Commit Graph

2551 Commits

Author SHA1 Message Date
Scott Bauer 93a2001bdf HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands
This patch validates the num_values parameter from userland during the
HIDIOCGUSAGES and HIDIOCSUSAGES commands. Previously, if the report id was set
to HID_REPORT_ID_UNKNOWN, we would fail to validate the num_values parameter
leading to a heap overflow.

Cc: stable@vger.kernel.org
Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-06-24 10:21:39 +02:00
Benjamin Tissoires a80e803a2a HID: multitouch: Add MT_QUIRK_NOT_SEEN_MEANS_UP to Surface Pro 3
The firmware found in the touch screen of an SP3 is buggy and may miss
to send lift off reports for contacts. Try to work around that issue by
using MT_QUIRK_NOT_SEEN_MEANS_UP.

based on a patch from: Daniel Martin <consume.noise@gmail.com>

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-06-01 16:03:28 +02:00
Oliver Neukum ed596a4a88 HID: elo: kill not flush the work
Flushing a work that reschedules itself is not a sensible operation. It needs
to be killed. Failure to do so leads to a kernel panic in the timer code.

CC: stable@vger.kernel.org
Signed-off-by: Oliver Neukum <ONeukum@suse.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-06-01 14:08:17 +02:00
Jiri Kosina 66bc5ba523 Merge branch 'for-4.7/wacom' into for-linus 2016-05-17 12:42:27 +02:00
Jiri Kosina 3390e579b3 Merge branch 'for-4.7/upstream' into for-linus
Conflicts:
	drivers/hid/usbhid/hid-quirks.c
2016-05-17 12:41:22 +02:00
Jiri Kosina 27fd38c522 Merge branches 'for-4.6/upstream-fixes', 'for-4.7/asus', 'for-4.7/hidraw' and 'for-4.7/thingm' into for-linus 2016-05-17 12:38:03 +02:00
Ping Cheng eff6ca9799 HID: wacom: add missed stylus_in_proximity line back
Commit 7e12978 ("HID: wacom: break out wacom_intuos_get_tool_type") by accident
removed stylus_in_proximity flag for Intuos series while shuffling the code
around.

Fix that by reintroducing that flag setting in wacom_intuos_inout(), where
it originally was.

Fixes: 7e12978 ("HID: wacom: break out wacom_intuos_get_tool_type")
Signed-off-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-05-03 12:03:44 +02:00
Jason Gerecke bef7e20006 HID: wacom: Add fuzz factor to distance and tilt axes
The fuzz present on the distance and tilt axes is noticable when a puck is
present, and userspace (specifically libinput) would like the ability to
filter out the noise. To facilitate this, we assign a fuzz value of '1'
for the distance and tilt axes. This is large enough to cover most of the
natural variation in distance value as the puck is moved around, and
enough to cover the jitter in rotation (reported through tilt axes) when
the puck is left alone.

Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-05-03 11:55:05 +02:00
Trent Lloyd 282bf1fe6d HID: usbhid: quirks for Corsair RGB keyboard & mice (K70R, K95RGB, M65RGB, K70RGB, K65RGB)
These devices feature multiple interfaces/endpoints: a legacy BIOS/boot
interface (endpoint 0x81), as well as 2 corsair-specific keyboard interfaces
(endpoint 0x82, 0x83 IN/0x03 OUT) and an RGB LED control interface (endpoint
0x84 IN/0x04 OUT)

Because the extra 3 interfaces are not of subclass USB_INTERFACE_SUBCLASS_BOOT,
HID_QUIRK_NOGET is not automatically set on them and a 10s timeout per-endpoint
(30s per device) occurs initialising reports on boot.  We configure
HID_QUIRK_NO_INIT_REPORTS for these devices.

Additionally the left-side G1-G18 macro keys on the K95RGB generate output on
the un-opened 0x82/0x83 endpoints which causes the keyboard to stop responding
waiting for this event to be collected.  We enable HID_QUIRK_ALWAYS_POLL to
prevent this situation from occurring.

