summary refs log tree commit diff
path: root/drivers/input/mouse
AgeCommit message (Collapse)Author
2023-06-14Input: psmouse - fix OOB access in Elantech protocolDmitry Torokhov
commit 7b63a88bb62ba2ddf5fcd956be85fe46624628b9 upstream. The kernel only allocate 5 MT slots; check that transmitted slot ID falls within the acceptable range. Link: https://lore.kernel.org/r/ZFnEL91nrT789dbG@google.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-06Input: focaltech - use explicitly signed char typeJason A. Donenfeld
commit 8980f190947ba29f23110408e712444884b74251 upstream. The recent change of -funsigned-char causes additions of negative numbers to become additions of large positive numbers, leading to wrong calculations of mouse movement. Change these casts to be explicitly signed, to take into account negative offsets. Fixes: 3bc753c06dd0 ("kbuild: treat char as always unsigned") Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=217211 Link: https://lore.kernel.org/r/20230318133010.1285202-1-Jason@zx2c4.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-06Input: alps - fix compatibility with -funsigned-charmsizanoen
commit 754ff5060daf5a1cf4474eff9b4edeb6c17ef7ab upstream. The AlpsPS/2 code previously relied on the assumption that `char` is a signed type, which was true on x86 platforms (the only place where this driver is used) before kernel 6.2. However, on 6.2 and later, this assumption is broken due to the introduction of -funsigned-char as a new global compiler flag. Fix this by explicitly specifying the signedness of `char` when sign extending the values received from the device. Fixes: f3f33c677699 ("Input: alps - Rushmore and v7 resolution support") Signed-off-by: msizanoen <msizanoen@qtmlabs.xyz> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230320045228.182259-1-msizanoen@qtmlabs.xyz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-02-01Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode"Dmitry Torokhov
commit 3c44e2b6cde674797b76e76d3a903a63ce8a18bb upstream. This reverts commit ac5408991ea6b06e29129b4d4861097c4c3e0d59 because it causes loss of keyboard on HP 15-da1xxx. Fixes: ac5408991ea6 ("Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode") Reported-by: Jiri Slaby <jirislaby@kernel.org> Link: https://lore.kernel.org/r/824effa5-8b9a-c28a-82bb-9b0ab24623e1@kernel.org Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1206358 Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-15Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI modeAman Dhoot
The device works fine in native RMI mode, there is no reason to use legacy PS/2 mode with it. Signed-off-by: Aman Dhoot <amandhoot12@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-10-09Merge branch 'next' into for-linusDmitry Torokhov
Prepare input updates for 6.1 merge window.
2022-09-29input: drop empty comment blocksChristophe JAILLET
Commit 1a59d1b8e05e ("treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156") has left some empty comment blocks. Remove them to save a few lines of code. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Link: https://lore.kernel.org/r/26a2b905b259bfffaf2de5b26f2007b8606970ed.1664478665.git.christophe.jaillet@wanadoo.fr Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-09-24Input: synaptics - disable Intertouch for Lenovo T14 and P14s AMD G1Mark Pearson
Since intertouch was enabled for the T14 and P14s AMD G1 laptops there have been a number of reports of touchpads not working well. Debugging this with Synaptics they noted that intertouch should not be enabled as SMBUS host notify is not available on these laptops. Reverting the previous commit (e4ce4d3a939d97bea045eafa13ad1195695f91ce) to restore functionality back to what it was. Note - we are working with Synaptics to see if there is a better solution, but nothing is confirmed as yet. Signed-off-by: Mark Pearson <markpearson@lenovo.com> Link: https://lore.kernel.org/r/20220920193936.8709-1-markpearson@lenovo.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-09-14Input: synaptics - enable InterTouch for the ThinkPad P1 G3Lyude Paul
