summaryrefslogtreecommitdiff
path: root/drivers/hid
AgeCommit message (Collapse)AuthorFilesLines
2022-11-16HID: hyperv: fix possible memory leak in mousevsc_probe()Yang Yingliang1-1/+1
[ Upstream commit b5bcb94b0954a026bbd671741fdb00e7141f9c91 ] If hid_add_device() returns error, it should call hid_destroy_device() to free hid_dev which is allocated in hid_allocate_device(). Fixes: 74c4fb058083 ("HID: hv_mouse: Properly add the hid device") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Reviewed-by: Wei Liu <wei.liu@kernel.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-11-16HID: wacom: Fix logic used for 3rd barrel switch emulationJason Gerecke1-5/+6
commit f77810f744139572a63e5a85ab6a8c10c2d44fb1 upstream. When support was added for devices using an explicit 3rd barrel switch, the logic used by devices emulating this feature was broken. The 'if' statement / block that was introduced only handles the case where the button is pressed (i.e. 'barrelswitch' and 'barrelswitch2' are both set) but not the case where it is released (i.e. one or both being cleared). This results in a BTN_STYLUS3 "down" event being sent when the button is pressed, but no "up" event ever being sent afterwards. This patch restores the previously-used logic for determining button states in the emulated case so that switches are reported correctly again. Link: https://github.com/linuxwacom/xf86-input-wacom/issues/292 Fixes: 6d09085b38e5 ("HID: wacom: Adding Support for new usages") CC: stable@vger.kernel.org #v5.19+ Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Tested-by: Joshua Dickens <joshua.dickens@wacom.com> Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-11-10HID: saitek: add madcatz variant of MMO7 mouse device IDSamuel Bailey3-0/+4
[ Upstream commit 79425b297f56bd481c6e97700a9a4e44c7bcfa35 ] The MadCatz variant of the MMO7 mouse has the ID 0738:1713 and the same quirks as the Saitek variant. Signed-off-by: Samuel Bailey <samuel.bailey1@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-29HID: magicmouse: Do not set BTN_MOUSE on double reportJosé Expósito1-1/+1
[ Upstream commit bb5f0c855dcfc893ae5ed90e4c646bde9e4498bf ] Under certain conditions the Magic Trackpad can group 2 reports in a single packet. The packet is split and the raw event function is invoked recursively for each part. However, after processing each part, the BTN_MOUSE status is updated, sending multiple click events. [1] Return after processing double reports to avoid this issue. Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/811 # [1] Fixes: a462230e16ac ("HID: magicmouse: enable Magic Trackpad support") Reported-by: Nulo <git@nulo.in> Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20221009182747.90730-1-jose.exposito89@gmail.com Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-26HID: playstation: add initial DualSense Edge controller supportRoderick Colenbrander2-1/+5
commit b8a968efab301743fd659b5649c5d7d3e30e63a6 upstream. Provide initial support for the DualSense Edge controller. The brings support up to the level of the original DualSense, but won't yet provide support for new features (e.g. reprogrammable buttons). Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com> CC: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20221010212313.78275-3-roderick.colenbrander@sony.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-26HID: playstation: stop DualSense output work on remove.Roderick Colenbrander1-5/+36
commit 182934a1e93b17f4edf71f4fcc8d19b19a6fe67a upstream. Ensure we don't schedule any new output work on removal and wait for any existing work to complete. If we don't do this e.g. rumble work can get queued during deletion and we trigger a kernel crash. Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com> CC: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20221010212313.78275-2-roderick.colenbrander@sony.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-21HID: nintendo: check analog user calibration for plausibilityJohnothan King1-25/+30
[ Upstream commit 50503e360eeb968a3d00234c9cc4057d774c3e9a ] Arne Wendt writes: Cheap clone controllers may (falsely) report as having a user calibration for the analog sticks in place, but return wrong/impossible values for the actual calibration data. In the present case at mine, the controller reports having a user calibration in place and successfully executes the read commands. The reported user calibration however is min = center = max = 0. This pull request addresses problems of this kind by checking the provided user calibration-data for plausibility (min < center < max) and falling back to the default values if implausible. I'll note that I was experiencing a crash because of this bug when using the GuliKit KingKong 2 controller. The crash manifests as a divide by zero error in the kernel logs: kernel: divide error: 0000 [#1] PREEMPT SMP NOPTI Link: https://github.com/nicman23/dkms-hid-nintendo/pull/25 Link: https://github.com/DanielOgorchock/linux/issues/36 Co-authored-by: Arne Wendt <arne.wendt@tuhh.de> Signed-off-by: Johnothan King <johnothanking@protonmail.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/gvpL2G6VwXGJPvxX5KRiu9pVjvTivgayug_jdKDY6zfuAaAqncP9BkKLosjwUXNlgVVTMfJSKfwPF1K79cKAkwGComyC21vCV3q9B3EXNkE=@protonmail.com Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-21HID: roccat: Fix use-after-free in roccat_read()Hyunwoo Kim1-0/+4