Signed-off-by: Trent Lloyd <trent@lloyd.id.au>
Tested-by: SUGNIAUX Wilfried <wsu@ppharm2k20.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-27 11:21:29 +02:00
Nazar Mokrynskyi 567a44ecb4 HID: Fix boot delay for Creative SB Omni Surround 5.1 with quirk
Needed for v2 of the device firmware, otherwise kernel will stuck for few
seconds and throw "usb_submit_urb(ctrl) failed: -1" early on system boot.

Signed-off-by: Nazar Mokrynskyi <nazar@mokrynskyi.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-25 16:23:26 +02:00
Heiner Kallweit bbf4ac9cfa HID: thingm: remove not needed error message
LED core takes care of handling failed calls to thingm_let_set.
- print error message in set_brightness_delayed or
- pass error to caller in led_set_brightness_sync
Also the error message here doesn't provide any hint what actually
went wrong. Therefore remove it.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@rehat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-25 11:30:57 +02:00
Heiner Kallweit a4362fd6da HID: thingm: set new flag LED_HW_PLUGGABLE
Use recently introduced flag LED_HW_PLUGGABLE to avoid warnings when
the device is unplugged.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-18 13:01:38 +02:00
Heiner Kallweit 91540ccc9c HID: thingm: factor out duplicated code to thingm_init_led
Simplify thingm_init_rgb by factoring out duplicated code
to thingm_init_led.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-18 13:01:38 +02:00
Ping Cheng e1123fe975 HID: wacom: Add support for DTK-1651
DTK-1651 is a display pen-only tablet

Signed-off-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-12 23:23:53 +02:00
Linus Torvalds 1c74a7f812 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
Pull HID fixes from Jiri Kosina:

 - fix for how scaling linearization is computed in wiimote driver, by
   Cyan Ogilvie

 - endless retry loop fix in generic USB HID core reset-resume handling,
   by Alan Stern

 - two functional fixes affecting particular devices, and oops fix for
   wacom driver, by Jason Gerecke

 - multitouch slot numbering fix from Gabriele Mazzotta

 - a couple more small fixes on top

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: wacom: Support switching from vendor-defined device mode on G9 and G11
  HID: wacom: Initialize hid_data.inputmode to -1
  HID: microsoft: add support for 3 more devices
  HID: multitouch: Synchronize MT frame on reset_resume
  HID: wacom: fix Bamboo ONE oops
  HID: lenovo: Don't use stack variables for DMA buffers
  HID: usbhid: fix inconsistent reset/resume/reset-resume behavior
  HID: wiimote: Fix wiimote mp scale linearization
2016-04-11 12:31:09 -07:00
Dmitry Torokhov 95d1c8951e HID: simplify implement() a bit
The 'size' variable is not really needed, and we can also shift constant
in the loop body when masking off existing bits.

Also we do not have to use 64 bit calculations if we take an extra
branch.

[jkosina@suse.cz: fix a small error in changelog]
Suggested-by: Doug Anderson <dianders@chromium.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-07 15:45:09 +02:00
Jason Gerecke 326ea2a905 HID: wacom: Support switching from vendor-defined device mode on G9 and G11
A tablet PC booted into Windows may have its pen/touch hardware switched
into "Wacom mode" similar to what we do with explicitly-supported hardware.
Some devices appear to maintain this state across reboots, preventing their
use with the generic HID driver. This patch adds support for detecting the
presence of the mode switch feature report used by devices based on the G9
and G11 chips and has the HID codepath always attempt to reset the device
back to sending standard HID reports.

Fixes: https://sourceforge.net/p/linuxwacom/bugs/307/
Fixes: https://sourceforge.net/p/linuxwacom/bugs/310/
Fixes: https://github.com/linuxwacom/input-wacom/issues/15

Co-authored-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-05 17:20:32 +02:00
Jason Gerecke c6fa1aeba0 HID: wacom: Initialize hid_data.inputmode to -1
Commit 5ae6e89 introduced hid_data.inputmode with a comment that it
would have the value -1 if undefined, but then forgot to actually
perform the initialization. Although this doesn't appear to have
caused any problems in practice, it should still be remedied.

Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-05 17:20:31 +02:00
Alistair Leslie-Hughes c847a89a87 HID: microsoft: add support for 3 more devices
Adds support for the Micrsift Digital 4K, Media 600 and Media 3000 V1 Keyboards,
which have the same quirks as the already existing hardware MS_NE4K.

Fixes https://bugzilla.kernel.org/show_bug.cgi?id=52841

[jkosina@suse.cz: rephrase changelog]
Signed-off-by: Alistair Leslie-Hughes <leslie_alistair@hotmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-04 15:56:16 +02:00
Yusuke Fujimaki b94f7d5ddf HID: asus: add support for VivoBook E200HA
Asus X205TA and E200HA built-in keyboard contain wrong logical maximum value in
report descriptor.

This patch correct wrong logical maximum in report descriptor.

Signed-off-by: Yusuke Fujimaki <usk.fujimaki@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-04 09:59:21 +02:00
Dan Carpenter 6edac6fde5 HID: hidraw: silence an uninitialized variable warning
My static checker complains that "devid" can be uninitialized if
alloc_chrdev_region() fails.  Fix this by moving the error hanling
forward a couple lines.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-04 09:49:12 +02:00
Dan Carpenter 85d08340c3 HID: roccat: silence an uninitialized variable warning
My static checker complains because we use "dev_id" before we check for
errors so it could be uninitialized.  Fix this by moving the error
handling forward a couple lines.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-04 09:49:12 +02:00
Yusuke Fujimaki eeb01a5792 HID: Asus X205TA keyboard driver
Asus X205TA built-in keyboard contains wrong
logical maximum value in report descriptor.

0x05, 0x01,  // Usage Page (Generic Desktop)
0x09, 0x06,  // Usage (Keyboard)
0xa1, 0x01,  // Collection (Application)
0x85, 0x01,  // Report ID (1)
0x05, 0x07,  // Usage Page (Keyboard/Keypad)
0x19, 0xe0,  // Usage Minimum (224)
0x29, 0xe7,  // Usage Maximum (231)
0x15, 0x00,  // Logical Minimum (0)
0x25, 0x01,  // Logical Maximum (1)
0x75, 0x01,  // Report Size (1)
0x95, 0x08,  // Report Count (8)
0x81, 0x02,  // Input (Data,Array,Abs)
0x95, 0x01,  // Report Count (1)
0x75, 0x08,  // Report Size (8)
0x81, 0x03,  // Input (Const,Var,Abs)
0x95, 0x05,  // Report Count (5)
0x75, 0x01,  // Report Size (1)
0x05, 0x08,  // Usage (LED)
0x19, 0x01,  // Usage Minimum (1)
0x29, 0x05,  // Usage Maximum (5)
0x91, 0x02,  // Output (Data,Var,Abs)
0x95, 0x01,  // Report Count (1)
0x75, 0x03,  // Report Size (3)
0x91, 0x03,  // Output (Const,Var,Abs)
0x95, 0x06,  // Report Count (6)
0x75, 0x08,  // Report Size (8)
0x15, 0x00,  // Logical Minimum (0)
0x25, 0x65,  // Logical Maximum (101)  * too small *
0x05, 0x07,  // Usage Page (Keyboard/Keypad)
0x19, 0x00,  // Usage Minimum (0)
0x29, 0xdd,  // Usage Maximum (221)
0x81, 0x00,  // Input(Data,Array,Abs)

In Asus X205TA japanese keyboard model,there are language
specific keys over usage id 101.
This patch correct wrong logical maximum in report
descriptor.

Signed-off-by: Yusuke Fujimaki <usk.fujimaki@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-01 11:47:04 +02:00
Gabriele Mazzotta 0a0f5b7e5b HID: multitouch: Synchronize MT frame on reset_resume
input_mt_get_slot_by_key() requires input_mt_sync_frame() to be called
at each frame. Do it when releasing the touches, or else we won't get
a proper slot number after mt_reset_resume().