Noticed this while trying to debug some unrelated issues: this laptop has the ability to use rmi4 but doesn't by default. So let's fix that. Tested locally, including mouse buttons, on my ThinkPad P1 G3. This might also enable the X1 Extreme G3, but I don't have such a system to test locally (presumably Mark can chime in if that's the case). Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://lore.kernel.org/r/20220909202127.141761-1-lyude@redhat.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-09-08Input: hgpk - fix repeated word in a commentwangjianli
Delete the redundant word 'to'. Signed-off-by: wangjianli <wangjianli@cdjrlc.com> Link: https://lore.kernel.org/r/20220908131043.37099-1-wangjianli@cdjrlc.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-09-03Input: psmouse - switch to using dev_groups for driver-specific attributesDmitry Torokhov
The driver core now has the ability to handle the creation and removal of device-specific sysfs files, let's use it instead of registering and unregistering attributes by hand. Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20220903051119.1332808-2-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-08-18Input: move from strlcpy with unused retval to strscpyWolfram Sang
Follow the advice of the below link and prefer 'strscpy' in this subsystem. Conversion is 1:1 because the return value is not used. Generated by a coccinelle script. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://lore.kernel.org/r/20220818210022.6865-1-wsa+renesas@sang-engineering.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-08-17Merge branch 'i2c/make_remove_callback_void-immutable' of ↵Dmitry Torokhov
git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux into next Sync up with the latest I2C code base to get updated prototype of I2C bus remove() method.
2022-08-16i2c: Make remove callback return voidUwe Kleine-König
The value returned by an i2c driver's remove function is mostly ignored. (Only an error message is printed if the value is non-zero that the error is ignored.) So change the prototype of the remove function to return no value. This way driver authors are not tempted to assume that passing an error to the upper layer is a good idea. All drivers are adapted accordingly. There is no intended change of behaviour, all callbacks were prepared to return 0 before. Reviewed-by: Peter Senna Tschudin <peter.senna@gmail.com> Reviewed-by: Jeremy Kerr <jk@codeconstruct.com.au> Reviewed-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Crt Mori <cmo@melexis.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Marek Behún <kabel@kernel.org> # for leds-turris-omnia Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Petr Machata <petrm@nvidia.com> # for mlxsw Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com> # for surface3_power Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> # for bmc150-accel-i2c + kxcjk-1013 Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> # for media/* + staging/media/* Acked-by: Miguel Ojeda <ojeda@kernel.org> # for auxdisplay/ht16k33 + auxdisplay/lcd2s Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # for versaclock5 Reviewed-by: Ajay Gupta <ajayg@nvidia.com> # for ucsi_ccg Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> # for iio Acked-by: Peter Rosin <peda@axentia.se> # for i2c-mux-*, max9860 Acked-by: Adrien Grassein <adrien.grassein@gmail.com> # for lontium-lt8912b Reviewed-by: Jean Delvare <jdelvare@suse.de> # for hwmon, i2c-core and i2c/muxes Acked-by: Corey Minyard <cminyard@mvista.com> # for IPMI Reviewed-by: Vladimir Oltean <olteanv@gmail.com> Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com> # for drivers/power Acked-by: Krzysztof Hałasa <khalasa@piap.pl> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Wolfram Sang <wsa@kernel.org>
2022-08-02Input: elan_i2c - convert to use dev_groupsGreg Kroah-Hartman
There is no need for a driver to individually add/create device groups, the driver core will do it automatically for you. Convert the elan_i2c driver to use the dev_groups pointer instead of manually calling the driver core to create the group and have it be cleaned up later on by the devm core. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20220802162854.3015369-1-gregkh@linuxfoundation.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-07-08Merge tag 'v5.19-rc5' into nextDmitry Torokhov
Merge with mainline to bring up the latest definition from MFD subsystem needed for Mediatek keypad driver.
