid-ite id-table, fixing
      the rfkill key not working on this keyboard. Note that like for the
      Acer Aspire Switch 10 (SW5-012) the id-table entry matches on the
      HID_GROUP_GENERIC generic group so that hid-ite only binds to the
      keyboard interface and the mouse/touchpad interface is left untouched
      so that hid-multitouch can bind to it.
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      5bf2f2f3
    • Dan Carpenter's avatar
      HID: roccat: add bounds checking in kone_sysfs_write_settings() · d4f98dbf
      Dan Carpenter authored
      This code doesn't check if "settings->startup_profile" is within bounds
      and that could result in an out of bounds array access.  What the code
      does do is it checks if the settings can be written to the firmware, so
      it's possible that the firmware has a bounds check?  It's safer and
      easier to verify when the bounds checking is done in the kernel.
      
      Fixes: 14bf62cd ("HID: add driver for Roccat Kone gaming mouse")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      d4f98dbf
  8. 07 Sep, 2020 2 commits
  9. 02 Sep, 2020 10 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid · fc3abb53
      Linus Torvalds authored
      Pull HID fixes from Jiri Kosina:
      
       - data sanitization and validtion fixes for report descriptor parser
         from Marc Zyngier
      
       - memory leak fix for hid-elan driver from Dinghao Liu
      
       - two device-specific quirks
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
        HID: core: Sanitize event code and type when mapping input
        HID: core: Correctly handle ReportSize being zero
        HID: elan: Fix memleak in elan_input_configured
        HID: microsoft: Add rumble support for the 8bitdo SN30 Pro+ controller
        HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for all Saitek X52 devices
      fc3abb53
    • Linus Torvalds's avatar
      Merge tag 'for-5.9/dm-fixes' of... · c3a13095
      Linus Torvalds authored
      Merge tag 'for-5.9/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
      
      Pull device mapper fixes from Mike Snitzer:
      
       - writecache fix to allow dax_direct_access() to partitioned pmem
         devices.
      
       - multipath fix to avoid any Path Group initialization if
         'pg_init_in_progress' isn't set.
      
       - crypt fix to use DECLARE_CRYPTO_WAIT() for onstack wait structures.
      
       - integrity fix to properly check integrity after device creation when
         in bitmap mode.
      
       - thinp and cache target __create_persistent_data_objects() fixes to
         reset the metadata's dm_block_manager pointer from PTR_ERR to NULL
         before returning from error path.
      
       - persistent-data block manager fix to guard against dm_block_manager
         NULL pointer dereference in dm_bm_is_read_only() and update various
         opencoded bm->read_only checks to use dm_bm_is_read_only() instead.
      
      * tag 'for-5.9/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm thin metadata: Fix use-after-free in dm_bm_set_read_only
        dm thin metadata:  Avoid returning cmd->bm wild pointer on error
        dm cache metadata: Avoid returning cmd->bm wild pointer on error
        dm integrity: fix error reporting in bitmap mode after creation
        dm crypt: Initialize crypto wait structures
        dm mpath: fix racey management of PG initialization
        dm writecache: handle DAX to partitions on persistent memory correctly
      c3a13095
    • Linus Torvalds's avatar
      Merge tag 'xfs-5.9-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · e1d0126c
      Linus Torvalds authored
      Pull xfs fixes from Darrick Wong:
       "Various small corruption fixes that have come in during the past
        month:
      
         - Avoid a log recovery failure for an insert range operation by
           rolling deferred ops incrementally instead of at the end.
      
         - Fix an off-by-one error when calculating log space reservations for
           anything involving an inode allocation or free.
      
         - Fix a broken shortform xattr verifier.
      
         - Ensure that the shortform xattr header padding is always
           initialized to zero"
      
      * tag 'xfs-5.9-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: initialize the shortform attr header padding entry
        xfs: fix boundary test in xfs_attr_shortform_verify
        xfs: fix off-by-one in inode alloc block reservation calculation
        xfs: finish dfops on every insert range shift iteration
      e1d0126c
    • Linus Torvalds's avatar
      Merge branch 'work.epoll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 54e54d58
      Linus Torvalds authored
      Pull epoll fixup from Al Viro:
       "Fixup for epoll regression; there's a better solution longer term, but
        this is the least intrusive fix"
      
      * 'work.epoll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        fix regression in "epoll: Keep a reference on files added to the check list"
      54e54d58
    • Ye Bin's avatar
      dm thin metadata: Fix use-after-free in dm_bm_set_read_only · 3a653b20
      Ye Bin authored
      The following error ocurred when testing disk online/offline:
      
      [  301.798344] device-mapper: thin: 253:5: aborting current metadata transaction
      [  301.848441] device-mapper: thin: 253:5: failed to abort metadata transaction
      [  301.849206] Aborting journal on device dm-26-8.
      [  301.850489] EXT4-fs error (device dm-26) in __ext4_new_inode:943: Journal has aborted
      [  301.851095] EXT4-fs (dm-26): Delayed block allocation failed for inode 398742 at logical offset 181 with max blocks 19 with error 30
      [  301.854476] BUG: KASAN: use-after-free in dm_bm_set_read_only+0x3a/0x40 [dm_persistent_data]
      
      Reason is:
      
       metadata_operation_failed
          abort_transaction
              dm_pool_abort_metadata
      	    __create_persistent_data_objects
      	        r = __open_or_format_metadata
      	        if (r) --> If failed will free pmd->bm but pmd->bm not set NULL
      		    dm_block_manager_destroy(pmd->bm);
          set_pool_mode
      	dm_pool_metadata_read_only(pool->pmd);
      	dm_bm_set_read_only(pmd->bm);  --> use-after-free
      