Signed-off-by: Gabriele Mazzotta <gabriele.mzt@gmail.com>
Reviewed-by: Benson Leung <bleung@chromium.org>
Reviewed-by: Benjamin TIssoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-04-01 11:34:11 +02:00
Benjamin Tissoires 580549ef6b HID: wacom: fix Bamboo ONE oops
Looks like recent changes in the Wacom driver made the Bamboo ONE crashes.
The tablet behaves as if it was a regular Bamboo device with pen, touch
and pad, but there is no physical pad connected to it.
The weird part is that the pad is still sending events and given that
there is no input node connected to it, we get  anull pointer exception.

Link: https://bugzilla.redhat.com/show_bug.cgi?id=1317116

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Ping Cheng <pingc@wacom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-29 15:42:27 +02:00
Josh Boyer ea36ae0910 HID: lenovo: Don't use stack variables for DMA buffers
The lenovo_send_cmd_cptkbd function uses a stack variable to submit
commands via hid_hw_raw_request.  Eventually this gets to the
usb_hcd_map_urb_for_dma function, which causes a warning to be thrown
if the CONFIG_DMA_API_DEBUG option is enabled.

Fix this by allocating a temporary buffer instead.

[jkosina@suse.cz: no need to NULL-initialize buf, spotted by Benjamin]
Reported-by: lejeczek <peljasz@yahoo.co.uk>
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-29 15:39:36 +02:00
Alan Stern 972e6a993f HID: usbhid: fix inconsistent reset/resume/reset-resume behavior
The usbhid driver has inconsistently duplicated code in its post-reset,
resume, and reset-resume pathways.

	reset-resume doesn't check HID_STARTED before trying to
	restart the I/O queues.

	resume fails to clear the HID_SUSPENDED flag if HID_STARTED
	isn't set.

	resume calls usbhid_restart_queues() with usbhid->lock held
	and the others call it without holding the lock.

The first item in particular causes a problem following a reset-resume
if the driver hasn't started up its I/O.  URB submission fails because
usbhid->urbin is NULL, and this triggers an unending reset-retry loop.

This patch fixes the problem by creating a new subroutine,
hid_restart_io(), to carry out all the common activities.  It also
adds some checks that were missing in the original code:

	After a reset, there's no need to clear any halted endpoints.

	After a resume, if a reset is pending there's no need to
	restart any I/O until the reset is finished.

	After a resume, if the interrupt-IN endpoint is halted there's
	no need to submit the input URB until the halt has been
	cleared.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Daniel Fraga <fragabr@gmail.com>
Tested-by: Daniel Fraga <fragabr@gmail.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-24 15:26:20 +01:00
Dmitry Torokhov 8f507c8b0f HID: hidraw: switch to using memdup_user
Instead of open-coding memory allocation and copying form user memory
sequence let's use memdup_user().

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-24 15:21:54 +01:00
Andy Lutomirski 7365abbade drivers/hid/uhid.c: check write() bitness using in_compat_syscall
uhid changes the format expected in write() depending on bitness.  It
should check the syscall bitness directly.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: David Herrmann <dh.herrmann@googlemail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-03-22 15:36:02 -07:00
Cyan Ogilvie d30596737e HID: wiimote: Fix wiimote mp scale linearization
The wiimote motion plus gyros use two scales to report fast and slow
rotation - below 440 deg/s uses 8192/440 units / deg/s, and above uses
8192/2000 units / deg/s.

Previously this driver attempted to linearize the two by scaling the fast
rate by 18 and the slow by 9, but this results in a scale of
8192*9/440 = ~167.564 for slow and 8192*18/2000 = 73.728 for fast.

Correct the fast motion scale factor so that both report ~167.564
units / deg/s

Signed-off-by: Cyan Ogilvie <cyan.ogilvie@gmail.com>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-18 17:31:38 +01:00
Linus Torvalds d66435cc7d Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
Pull HID updates from Jiri Kosina:

 - functionally equivalent cleanups for wacom driver, making the code
   more readable, from Benjamin Tissoires

 - a bunch of improvements and fixes for thingm driver from Heiner
   Kallweit

 - bugfixes to out-of-bound access for generic parsing functions (which
   have been there since ever) extract() and implement(), from Dmitry
   Torokhov

 - a lot of added / improved device support in sony, wacom, microsoft,
   multitouch and logitech driver, from various people

