kernel/linux.git/drivers/input/tablet, branch v4.19.112

Input: pegasus_notetaker - fix endpoint sanity check

2020-01-29T15:43:20+00:00

commit bcfcb7f9b480dd0be8f0df2df17340ca92a03b98 upstream. The driver was checking the number of endpoints of the first alternate setting instead of the current one, something which could be used by a malicious device (or USB descriptor fuzzer) to trigger a NULL-pointer dereference. Fixes: 1afca2b66aac ("Input: add Pegasus Notetaker tablet driver") Signed-off-by: Johan Hovold Acked-by: Martin Kepplinger Acked-by: Vladis Dronov Link: https://lore.kernel.org/r/20191210113737.4016-2-johan@kernel.org Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

Input: aiptek - fix endpoint sanity check

2020-01-29T15:43:20+00:00

commit 3111491fca4f01764e0c158c5e0f7ced808eef51 upstream. The driver was checking the number of endpoints of the first alternate setting instead of the current one, something which could lead to the driver binding to an invalid interface. This in turn could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: 8e20cf2bce12 ("Input: aiptek - fix crash on detecting device without endpoints") Signed-off-by: Johan Hovold Acked-by: Vladis Dronov Link: https://lore.kernel.org/r/20191210113737.4016-3-johan@kernel.org Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

Input: gtco - fix endpoint sanity check

2020-01-29T15:43:20+00:00

commit a8eeb74df5a6bdb214b2b581b14782c5f5a0cf83 upstream. The driver was checking the number of endpoints of the first alternate setting instead of the current one, something which could lead to the driver binding to an invalid interface. This in turn could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: 162f98dea487 ("Input: gtco - fix crash on detecting device without endpoints") Signed-off-by: Johan Hovold Acked-by: Vladis Dronov Link: https://lore.kernel.org/r/20191210113737.4016-5-johan@kernel.org Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

Input: kbtab - sanity check for endpoint type

2019-08-25T08:47:49+00:00

commit c88090dfc84254fa149174eb3e6a8458de1912c4 upstream. The driver should check whether the endpoint it uses has the correct type. Reported-by: syzbot+c7df50363aaff50aa363@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

Input: gtco - bounds check collection indent level

2019-07-26T07:14:21+00:00

commit 2a017fd82c5402b3c8df5e3d6e5165d9e6147dc1 upstream. The GTCO tablet input driver configures itself from an HID report sent via USB during the initial enumeration process. Some debugging messages are generated during the parsing. A debugging message indentation counter is not bounds checked, leading to the ability for a specially crafted HID report to cause '-' and null bytes be written past the end of the indentation array. As long as the kernel has CONFIG_DYNAMIC_DEBUG enabled, this code will not be optimized out. This was discovered during code review after a previous syzkaller bug was found in this driver. Signed-off-by: Grant Hernandez Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

Input: wacom_serial4 - add support for Wacom ArtPad II tablet

2019-03-13T21:02:38+00:00

commit 44fc95e218a09d7966a9d448941fdb003f6bb69f upstream. Tablet initially begins communicating at 9600 baud, so this command should be used to connect to the device: $ inputattach --daemon --baud 9600 --wacom_iv /dev/ttyS0 https://github.com/linuxwacom/xf86-input-wacom/issues/40 Signed-off-by: Jason Gerecke Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

Input: aiptek - replace GFP_ATOMIC with GFP_KERNEL in aiptek_probe()

2018-07-27T18:59:10+00:00

aiptek_probe() is never called in atomic context. It calls usb_alloc_coherent() with GFP_ATOMIC, which is not necessary. GFP_ATOMIC can be replaced with GFP_KERNEL. This is found by a static analysis tool named DCNS written by myself. Signed-off-by: Jia-Ju Bai Signed-off-by: Dmitry Torokhov

Input: pegasus_notetaker - do not rely on input_dev->users

2018-03-17T18:05:18+00:00

If the device is unused and suspended, a call to open will cause the device to autoresume through the call to usb_autopm_get_interface(). input_dev->users is already incremented by the input subsystem, therefore this expression will always be evaluated to true: if (pegasus->dev->users && usb_submit_urb(pegasus->irq, GFP_NOIO) < 0) retval = -EIO; The same URB will then be fail when resubmitted in pegasus_open(). Introduce pegasus->is_open to keep track of the state instead. Signed-off-by: Marcus Folkesson Signed-off-by: Dmitry Torokhov

Input: pagasus_notetaker - fix deadlock in autosuspend

2018-03-17T18:05:18+00:00

usb_autopm_get_interface() that is called in pegasus_open() does an autoresume if the device is suspended. input_dev->mutex used in pegasus_resume() is in this case already taken by the input subsystem and will cause a deadlock. Signed-off-by: Marcus Folkesson Signed-off-by: Dmitry Torokhov

Input: inline macros for MODULE_LICENSE, etc

2018-01-17T17:52:22+00:00

Inline macro for MODULE_LICENSE to make the license information easy to find, eg with grep. Inline the other module-related macros at the same time. A simplified version of the semantic patch for the MODULE_LICENSE case is as follows: (http://coccinelle.lip6.fr/) // @s@ identifier i; expression e; @@ @@ declarer name MODULE_LICENSE; identifier s.i; expression s.e; @@ MODULE_LICENSE( - i + e ); // Signed-off-by: Julia Lawall [dtor: added a couple of drivers missed by the script, removed a few unused DRIVER_VERSION macros] Signed-off-by: Dmitry Torokhov