2022-06-22Input: cyapa_gen6 - aligned "*" each lineJiang Jian
Consider * alignment in comments Signed-off-by: Jiang Jian <jiangjian@cdjrlc.com> Link: https://lore.kernel.org/r/20220621070032.30072-1-jiangjian@cdjrlc.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-06-22Input: gpio_mouse - fix typos in commentsJiang Jian
Drop a redundant word 'the' in the comments of function gpio_mouse_scan. Signed-off-by: Jiang Jian <jiangjian@cdjrlc.com> Link: https://lore.kernel.org/r/20220622062100.19490-1-jiangjian@cdjrlc.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-06-07Merge tag 'input-for-v5.19-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - proper annotation of USB buffers in bcm5974 touchpad dirver - a quirk in SOC button driver to handle Lenovo Yoga Tablet2 1051F - a fix for missing dependency in raspberrypi-ts driver to avoid compile breakages with random configs. * tag 'input-for-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to dmi_use_low_level_irq Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag Input: raspberrypi-ts - add missing HAS_IOMEM dependency
2022-06-07Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flagMathias Nyman
The bcm5974 driver does the allocation and dma mapping of the usb urb data buffer, but driver does not set the URB_NO_TRANSFER_DMA_MAP flag to let usb core know the buffer is already mapped. usb core tries to map the already mapped buffer, causing a warning: "xhci_hcd 0000:00:14.0: rejecting DMA map of vmalloc memory" Fix this by setting the URB_NO_TRANSFER_DMA_MAP, letting usb core know buffer is already mapped by bcm5974 driver Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=215890 Link: https://lore.kernel.org/r/20220606113636.588955-1-mathias.nyman@linux.intel.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-06-02Merge tag 'arm-multiplatform-5.19-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull more ARM multiplatform updates from Arnd Bergmann: "The second part of the multiplatform changes now converts the Intel/Marvell PXA platform along with the rest. The patches went through several rebases before the merge window as bugs were found, so they remained separate. This has to touch a lot of drivers, in particular the touchscreen, pcmcia, sound and clk bits, to detach the driver files from the platform and board specific header files" * tag 'arm-multiplatform-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (48 commits) ARM: pxa/mmp: remove traces of plat-pxa ARM: pxa: convert to multiplatform ARM: pxa/sa1100: move I/O space to PCI_IOBASE ARM: pxa: remove support for MTD_XIP ARM: pxa: move mach/*.h to mach-pxa/ ARM: PXA: fix multi-cpu build of xsc3 ARM: pxa: move plat-pxa to drivers/soc/ ARM: mmp: rename pxa_register_device ARM: mmp: remove tavorevb board support ARM: pxa: remove unused mach/bitfield.h ARM: pxa: move clk register definitions to driver ARM: pxa: move smemc register access from clk to platform cpufreq: pxa3: move clk register access to clk driver ARM: pxa: remove get_clk_frequency_khz() ARM: pxa: pcmcia: move smemc configuration back to arch ASoC: pxa: i2s: use normal MMIO accessors ASoC: pxa: ac97: use normal MMIO accessors ASoC: pxa: use pdev resource for FIFO regs Input: wm97xx - get rid of irq_enable method in wm97xx_mach_ops Input: wm97xx - switch to using threaded IRQ ...