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (44 commits)
  HID: microsoft: Add ID for MS Wireless Comfort Keyboard
  hid: thingm: reorder calls in thingm_probe
  HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report()
  HID: multitouch: Release all touch slots on reset_resume
  HID: usbhid: enable NO_INIT_REPORTS quirk for Semico USB Keykoard2
  HID: penmount: report only one button for PenMount 6000 USB touchscreen controller
  HID: i2c-hid: Fix suspend/resume when already runtime suspended
  HID: i2c-hid: Add hid-over-i2c name to i2c id table
  HID: multitouch: force retrieving of Win8 signature blob
  HID: Support for CMedia CM6533 HID audio jack controls
  HID: thingm: improve locking
  HID: thingm: switch to managed version of led_classdev_register
  HID: thingm: remove workqueue
  HID: corsair: fix mapping of non-keyboard usages
  HID: wacom: close the wireless receiver on remove()
  HID: wacom: cleanup input devices
  HID: wacom: reuse wacom_parse_and_register() in wireless_work
  HID: wacom: move down wireless_work()
  HID: wacom: break out parsing of device and registering of input
  HID: wacom: break out wacom_intuos_get_tool_type
  ...
2016-03-17 21:32:20 -07:00
Jiri Kosina e1c9b9ff24 Merge branches 'for-4.5/upstream-fixes', 'for-4.6/cmedia', 'for-4.6/i2c-hid', 'for-4.6/logitech', 'for-4.6/multitouch', 'for-4.6/penmount', 'for-4.6/sony', 'for-4.6/thingm', 'for-4.6/upstream' and 'for-4.6/wacom' into for-linus 2016-03-17 13:51:54 +01:00
Slava Bacherikov f9a82c2054 HID: microsoft: Add ID for MS Wireless Comfort Keyboard
Microsoft Wireless Comfort Keyboard has vendor specific My Favorites
1-5 keys. Linux already supports this buttons on other MS keyboards by
MS_ERGONOMY quirk. So apply MS_ERGONOMY quirk to USB PID 0x00e3
(Microsoft Wireless Optical Desktop Receiver 3.0A). After this
My Favorites 1..5 keys will be reported as KEY_F14..KEY_F15 events.

Signed-off-by: Slava Bacherikov <slava@bacher09.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-16 11:19:26 +01:00
Heiner Kallweit 1d1b564ff8 hid: thingm: reorder calls in thingm_probe
When reviewing another thingm patch Benjamin Tissoires pointed out
the following: "The problem here is that hid_hw_start() is called
before thingm_version() which allows user space to briefly introduce
races between thingm_version() and any hidraw requests.
The mutex will not help here as it is initialized after hid_hw_start()
and only used for protecting the concurrent access of the rgb."

Avoid this possible issue by calling hid_hw_start() later in the
probe function.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-15 15:28:55 +01:00
Dmitry Torokhov 3b654288b1 HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report()
Even though hid_hw_* checks that passed in data_len is less than
HID_MAX_BUFFER_SIZE it is not enough, as i2c-hid does not necessarily
allocate buffers of HID_MAX_BUFFER_SIZE but rather checks all device
reports and select largest size. In-kernel users normally just send as much
data as report needs, so there is no problem, but hidraw users can do
whatever they please:

BUG: KASAN: slab-out-of-bounds in memcpy+0x34/0x54 at addr ffffffc07135ea80
Write of size 4101 by task syz-executor/8747
CPU: 2 PID: 8747 Comm: syz-executor Tainted: G    BU         3.18.0 #37
Hardware name: Google Tegra210 Smaug Rev 1,3+ (DT)
Call trace:
[<ffffffc00020ebcc>] dump_backtrace+0x0/0x258 arch/arm64/kernel/traps.c:83
[<ffffffc00020ee40>] show_stack+0x1c/0x2c arch/arm64/kernel/traps.c:172
[<     inline     >] __dump_stack lib/dump_stack.c:15
[<ffffffc001958114>] dump_stack+0x90/0x140 lib/dump_stack.c:50
[<     inline     >] print_error_description mm/kasan/report.c:97
[<     inline     >] kasan_report_error mm/kasan/report.c:278
[<ffffffc0004597dc>] kasan_report+0x268/0x530 mm/kasan/report.c:305
[<ffffffc0004592e8>] __asan_storeN+0x20/0x150 mm/kasan/kasan.c:718
[<ffffffc0004594e0>] memcpy+0x30/0x54 mm/kasan/kasan.c:299
[<ffffffc001306354>] __i2c_hid_command+0x2b0/0x7b4 drivers/hid/i2c-hid/i2c-hid.c:178
[<     inline     >] i2c_hid_set_or_send_report drivers/hid/i2c-hid/i2c-hid.c:321
[<ffffffc0013079a0>] i2c_hid_output_raw_report.isra.2+0x3d4/0x4b8 drivers/hid/i2c-hid/i2c-hid.c:589
[<ffffffc001307ad8>] i2c_hid_output_report+0x54/0x68 drivers/hid/i2c-hid/i2c-hid.c:602
[<     inline     >] hid_hw_output_report include/linux/hid.h:1039
[<ffffffc0012cc7a0>] hidraw_send_report+0x400/0x414 drivers/hid/hidraw.c:154
[<ffffffc0012cc7f4>] hidraw_write+0x40/0x64 drivers/hid/hidraw.c:177
[<ffffffc0004681dc>] vfs_write+0x1d4/0x3cc fs/read_write.c:534
[<     inline     >] SYSC_pwrite64 fs/read_write.c:627
[<ffffffc000468984>] SyS_pwrite64+0xec/0x144 fs/read_write.c:614
Object at ffffffc07135ea80, in cache kmalloc-512
Object allocated with size 268 bytes.

Let's check data length against the buffer size before attempting to copy
data over.

Cc: stable@vger.kernel.org
Reported-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-15 14:27:10 +01:00
Benson Leung d3e69b9a04 HID: multitouch: Release all touch slots on reset_resume
When resetting a device (especially after power loss) it is unlikely
that the firmware will keep the contact tracking data for the previous
touches and will be able to reconcile it with the new contacts, so
let's release all slots on reset resume as start anew.

Signed-off-by: Benson Leung <bleung@chromium.org>
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-14 10:00:00 +01:00
Daniel Bristot de Oliveira c14022bfd2 HID: usbhid: enable NO_INIT_REPORTS quirk for Semico USB Keykoard2
The device which identifies itself as a "USB Keykoard" (no typo)
with VID:PID 1a2c:0027 does not seem to be handling the reports
initialization very well.

This results in a "usb_submit_urb(ctrl) failed: -1" message from the
kernel when connected, and a delay before its initialization. It can
also cause the hang the system.

This patch adds the  quirk for this device, which causes the delay
to disappear. It is named as "USB Keykoard2" because the "USB Keykoard"
already exists.

Signed-off-by: Daniel Bristot de Oliveira <bristot@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-10 18:20:24 +01:00
Andrew Shadura 5f66872cbd HID: penmount: report only one button for PenMount 6000 USB touchscreen controller
PenMount 6000 USB resistive touchscreen controller reports it has three
buttons, while in reality it doesn't have any and doesn't support active
styli, and only generates touch events.

In penmount_input_mapping(), map only the first button (with code 0),
ignore the rest.

Signed-off-by: Andrew Shadura <andrew.shadura@collabora.co.uk>
Tested-by: Christian Gmeiner <c.gmeiner@bachmann.info
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-10 17:17:26 +01:00
Doug Anderson 01714a6f5f HID: i2c-hid: Fix suspend/resume when already runtime suspended
On ACPI-based systems ACPI power domain code runtime resumes device before
calling suspend method, which ensures that i2c-hid suspend code starts with
device not in low-power state and with interrupts enabled.

On other systems, especially if device is not a part of any power domain,
we may end up calling driver's system-level suspend routine while the
device is runtime-suspended (with controller in presumably low power state
and interrupts disabled). This will result in interrupts being essentially
disabled twice, and we will only re-enable them after both system resume
and runtime resume methods complete. Unfortunately i2c_hid_resume() calls
i2c_hid_hwreset() and that only works properly if interrupts are enabled.

