Linux kernel stable tree (mirror) https://git.radix-linux.su/kernel/linux.git/atom?h=v3.2.95 2017-07-18T17:38:34+00:00 2017-07-18T17:38:34+00:00 Johan Hovold johan@kernel.org 2017-03-16T18:37:01+00:00 urn:sha1:5afad9651d8807c583e442eb52b7a6ac31f72e34 commit 5cc4a1a9f5c179795c8a1f2b0f4361829d6a070e upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints. Fixes: aca951a22a1d ("[PATCH] input-driver-yealink-P1K-usb-phone") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2017-07-18T17:38:34+00:00 Johan Hovold johan@kernel.org 2017-03-16T18:35:12+00:00 urn:sha1:91b1397df10443bd9ccbc50fbe21fcb3c361d104 commit ac2ee9ba953afe88f7a673e1c0c839227b1d7891 upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints. Fixes: c04148f915e5 ("Input: add driver for USB VoIP phones with CM109...") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2016-08-22T21:37:12+00:00 Manfred Schlaegl manfred.schlaegl@gmx.at 2016-05-27T23:36:36+00:00 urn:sha1:0ab9b883b36507e4ca4e5a0883fcca25c8a9e32c commit f49cf3b8b4c841457244c461c66186a719e13bcc upstream. Pwm config may sleep so defer it using a worker. On a Freescale i.MX53 based board we ran into "BUG: scheduling while atomic" because input_inject_event locks interrupts, but imx_pwm_config_v2 sleeps. Tested on Freescale i.MX53 SoC with 4.6.0. Signed-off-by: Manfred Schlaegl <manfred.schlaegl@gmx.at> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2016-08-22T21:37:12+00:00 Olivier Sobrie olivier@sobrie.be 2015-03-12T21:47:13+00:00 urn:sha1:e8025db4dc8593abea2c1f70bb70315790550fe1 commit d1b12075ffa808dce33dd46b7ad035bebf8da215 upstream. Calling pwm_config() with a period equal to zero always results in error (-EINVAL) and pwm chip config method is never called. Signed-off-by: Olivier Sobrie <olivier@sobrie.be> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2016-08-22T21:37:12+00:00 Ricky Liang jcliang@chromium.org 2016-05-20T17:58:59+00:00 urn:sha1:b3b03b8c3ce3c5095f81998d8783b25891a1ba13 commit affa80bd97f7ca282d1faa91667b3ee9e4c590e6 upstream. When running a 32-bit userspace on a 64-bit kernel, the UI_SET_PHYS ioctl needs to be treated with special care, as it has the pointer size encoded in the command. Signed-off-by: Ricky Liang <jcliang@chromium.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2016-06-15T20:28:12+00:00 Stephen Boyd sboyd@codeaurora.org 2016-04-17T12:21:42+00:00 urn:sha1:2f58d46cf07011aec2a6f840c9cc235d39b294b7 commit eda5ecc0a6b865561997e177c393f0b0136fe3b7 upstream. The trigger delay algorithm that converts from microseconds to the register value looks incorrect. According to most of the PMIC documentation, the equation is delay (Seconds) = (1 / 1024) * 2 ^ (x + 4) except for one case where the documentation looks to have a formatting issue and the equation looks like delay (Seconds) = (1 / 1024) * 2 x + 4 Most likely this driver was written with the improper documentation to begin with. According to the downstream sources the valid delays are from 2 seconds to 1/64 second, and the latter equation just doesn't make sense for that. Let's fix the algorithm and the range check to match the documentation and the downstream sources. Reported-by: Bjorn Andersson <bjorn.andersson@linaro.org> Fixes: 92d57a73e410 ("input: Add support for Qualcomm PMIC8XXX power key") Signed-off-by: Stephen Boyd <sboyd@codeaurora.org> Tested-by: John Stultz <john.stultz@linaro.org> Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> [bwh: Backported to 3.2: use pdata->kpd_trigger_delay_us not kpd_delay] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2016-04-30T22:05:21+00:00 Vladis Dronov vdronov@redhat.com 2016-03-23T18:53:46+00:00 urn:sha1:ae211053c771562a27a53c2a49f20f720a7c473d commit 950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d upstream. The ati_remote2 driver expects at least two interfaces with one endpoint each. If given malicious descriptor that specify one interface or no endpoints, it will crash in the probe function. Ensure there is at least two interfaces and one endpoint for each interface before using it. The full disclosure: http://seclists.org/bugtraq/2016/Mar/90 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2016-04-30T22:05:18+00:00 Josh Boyer jwboyer@fedoraproject.org 2016-03-14T16:33:40+00:00 urn:sha1:615fd7f1ce2ced5bd401aeac55cda44295c2ae58 commit 9c6ba456711687b794dcf285856fc14e2c76074f upstream. The powermate driver expects at least one valid USB endpoint in its probe function. If given malicious descriptors that specify 0 for the number of endpoints, it will crash. Validate the number of endpoints on the interface before using them. The full report for this issue can be found here: http://seclists.org/bugtraq/2016/Mar/85 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2011-12-19T23:11:12+00:00 Linus Torvalds torvalds@linux-foundation.org 2011-12-19T23:11:12+00:00 urn:sha1:10ee08b7570dde2bac77d3f96eca2ce630a32b49 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: synaptics - fix touchpad not working after S2R on Vostro V13 Input: cma3000_d0x - fix signedness bug in cma3000_thread_irq() Input: wacom - add product id used by Samsung Slate 7 2011-12-12T08:01:02+00:00 Xi Wang xi.wang@gmail.com 2011-12-12T07:40:56+00:00 urn:sha1:3a7f8fb1d8c9b6a066b0452cea47c85547c97723 The error check (intr_status < 0) didn't work because intr_status is a u8. Change its type to signed int. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>