2022-05-21Input: cypress_ps2 - fix typo in commentJulia Lawall
Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> Link: https://lore.kernel.org/r/20220521111145.81697-27-Julia.Lawall@inria.fr Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-05-18Input: vmmouse - disable vmmouse before entering suspend modeZongmin Zhou
Currently, when trying to suspend and resume with VirtualPS/2 VMMouse there is an error message after resuming: psmouse serio1: vmmouse: Unable to re-enable mouse when reconnecting, err: -6 and the mouse will no longer be operable, requiring full rescan to find a another driver to use for the port. This error is due to QEMU still generating PS2 events which the kernel is not consuming until resume time, where they interfere with mouse identification and ultimately resulting in an error getting VMMOUSE_VERSION_ID. Test scenario: 1) start virtual machine with qemu command "vmport=on" 2) click suspend botton to enter suspend mode 3) resume and observe the error message in the kernel logs Let's fix this by disabling the vmmouse in its reset handler. This will notify qemu to stop vmmouse and remove the handler. Signed-off-by: Zongmin Zhou<zhouzongmin@kylinos.cn> Reviewed-by: Zack Rusin <zackr@vmware.com> Link: https://lore.kernel.org/r/20220322021046.1087954-1-zhouzongmin@kylinos.cn Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-05-16Input: psmouse-smbus - avoid flush_scheduled_work() usageTetsuo Handa
Flushing system-wide workqueues is dangerous and will be forbidden. Replace system_wq with local psmouse_wq. Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Link: https://lore.kernel.org/r/25e2b787-cb2c-fb0d-d62c-6577ad1cd9df@I-love.SAKURA.ne.jp Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-04-19ARM: pxa: split up mach/hardware.hArnd Bergmann
The mach/hardware.h is included in lots of places, and it provides three different things on pxa: - the cpu_is_pxa* macros - an indirect inclusion of mach/addr-map.h - the __REG() and io_pv2() helper macros Split it up into separate <linux/soc/pxa/cpu.h> and mach/pxa-regs.h headers, then change all the files that use mach/hardware.h to include the exact set of those three headers that they actually need, allowing for further more targeted cleanup. linux/soc/pxa/cpu.h can remain permanently exported and is now in a global location along with similar headers. pxa-regs.h and addr-map.h are only used in a very small number of drivers now and can be moved to arch/arm/mach-pxa/ directly when those drivers are to pass the necessary data as resources. Cc: Michael Turquette <mturquette@baylibre.com> Cc: Stephen Boyd <sboyd@kernel.org> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Cc: Jacek Anaszewski <jacek.anaszewski@gmail.com> Cc: Pavel Machek <pavel@ucw.cz> Acked-by: Ulf Hansson <ulf.hansson@linaro.org> Cc: Dominik Brodowski <linux@dominikbrodowski.net> Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Guenter Roeck <linux@roeck-us.net> Acked-by: Mark Brown <broonie@kernel.org> Cc: linux-clk@vger.kernel.org Cc: linux-pm@vger.kernel.org Cc: linux-input@vger.kernel.org Cc: linux-leds@vger.kernel.org Cc: linux-mmc@vger.kernel.org Cc: linux-mtd@lists.infradead.org Cc: linux-rtc@vger.kernel.org Cc: linux-usb@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: linux-fbdev@vger.kernel.org Cc: linux-watchdog@vger.kernel.org Cc: alsa-devel@alsa-project.org Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2022-03-20Input: synaptics - enable InterTouch on ThinkPad T14/P14s Gen 1 AMDMatthew Haughton
Confirmed LEN2064 on my P14s works with psmouse.synaptics_intertouch=1 By all accounts T14 and P14s are the same hardware which only differ by model identifier. Signed-off-by: Matthew Haughton <snafu109@gmail.com> Link: https://lore.kernel.org/r/20220318113949.32722-1-snafu109@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-03-01Input: elan_i2c - fix regulator enable count imbalance after suspend/resumeHans de Goede
Before these changes elan_suspend() would only disable the regulator when device_may_wakeup() returns false; whereas elan_resume() would unconditionally enable it, leading to an enable count imbalance when device_may_wakeup() returns true. This triggers the "WARN_ON(regulator->enable_count)" in regulator_put() when the elan_i2c driver gets unbound, this happens e.g. with the hot-plugable dock with Elan I2C touchpad for the Asus TF103C 2-in-1. Fix this by making the regulator_enable() call also be conditional on device_may_wakeup() returning false. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20220131135436.29638-2-hdegoede@redhat.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-03-01Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power()Hans de Goede
elan_disable_power() is called conditionally on suspend, where as elan_enable_power() is always called on resume. This leads to an imbalance in the regulator's enable count. Move the regulator_[en|dis]able() calls out of elan_[en|dis]able_power() in preparation of fixing this. No functional changes intended. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20220131135436.29638-1-hdegoede@redhat.com [dtor: consolidate elan_[en|dis]able() into elan_set_power()] Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-02-18Input: psmouse - set up dependency between PS/2 and SMBus companionsDmitry Torokhov
When we switch from emulated PS/2 to native (RMI4 or Elan) protocols, we create SMBus companion devices that are attached to I2C/SMBus controllers. However, when suspending and resuming, we also need to make sure that we take into account the PS/2 device they are associated with, so that PS/2 device is suspended after the companion and resumed before it, otherwise companions will not work properly. Before I2C devices were marked for asynchronous suspend/resume, this ordering happened naturally, but now we need to enforce it by establishing device links, with PS/2 devices being suppliers and SMBus companions being consumers. Fixes: 172d931910e1 ("i2c: enable async suspend/resume on i2c client devices") Reported-and-tested-by: Hugh Dickins <hughd@google.com> Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com> Link: https://lore.kernel.org/r/89456fcd-a113-4c82-4b10-a9bcaefac68f@google.com Link: https://lore.kernel.org/r/YgwQN8ynO88CPMju@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-01-15Merge branch 'next' into for-linusDmitry Torokhov
Prepare input updates for 5.17 merge window.