      Add checks to see if pmd->bm is NULL in dm_bm_set_read_only and
      dm_bm_set_read_write functions.  If bm is NULL it means creating the
      bm failed and so dm_bm_is_read_only must return true.
      Signed-off-by: default avatarYe Bin <yebin10@huawei.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      3a653b20
    • Ye Bin's avatar
      dm thin metadata: Avoid returning cmd->bm wild pointer on error · 219403d7
      Ye Bin authored
      Maybe __create_persistent_data_objects() caller will use PTR_ERR as a
      pointer, it will lead to some strange things.
      Signed-off-by: default avatarYe Bin <yebin10@huawei.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      219403d7
    • Ye Bin's avatar
      dm cache metadata: Avoid returning cmd->bm wild pointer on error · d16ff19e
      Ye Bin authored
      Maybe __create_persistent_data_objects() caller will use PTR_ERR as a
      pointer, it will lead to some strange things.
      Signed-off-by: default avatarYe Bin <yebin10@huawei.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      d16ff19e
    • Al Viro's avatar
      fix regression in "epoll: Keep a reference on files added to the check list" · 77f4689d
      Al Viro authored
      epoll_loop_check_proc() can run into a file already committed to destruction;
      we can't grab a reference on those and don't need to add them to the set for
      reverse path check anyway.
      Tested-by: default avatarMarc Zyngier <maz@kernel.org>
      Fixes: a9ed4a65 ("epoll: Keep a reference on files added to the check list")
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      77f4689d
    • Linus Torvalds's avatar
      Merge tag 'perf-tools-fixes-for-v5.9-2020-09-01' of... · 9c7d619b
      Linus Torvalds authored
      Merge tag 'perf-tools-fixes-for-v5.9-2020-09-01' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux
      
      Pull perf tools fixes from Arnaldo Carvalho de Melo:
      
       - Fix infinite loop in the TUI for grouped events in 'perf top/record',
         eg when using "perf top -e '{cycles,instructions,cache-misses}'".
      
       - Fix segfault by skipping side-band event setup if HAVE_LIBBPF_SUPPORT
         is not set.
      
       - Fix synthesized branch stacks generated from CoreSight ETM trace and
         Intel PT hardware traces.
      
       - Fix error when synthesizing events from ARM SPE hardware trace.
      
       - The SNOOPX and REMOTE offsets in the data_src bitmask in perf records
         were were both 37, SNOOPX is 38, fix it.
      
       - Fix use of CPU list with summary option in 'perf sched timehist'.
      
       - Avoid an uninitialized read when using fake PMUs.
      
       - Set perf_event_attr.exclude_guest=1 for user-space counting.
      
       - Don't order events when doing a 'perf report -D' raw dump of
         perf.data records.
      
       - Set NULL sentinel in pmu_events table in "Parse and process metrics"
         'perf test'
      
       - Fix basic bpf filtering 'perf test' on s390x.
      
       - Fix out of bounds array access in the 'perf stat' print_counters()
         evlist method.
      
       - Add mwait_idle_with_hints.constprop.0 to the list of idle symbols.
      
       - Use %zd for size_t printf formats on 32-bit.
      
       - Correct the help info of "perf record --no-bpf-event" option.
      
       - Add entries for CoreSight and Arm SPE tooling to MAINTAINERS.
      
      * tag 'perf-tools-fixes-for-v5.9-2020-09-01' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:
        perf report: Disable ordered_events for raw dump
        perf tools: Correct SNOOPX field offset
        perf intel-pt: Fix corrupt data after perf inject from
        perf cs-etm: Fix corrupt data after perf inject from
        perf top/report: Fix infinite loop in the TUI for grouped events
        perf parse-events: Avoid an uninitialized read when using fake PMUs
        perf stat: Fix out of bounds array access in the print_counters() evlist method
        perf test: Set NULL sentinel in pmu_events table in "Parse and process metrics" test
        perf parse-events: Set exclude_guest=1 for user-space counting
        perf record: Correct the help info of option "--no-bpf-event"
        perf tools: Use %zd for size_t printf formats on 32-bit
        MAINTAINERS: Add entries for CoreSight and Arm SPE tooling
        perf: arm-spe: Fix check error when synthesizing events
        perf symbols: Add mwait_idle_with_hints.constprop.0 to the list of idle symbols
        perf top: Skip side-band event setup if HAVE_LIBBPF_SUPPORT is not set
        perf sched timehist: Fix use of CPU list with summary option
        perf test: Fix basic bpf filtering test
      9c7d619b
    • Linus Torvalds's avatar
      Merge tag 'for-5.9-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · dcdfd9cc
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
       "Two small fixes and a bunch of lockdep fixes for warnings that show up
        with an upcoming tree locking update but are valid with current locks
        as well"
      
      * tag 'for-5.9-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: tree-checker: fix the error message for transid error
        btrfs: set the lockdep class for log tree extent buffers
        btrfs: set the correct lockdep class for new nodes
        btrfs: allocate scrub workqueues outside of locks
        btrfs: fix potential deadlock in the search ioctl
        btrfs: drop path before adding new uuid tree entry
        btrfs: block-group: fix free-space bitmap threshold
      dcdfd9cc
  10. 01 Sep, 2020 7 commits