kernel/linux.git/drivers/input/rmi4, branch v6.6.132

Input: synaptics-rmi - fix crash with unsupported versions of F34

2025-06-19T13:28:36+00:00

[ Upstream commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 ] Sysfs interface for updating firmware for RMI devices is available even when F34 probe fails. The code checks for presence of F34 "container" pointer and then tries to use the function data attached to the sub-device. F34 assigns the function data early, before it knows if probe will succeed, leaving behind a stale pointer. Fix this by expanding checks to not only test for presence of F34 "container" but also check if there is driver data assigned to the sub-device, and call dev_set_drvdata() only after we are certain that probe is successful. This is not a complete fix, since F34 will be freed during firmware update, so there is still a race when fetching and accessing this pointer. This race will be addressed in follow-up changes. Reported-by: Hanno Böck Fixes: 29fd0ec2bdbe ("Input: synaptics-rmi4 - add support for F34 device reflash") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/aBlAl6sGulam-Qcx@google.com Signed-off-by: Dmitry Torokhov Signed-off-by: Sasha Levin

Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal

2024-10-17T13:24:15+00:00

commit fbf8d71742557abaf558d8efb96742d442720cc2 upstream. Calling irq_domain_remove() will lead to freeing the IRQ domain prematurely. The domain is still referenced and will be attempted to get used via rmi_free_function_list() -> rmi_unregister_function() -> irq_dispose_mapping() -> irq_get_irq_data()'s ->domain pointer. With PaX's MEMORY_SANITIZE this will lead to an access fault when attempting to dereference embedded pointers, as in Torsten's report that was faulting on the 'domain->ops->unmap' test. Fix this by releasing the IRQ domain only after all related IRQs have been deactivated. Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain") Reported-by: Torsten Hilbrich Signed-off-by: Mathias Krause Link: https://lore.kernel.org/r/20240222142654.856566-1-minipli@grsecurity.net Signed-off-by: Dmitry Torokhov Signed-off-by: Tzung-Bi Shih Signed-off-by: Sasha Levin

Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails

2024-04-13T11:07:33+00:00

[ Upstream commit bc4996184d56cfaf56d3811ac2680c8a0e2af56e ] While input core can work with input->phys set to NULL userspace might depend on it, so better fail probing if allocation fails. The system must be in a pretty bad shape for it to happen anyway. Signed-off-by: Kunwu Chan Link: https://lore.kernel.org/r/20240117073124.143636-1-chentao@kylinos.cn Signed-off-by: Dmitry Torokhov Signed-off-by: Sasha Levin

Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()

2023-11-20T10:59:34+00:00

[ Upstream commit eb988e46da2e4eae89f5337e047ce372fe33d5b1 ] The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is a use after free. Move the put_device() to the end to fix this. Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/706efd36-7561-42f3-adfa-dd1d0bd4f5a1@moroto.mountain Signed-off-by: Dmitry Torokhov Signed-off-by: Sasha Levin

Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport

2023-10-14T00:59:19+00:00

Touch controllers need some time after receiving reset command for the firmware to finish re-initializing and be ready to respond to commands from the host. The driver already had handling for the post-reset delay for I2C and SPI transports, this change adds the handling to SMBus-connected devices. SMBus devices are peculiar because they implement legacy PS/2 compatibility mode, so reset is actually issued by psmouse driver on the associated serio port, after which the control is passed to the RMI4 driver with SMBus companion device. Note that originally the delay was added to psmouse driver in 92e24e0e57f7 ("Input: psmouse - add delay when deactivating for SMBus mode"), but that resulted in an unwanted delay in "fast" reconnect handler for the serio port, so it was decided to revert the patch and have the delay being handled in the RMI4 driver, similar to the other transports. Tested-by: Jeffery Miller Link: https://lore.kernel.org/r/ZR1yUFJ8a9Zt606N@penguin Signed-off-by: Dmitry Torokhov

Input: Switch i2c drivers back to use .probe()

2023-05-17T16:59:11+00:00

After commit b8a1a4cd5a98 ("i2c: Provide a temporary .probe_new() call-back type"), all drivers being converted to .probe_new() and then 03c835f498b5 ("i2c: Switch .probe() to not take an id parameter") convert back to (the new) .probe() to be able to eventually drop .probe_new() from struct i2c_driver. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230517164645.162294-1-u.kleine-koenig@pengutronix.de Signed-off-by: Dmitry Torokhov

Input: synaptics-rmi4 - fix function name in kerneldoc

2023-04-14T06:25:35+00:00

No functional modification involved. drivers/input/rmi4/rmi_bus.c:300: warning: expecting prototype for rmi_register_function_handler(). Prototype was for __rmi_register_function_handler() instead. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Link: https://lore.kernel.org/r/20230209040710.111456-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Dmitry Torokhov

Input: synaptics-rmi4 - fix SPI device ID

2023-02-04T00:53:40+00:00

Currently, the ID being set to "rmi4_spi" causes this warning: "SPI driver rmi4_spi has no spi_device_id for syna,rmi4-spi" Change the ID to rmi4-spi to stop this warning. Signed-off-by: Rayyan Ansari Link: https://lore.kernel.org/r/20221219133717.1638496-1-rayyan@ansari.sh Signed-off-by: Dmitry Torokhov

Input: rmi4 - switch to SYSTEM_SLEEP/RUNTIME_PM_OPS() and pm_ptr()

2023-01-27T22:49:52+00:00

SET_SYSTEM_SLEEP_PM_OPS() and SET_RUNTIME_PM_OPS() are deprecated as they requires explicit protection against unused function warnings. The new combination of pm_ptr() and SYSTEM_SLEEP_PM_OPS() / RUNTIME_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the #ifdef guards. Whilst all 3 sets of callbacks are similar, there are small differences that make it challenging to use a single pm_dev_ops structure - hence leave the duplication as it stands. Signed-off-by: Jonathan Cameron Cc: Matthias Schiffer Cc: Lyude Paul Cc: Andrew Duggan Link: https://lore.kernel.org/r/20230114171620.42891-6-jic23@kernel.org Signed-off-by: Dmitry Torokhov

Input: rmi_smbus - Convert to i2c's .probe_new()

2022-12-02T22:53:43+00:00

The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20221118224540.619276-225-uwe@kleine-koenig.org Signed-off-by: Dmitry Torokhov