[ Upstream commit cacdb14b1c8d3804a3a7d31773bc7569837b71a4 ] roccat_report_event() is responsible for registering roccat-related reports in struct roccat_device. int roccat_report_event(int minor, u8 const *data) { struct roccat_device *device; struct roccat_reader *reader; struct roccat_report *report; uint8_t *new_value; device = devices[minor]; new_value = kmemdup(data, device->report_size, GFP_ATOMIC); if (!new_value) return -ENOMEM; report = &device->cbuf[device->cbuf_end]; /* passing NULL is safe */ kfree(report->value); ... The registered report is stored in the struct roccat_device member "struct roccat_report cbuf[ROCCAT_CBUF_SIZE];". If more reports are received than the "ROCCAT_CBUF_SIZE" value, kfree() the saved report from cbuf[0] and allocates a new reprot. Since there is no lock when this kfree() is performed, kfree() can be performed even while reading the saved report. static ssize_t roccat_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos) { struct roccat_reader *reader = file->private_data; struct roccat_device *device = reader->device; struct roccat_report *report; ssize_t retval = 0, len; DECLARE_WAITQUEUE(wait, current); mutex_lock(&device->cbuf_lock); ... report = &device->cbuf[reader->cbuf_start]; /* * If report is larger than requested amount of data, rest of report * is lost! */ len = device->report_size > count ? count : device->report_size; if (copy_to_user(buffer, report->value, len)) { retval = -EFAULT; goto exit_unlock; } ... The roccat_read() function receives the device->cbuf report and delivers it to the user through copy_to_user(). If the N+ROCCAT_CBUF_SIZE th report is received while copying of the Nth report->value is in progress, the pointer that copy_to_user() is working on is kfree()ed and UAF read may occur. (race condition) Since the device node of this driver does not set separate permissions, this is not a security vulnerability, but because it is used for requesting screen display of profile or dpi settings, a user using the roccat device can apply udev to this device node or There is a possibility to use it by giving. Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-21hid: topre: Add driver fixing report descriptorHarry Stern4-0/+59
[ Upstream commit a109d5c45b3d6728b9430716b915afbe16eef27c ] The Topre REALFORCE R2 firmware incorrectly reports that interface descriptor number 1, input report descriptor 2's events are array events rather than variable events. That particular report descriptor is used to report keypresses when there are more than 6 keys held at a time. This bug prevents events from this interface from being registered properly, so only 6 keypresses (from a different interface) can be registered at once, rather than full n-key rollover. This commit fixes the bug by setting the correct value in a report_fixup function. The original bug report can be found here: Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/804 Thanks to Benjamin Tissoires for diagnosing the issue with the report descriptor. Signed-off-by: Harry Stern <harry@harrystern.net> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20220911003614.297613-1-harry@harrystern.net Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-21HID: amd_sfh: Handle condition of "no sensors" for SFH1.1Basavaraj Natikar1-0/+2
[ Upstream commit 68266bdcceec10ea364e62c63732cd6fe5a256a8 ] Based on num_hid_devices, each sensor device registers to HID. If "no sensors" then amd_sfh work initialization and scheduling doesn’t make sense and return ENODEV to stop driver probe. Hence add a check for num_hid_devices to handle special case in the situation of "no sensors" for SFH1.1. Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality") Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-21HID: uclogic: Fix warning in uclogic_rdesc_template_applyJosé Expósito1-1/+1
[ Upstream commit 609174edeb758d1e2d713e7ab4e09ea8d45aa4f7 ] Building with Sparse enabled prints this warning: warning: incorrect type in assignment (different base types) expected signed int x got restricted __le32 [usertype] Cast the return value of cpu_to_le32() to fix the warning. Fixes: 08177f4 ("HID: uclogic: merge hid-huion driver in hid-uclogic") Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-21HID: uclogic: Add missing suffix for digitalizersJosé Expósito1-0/+1