2021-12-30Input: appletouch - initialize work before device registrationPavel Skripkin
Syzbot has reported warning in __flush_work(). This warning is caused by work->func == NULL, which means missing work initialization. This may happen, since input_dev->close() calls cancel_work_sync(&dev->work), but dev->work initalization happens _after_ input_register_device() call. So this patch moves dev->work initialization before registering input device Fixes: 5a6eb676d3bc ("Input: appletouch - improve powersaving for Geyser3 devices") Reported-and-tested-by: syzbot+b88c5eae27386b252bbd@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Link: https://lore.kernel.org/r/20211230141151.17300-1-paskripkin@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2021-12-20Input: byd - fix typo in a commentXiang wangx
The double `the' in a comment is repeated, thus it should be removed. Signed-off-by: Xiang wangx <wangxiang@cdjrlc.com> Link: https://lore.kernel.org/r/20211216082735.11948-1-wangxiang@cdjrlc.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2021-12-08Merge tag 'v5.15' into nextDmitry Torokhov
Sync up with the mainline to get the latest APIs and DT bindings.
2021-11-29Input: elantech - fix stack out of bound access in elantech_change_report_id()Andrea Righi
The array param[] in elantech_change_report_id() must be at least 3 bytes, because elantech_read_reg_params() is calling ps2_command() with PSMOUSE_CMD_GETINFO, that is going to access 3 bytes from param[], but it's defined in the stack as an array of 2 bytes, therefore we have a potential stack out-of-bounds access here, also confirmed by KASAN: [ 6.512374] BUG: KASAN: stack-out-of-bounds in __ps2_command+0x372/0x7e0 [ 6.512397] Read of size 1 at addr ffff8881024d77c2 by task kworker/2:1/118 [ 6.512416] CPU: 2 PID: 118 Comm: kworker/2:1 Not tainted 5.13.0-22-generic #22+arighi20211110 [ 6.512428] Hardware name: LENOVO 20T8000QGE/20T8000QGE, BIOS R1AET32W (1.08 ) 08/14/2020 [ 6.512436] Workqueue: events_long serio_handle_event [ 6.512453] Call Trace: [ 6.512462] show_stack+0x52/0x58 [ 6.512474] dump_stack+0xa1/0xd3 [ 6.512487] print_address_description.constprop.0+0x1d/0x140 [ 6.512502] ? __ps2_command+0x372/0x7e0 [ 6.512516] __kasan_report.cold+0x7d/0x112 [ 6.512527] ? _raw_write_lock_irq+0x20/0xd0 [ 6.512539] ? __ps2_command+0x372/0x7e0 [ 6.512552] kasan_report+0x3c/0x50 [ 6.512564] __asan_load1+0x6a/0x70 [ 6.512575] __ps2_command+0x372/0x7e0 [ 6.512589] ? ps2_drain+0x240/0x240 [ 6.512601] ? dev_printk_emit+0xa2/0xd3 [ 6.512612] ? dev_vprintk_emit+0xc5/0xc5 [ 6.512621] ? __kasan_check_write+0x14/0x20 [ 6.512634] ? mutex_lock+0x8f/0xe0 [ 6.512643] ? __mutex_lock_slowpath+0x20/0x20 [ 6.512655] ps2_command+0x52/0x90 [ 6.512670] elantech_ps2_command+0x4f/0xc0 [psmouse] [ 6.512734] elantech_change_report_id+0x1e6/0x256 [psmouse] [ 6.512799] ? elantech_report_trackpoint.constprop.0.cold+0xd/0xd [psmouse] [ 6.512863] ? ps2_command+0x7f/0x90 [ 6.512877] elantech_query_info.cold+0x6bd/0x9ed [psmouse] [ 6.512943] ? elantech_setup_ps2+0x460/0x460 [psmouse] [ 6.513005] ? psmouse_reset+0x69/0xb0 [psmouse] [ 6.513064] ? psmouse_attr_set_helper+0x2a0/0x2a0 [psmouse] [ 6.513122] ? phys_pmd_init+0x30e/0x521 [ 6.513137] elantech_init+0x8a/0x200 [psmouse] [ 6.513200] ? elantech_init_ps2+0xf0/0xf0 [psmouse] [ 6.513249] ? elantech_query_info+0x440/0x440 [psmouse] [ 6.513296] ? synaptics_send_cmd+0x60/0x60 [psmouse] [ 6.513342] ? elantech_query_info+0x440/0x440 [psmouse] [ 6.513388] ? psmouse_try_protocol+0x11e/0x170 [psmouse] [ 6.513432] psmouse_extensions+0x65d/0x6e0 [psmouse] [ 6.513476] ? psmouse_try_protocol+0x170/0x170 [psmouse] [ 6.513519] ? mutex_unlock+0x22/0x40 [ 6.513526] ? ps2_command+0x7f/0x90 [ 6.513536] ? psmouse_probe+0xa3/0xf0 [psmouse] [ 6.513580] psmouse_switch_protocol+0x27d/0x2e0 [psmouse] [ 6.513624] psmouse_connect+0x272/0x530 [psmouse] [ 6.513669] serio_driver_probe+0x55/0x70 [ 6.513679] really_probe+0x190/0x720 [ 6.513689] driver_probe_device+0x160/0x1f0 [ 6.513697] device_driver_attach+0x119/0x130 [ 6.513705] ? device_driver_attach+0x130/0x130 [ 6.513713] __driver_attach+0xe7/0x1a0 [ 6.513720] ? device_driver_attach+0x130/0x130 [ 6.513728] bus_for_each_dev+0xfb/0x150 [ 6.513738] ? subsys_dev_iter_exit+0x10/0x10 [ 6.513748] ? _raw_write_unlock_bh+0x30/0x30 [ 6.513757] driver_attach+0x2d/0x40 [ 6.513764] serio_handle_event+0x199/0x3d0 [ 6.513775] process_one_work+0x471/0x740 [ 6.513785] worker_thread+0x2d2/0x790 [ 6.513794] ? process_one_work+0x740/0x740 [ 6.513802] kthread+0x1b4/0x1e0 [ 6.513809] ? set_kthread_struct+0x80/0x80 [ 6.513816] ret_from_fork+0x22/0x30 [ 6.513832] The buggy address belongs to the page: [ 6.513838] page:00000000bc35e189 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1024d7 [ 6.513847] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) [ 6.513860] raw: 0017ffffc0000000 dead000000000100 dead000000000122 0000000000000000 [ 6.513867] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 6.513872] page dumped because: kasan: bad access detected [ 6.513879] addr ffff8881024d77c2 is located in stack of task kworker/2:1/118 at offset 34 in frame: [ 6.513887] elantech_change_report_id+0x0/0x256 [psmouse] [ 6.513941] this frame has 1 object: [ 6.513947] [32, 34) 'param' [ 6.513956] Memory state around the buggy address: [ 6.513962] ffff8881024d7680: f2 f2 f2 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 [ 6.513969] ffff8881024d7700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 6.513976] >ffff8881024d7780: 00 00 00 00 f1 f1 f1 f1 02 f3 f3 f3 00 00 00 00 [ 6.513982] ^ [ 6.513988] ffff8881024d7800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 6.513995] ffff8881024d7880: 00 f1 f1 f1 f1 03 f2 03 f2 03 f3 f3 f3 00 00 00 [ 6.514000] ================================================================== Define param[] in elantech_change_report_id() as an array of 3 bytes to prevent the out-of-bounds access in the stack. Fixes: e4c9062717fe ("Input: elantech - fix protocol errors for some trackpoints in SMBus mode") BugLink: https://bugs.launchpad.net/bugs/1945590 Signed-off-by: Andrea Righi <andrea.righi@canonical.com> Reviewed-by: Wolfram Sang <wsa@kernel.org> Link: https://lore.kernel.org/r/20211116095559.24395-1-andrea.righi@canonical.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2021-11-11Merge branch 'next' into for-linusDmitry Torokhov
Prepare input updates for 5.16 merge window.