Also if device is runtime-suspended driver's suspend code may fail if it
tries to issue I/O requests.

Let's fix it by runtime-resuming the device if we need to run HID driver's
suspend code and also disabling interrupts only if device is not already
runtime-suspended. Also on resume we mark the device as running at full
power (since that is what resetting will do to it).

Reviewed-by: Benson Leung <bleung@chromium.org>
Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Doug Anderson <dianders@chromium.org>
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-10 10:04:22 +01:00
Benson Leung 1dcdde98bc HID: i2c-hid: Add hid-over-i2c name to i2c id table
When using the device tree binding OF compatible = "hid-over-i2c" the
i2c id table also needs to have that name in order to auto load this
driver, since i2c core reports module alias as i2c:<string> where
<string> is compatible string of OF binding stripped of manufacturer's
prefix.

Tested-by: Andrew Duggan <aduggan@synaptics.com>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Benson Leung <bleung@chromium.org>
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-10 10:04:21 +01:00
Benjamin Tissoires 45c5c68282 HID: multitouch: force retrieving of Win8 signature blob
The Synaptics 0x11e5 over I2C found in the Asus T100-CHI requires to
fetch the signature blob to actually start sending events.

With this patch, we should be close enough to the Windows driver which
checks the content of the blob at plugin to validate or not the
touchscreen.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=113481
Fixes: 6d4f5440 ("HID: multitouch: Fetch feature reports on demand for Win8 devices")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-07 23:42:49 +01:00
Ben Chen ad8ddc5755 HID: Support for CMedia CM6533 HID audio jack controls
The C-Media CM6533 is a USB audio chip featuring it's jack detection
capability.The device originates an interrupt transfer via HID interface each
time when a jack event occurs.  The purpose of this patch is to handle hid raw
events to keep the operating system informed of user interactions.

Signed-off-by: Ben Chen <ben_chen@bizlinktech.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-02 10:31:36 +01:00
Heiner Kallweit 43a4a04d4d HID: thingm: improve locking
Reading from the device consists of two operations: sending the read
command and the actual read from the device. If the device is accessed
in between we might read wrong data. Therefore protect the full sequence
of both operations with a mutex.
Also change the semantics of thingm_recv to include both operations.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-02 10:20:31 +01:00
Heiner Kallweit c46fab2870 HID: thingm: switch to managed version of led_classdev_register
Simplify the code by switching to the managed version of
led_classdev_register.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-02 10:20:30 +01:00
Heiner Kallweit 3de68ce92b HID: thingm: remove workqueue
Defining workqueues in LED drivers isn't needed any longer as the LED core
was extended with a generic workqueue recently.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-03-02 10:20:30 +01:00
Clément Vuchener e791f7b102 HID: corsair: fix mapping of non-keyboard usages
This fixes a bug where the Volume Up key was ignored because it uses the same usage code as G18. Special Corsair usage codes are in the keyboard page, other pages should be left to the generic driver.

Signed-off-by: Clément Vuchener <clement.vuchener@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-02-23 14:21:19 +01:00
Benjamin Tissoires f620516178 HID: wacom: close the wireless receiver on remove()
rmmod/insmod the wacom.ko module does not work for the receiver because
it was not previously closed. Now, we can hack with the wireless receiver
without having to unplug/replug it.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-02-16 20:40:38 +01:00
Benjamin Tissoires 17f28470f4 HID: wacom: cleanup input devices
Just some cleaning up when the input devices are unregistered.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-02-16 20:40:38 +01:00
Benjamin Tissoires fd5f92b6d3 HID: wacom: reuse wacom_parse_and_register() in wireless_work
Removes duplicated code.
The only difference is that we now need to stop and start the attached hid
device, but this is a small cost.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-02-16 20:40:37 +01:00
Benjamin Tissoires a2f091af75 HID: wacom: move down wireless_work()
If wireless_work() wants to reuse parse_and_register(), we need to have
it declared after this function.

No functional changes.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2016-02-16 20:40:37 +01:00