[ Upstream commit 0977fda0587cbc5403651ba169e264aa01e8a026 ] The Pen (0x02) application usage was changed to Digitalizer (0x01) in commit f7d8e387d9ae ("HID: uclogic: Switch to Digitizer usage for styluses"). However, a suffix was not selected for the new usage. Handle the digitalizer application usage in uclogic_input_configured() and add the required suffix. Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Fixes: f7d8e387d9ae ("HID: uclogic: Switch to Digitizer usage for styluses") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-21HID: multitouch: Add memory barriersAndri Yngvason1-4/+4
commit be6e2b5734a425941fcdcdbd2a9337be498ce2cf upstream. This fixes broken atomic checks which cause a race between the release-timer and processing of hid input. I noticed that contacts were sometimes sticking, even with the "sticky fingers" quirk enabled. This fixes that problem. Cc: stable@vger.kernel.org Fixes: 9609827458c3 ("HID: multitouch: optimize the sticky fingers timer") Signed-off-by: Andri Yngvason <andri@yngvason.is> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20220907150159.2285460-1-andri@yngvason.is Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-31Merge tag 'for-linus-2022083101' of ↵Linus Torvalds13-34/+96
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - NULL pointer dereference fix for Steam driver (Lee Jones) - memory leak fix for hidraw (Karthik Alapati) - regression fix for functionality of some UCLogic tables (Benjamin Tissoires) - a few new device IDs and device-specific quirks * tag 'for-linus-2022083101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: nintendo: fix rumble worker null pointer deref HID: intel-ish-hid: ipc: Add Meteor Lake PCI device ID HID: input: fix uclogic tablets HID: Add Apple Touchbar on T2 Macs in hid_have_special_driver list HID: add Lenovo Yoga C630 battery quirk HID: AMD_SFH: Add a DMI quirk entry for Chromebooks HID: thrustmaster: Add sparco wheel and fix array length hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo HID: asus: ROG NKey: Ignore portion of 0x5a report HID: hidraw: fix memory leak in hidraw_release() HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
2022-08-25HID: nintendo: fix rumble worker null pointer derefDaniel J. Ogorchock1-2/+4
We can dereference a null pointer trying to queue work to a destroyed workqueue. If the device is disconnected, nintendo_hid_remove is called, in which the rumble_queue is destroyed. Avoid using that queue to defer rumble work once the controller state is set to JOYCON_CTLR_STATE_REMOVED. This eliminates the null pointer dereference. Signed-off-by: Daniel J. Ogorchock <djogorchock@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25HID: intel-ish-hid: ipc: Add Meteor Lake PCI device IDEven Xu2-0/+2
Add device ID of Meteor Lake P into ishtp support list. Signed-off-by: Even Xu <even.xu@intel.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25HID: input: fix uclogic tabletsBenjamin Tissoires1-1/+4
commit 87562fcd1342 ("HID: input: remove the need for HID_QUIRK_INVERT") made the assumption that it was the only one handling tablets and thus kept an internal state regarding the tool. Turns out that the uclogic driver has a timer to release the in range bit, effectively making hid-input ignoring all in range information after the very first one. Fix that by having a more rationale approach which consists in forwarding every event and let the input stack filter out the duplicates. Reported-by: Stefan Hansson <newbie13xd@gmail.com> Fixes: 87562fcd1342 ("HID: input: remove the need for HID_QUIRK_INVERT") Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25HID: Add Apple Touchbar on T2 Macs in hid_have_special_driver listAditya Garg2-0/+4
The touchbar on Apple T2 Macs has 2 modes, one that shows the function keys and other that shows the media controls. The user can use the fn key on his keyboard to switch between the 2 modes. On Linux, if people were using an external keyboard or mouse, the touchbar failed to change modes on pressing the fn key with the following in dmesg :- [ 10.661445] apple-ib-als 0003:05AC:8262.0001: : USB HID v1.01 Device [Apple Inc. Ambient Light Sensor] on usb-bce-vhci-3/input0 [ 11.830992] apple-ib-touchbar 0003:05AC:8302.0007: input: USB HID v1.01 Keyboard [Apple Inc. Touch Bar Display] on usb-bce-vhci-6/input0 [ 12.139407] apple-ib-touchbar 0003:05AC:8102.0008: : USB HID v1.01 Device [Apple Inc. Touch Bar Backlight] on usb-bce-vhci-7/input0 [ 12.211824] apple-ib-touchbar 0003:05AC:8102.0009: : USB HID v1.01 Device [Apple Inc. Touch Bar Backlight] on usb-bce-vhci-7/input1 [ 14.219759] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 2 (-110) [ 24.395670] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 2 (-110) [ 34.635791] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 2 (-110) [ 269.579233] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 1 (-110) Add the USB IDs of the touchbar found in T2 Macs to HID have special driver list to fix the issue. Signed-off-by: Aditya Garg <gargaditya08@live.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25HID: add Lenovo Yoga C630 battery quirkSteev Klimaszewski2-0/+3