2021-11-09Input: elantench - fix misreporting trackpoint coordinatesPhoenix Huang
Some firmwares occasionally report bogus data from trackpoint, with X or Y displacement being too large (outside of [-127, 127] range). Let's drop such packets so that we do not generate jumps. Signed-off-by: Phoenix Huang <phoenix@emc.com.tw> Tested-by: Yufei Du <yufeidu@cs.unc.edu> Link: https://lore.kernel.org/r/20210729010940.5752-1-phoenix@emc.com.tw Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2021-09-06Input: elan_i2c - reduce the resume time for controller in Whiteboxjingle.wu
Similar to controllers found Voxel, Delbin, Magpie and Bobba, the one found in Whitebox does not need to be reset after issuing power-on command, and skipping reset saves resume time. Signed-off-by: Jingle Wu <jingle.wu@emc.com.tw> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20210907012924.11391-1-jingle.wu@emc.com.tw Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2021-07-18Merge tag 'v5.13' into nextDmitry Torokhov
Sync up with the mainline to get the latest parport API.
2021-06-19Input: trackpoint - use kobj_to_dev()YueHaibing
Use kobj_to_dev() instead of container_of() Generated by: scripts/coccinelle/api/kobj_to_dev.cocci Signed-off-by: YueHaibing <yuehaibing@huawei.com> Link: https://lore.kernel.org/r/20210607122722.36736-1-yuehaibing@huawei.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2021-05-06Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - three new touchscreen drivers: Hycon HY46XX, ILITEK Lego Series, and MStar MSG2638 - a new driver for Azoteq IQS626A proximity and touch controller - addition of Amazon Game Controller to the list of devices handled by the xpad driver - Elan touchscreen driver will avoid binding to devices described as I2CHID compatible in ACPI tables - various driver fixes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (56 commits) Input: xpad - add support for Amazon Game Controller Input: ili210x - add missing negation for touch indication on ili210x MAINTAINERS: repair reference in HYCON HY46XX TOUCHSCREEN SUPPORT Input: add driver for the Hycon HY46XX touchpanel series dt-bindings: touchscreen: Add HY46XX bindings dt-bindings: Add Hycon Technology vendor prefix Input: cyttsp - flag the device properly Input: cyttsp - set abs params for ABS_MT_TOUCH_MAJOR Input: cyttsp - drop the phys path Input: cyttsp - reduce reset pulse timings Input: cyttsp - error message on boot mode exit error Input: apbps2 - remove useless variable Input: mms114 - support MMS136 Input: mms114 - convert bindings to YAML and extend Input: Add support for ILITEK Lego Series dt-bindings: input: touchscreen: ilitek_ts_i2c: Add bindings Input: add MStar MSG2638 touchscreen driver dt-bindings: input/touchscreen: add bindings for msg2638 Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state Input: elants_i2c - do not bind to i2c-hid compatible ACPI instantiated devices ...
2021-04-10Input: elantech - Prepare a complete software node for the deviceHeikki Krogerus
Creating a software node and supplying that for the device instead of only the device properties in it. A software node was always created in any case to hold the additional device properties, so this change does not have any real effect. This change makes it possible to remove support for the problematic "dangling" device properties from i2c subsystem, i.e. the "properties" member from struct i2c_board_info. The problems caused by them are not related to this driver. Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Wolfram Sang <wsa@kernel.org>
2021-03-25Input: elan_i2c - fix a typo in parameter nameNikolai Kostrigin
s/max_baseliune/max_baseline/ Signed-off-by: Nikolai Kostrigin <nickel@altlinux.org> Link: https://lore.kernel.org/r/20210311114146.1977616-1-nickel@altlinux.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2021-03-09Input: elan_i2c - reduce the resume time for new devicesJingle Wu
Newer controllers, such as Voxel, Delbin, Magple, Bobba and others, do not need to be reset after issuing power-on command, and skipping reset saves at least 100ms from resume time. Note that if first attempt of re-initializing device fails we will not be skipping reset on the subsequent ones. Signed-off-by: Jingle Wu <jingle.wu@emc.com.tw> Link: https://lore.kernel.org/r/20210226073537.4926-1-jingle.wu@emc.com.tw Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2021-02-22Input: alps - fix spelling of "positive"Bhaskar Chowdhury
s/postive/positive/ Signed-off-by: Bhaskar Chowdhury <unixbhaskar@gmail.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Pali Rohár <pali@kernel.org> Link: https://lore.kernel.org/r/20210222075439.32201-1-unixbhaskar@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2021-02-22Merge tag 'v5.11' into nextDmitry Torokhov
Merge with mainline to get latest APIs and device tree bindings.
2021-01-19Input: synaptics - replace NOOP with suitable commentaryLee Jones
Fixes the following W=1 kernel build warning(s): drivers/input/mouse/synaptics.c: In function ‘synaptics_process_packet’: drivers/input/mouse/synaptics.c:1110:6: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] Signed-off-by: Lee Jones <lee.jones@linaro.org> Link: https://lore.kernel.org/r/20210114152323.2382283-2-lee.jones@linaro.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2020-12-14Merge branch 'next' into for-linusDmitry Torokhov
Prepare input updates for 5.11 merge window.
2020-12-14Input: cyapa_gen6 - fix out-of-bounds stack accessArnd Bergmann
gcc -Warray-bounds warns about a serious bug in cyapa_pip_retrieve_data_structure: drivers/input/mouse/cyapa_gen6.c: In function 'cyapa_pip_retrieve_data_structure.constprop': include/linux/unaligned/access_ok.h:40:17: warning: array subscript -1 is outside array bounds of 'struct retrieve_data_struct_cmd[1]' [-Warray-bounds] 40 | *((__le16 *)p) = cpu_to_le16(val); drivers/input/mouse/cyapa_gen6.c:569:13: note: while referencing 'cmd' 569 | } __packed cmd; | ^~~ Apparently the '-2' was added to the pointer instead of the value, writing garbage into the stack next to this variable. Fixes: c2c06c41f700 ("Input: cyapa - add gen6 device module support") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://lore.kernel.org/r/20201026161332.3708389-1-arnd@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2020-12-11Input: elantech - fix protocol errors for some trackpoints in SMBus modejingle.wu
There are some version of Elan trackpads that send incorrect data when in SMbus mode, unless they are switched to use 0x5f reports instead of standard 0x5e. This patch implements querying device to retrieve chips identifying data, and switching it, when needed to the alternative report. Signed-off-by: Jingle Wu <jingle.wu@emc.com.tw> Link: https://lore.kernel.org/r/20201211071531.32413-1-jingle.wu@emc.com.tw Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2020-12-11Input: elan_i2c - add new trackpoint report type 0x5FJingle Wu
The 0x5F is a new trackpoint report type used by some modules. Signed-off-by: Jingle Wu <jingle.wu@emc.com.tw> Link: https://lore.kernel.org/r/20201211071511.32349-1-jingle.wu@emc.com.tw Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-10-15 09:28:10 +0000