Similar to the Surface Go devices, the Elantech touchscreen/digitizer in the Lenovo Yoga C630 mistakenly reports the battery of the stylus, and always reports an empty battery. Apply the HID_BATTERY_QUIRK_IGNORE quirk to ignore this battery and prevent the erroneous low battery warnings. Signed-off-by: Steev Klimaszewski <steev@kali.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25HID: AMD_SFH: Add a DMI quirk entry for ChromebooksAkihiko Odaki1-0/+18
Google Chromebooks use Chrome OS Embedded Controller Sensor Hub instead of Sensor Hub Fusion and leaves MP2 uninitialized, which disables all functionalities, even including the registers necessary for feature detections. The behavior was observed with Lenovo ThinkPad C13 Yoga. Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Suggested-by: Mario Limonciello <mario.limonciello@amd.com> Acked-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25HID: thrustmaster: Add sparco wheel and fix array lengthMichael Hübner1-1/+2
Add device id for the Sparco R383 Mod wheel. Fix wheel info array length to match actual wheel count present in the array. Signed-off-by: Michael Hübner <michaelh.95@t-online.de> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered messageEven Xu1-29/+39
There is a timing issue captured during ishtp client sending stress tests. It was observed during stress tests that ISH firmware is getting out of ordered messages. This is a rare scenario as the current set of ISH client drivers don't send much data to firmware. But this may not be the case going forward. When message size is bigger than IPC MTU, ishtp splits the message into fragments and uses serialized async method to send message fragments. The call stack: ishtp_cl_send_msg_ipc->ipc_tx_callback(first fregment)-> ishtp_send_msg(with callback)->write_ipc_to_queue-> write_ipc_from_queue->callback->ipc_tx_callback(next fregment)...... When an ipc write complete interrupt is received, driver also calls write_ipc_from_queue->ipc_tx_callback in ISR to start sending of next fragment. Through ipc_tx_callback uses spin_lock to protect message splitting, as the serialized sending method will call back to ipc_tx_callback again, so it doesn't put sending under spin_lock, it causes driver cannot guarantee all fragments be sent in order. Considering this scenario: ipc_tx_callback just finished a fragment splitting, and not call ishtp_send_msg yet, there is a write complete interrupt happens, then ISR->write_ipc_from_queue ->ipc_tx_callback->ishtp_send_msg->write_ipc_to_queue...... Because ISR has higher exec priority than normal thread, this causes the new fragment be sent out before previous fragment. This disordered message causes invalid message to firmware. The solution is, to send fragments synchronously: Use ishtp_write_message writing fragments into tx queue directly one by one, instead of ishtp_send_msg only writing one fragment with completion callback. As no completion callback be used, so change ipc_tx_callback to ipc_tx_send. Signed-off-by: Even Xu <even.xu@intel.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typoJason Wang1-1/+1
The double `like' is duplicated in the comment, remove one. Signed-off-by: Jason Wang <wangborong@cdjrlc.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25HID: asus: ROG NKey: Ignore portion of 0x5a reportJosh Kilmer1-0/+7
On an Asus G513QY, of the 5 bytes in a 0x5a report, only the first byte is a meaningful keycode. The other bytes are zeroed out or hold garbage from the last packet sent to the keyboard. This patch fixes up the report descriptor for this event so that the general hid code will only process 1 byte for keycodes, avoiding spurious key events and unmapped Asus vendor usagepage code warnings. Signed-off-by: Josh Kilmer <srjek2@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25HID: hidraw: fix memory leak in hidraw_release()Karthik Alapati1-0/+2
Free the buffered reports before deleting the list entry. BUG: memory leak unreferenced object 0xffff88810e72f180 (size 32): comm "softirq", pid 0, jiffies 4294945143 (age 16.080s) hex dump (first 32 bytes): 64 f3 c6 6a d1 88 07 04 00 00 00 00 00 00 00 00 d..j............ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff814ac6c3>] kmemdup+0x23/0x50 mm/util.c:128 [<ffffffff8357c1d2>] kmemdup include/linux/fortify-string.h:440 [inline] [<ffffffff8357c1d2>] hidraw_report_event+0xa2/0x150 drivers/hid/hidraw.c:521 [<ffffffff8356ddad>] hid_report_raw_event+0x27d/0x740 drivers/hid/hid-core.c:1992 [<ffffffff8356e41e>] hid_input_report+0x1ae/0x270 drivers/hid/hid-core.c:2065 [<ffffffff835f0d3f>] hid_irq_in+0x1ff/0x250 drivers/hid/usbhid/hid-core.c:284 [<ffffffff82d3c7f9>] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1670 [<ffffffff82d3cc26>] usb_hcd_giveback_urb+0x1b6/0x1d0 drivers/usb/core/hcd.c:1747 [<ffffffff82ef1e14>] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988 [<ffffffff812f50a8>] call_timer_fn+0x38/0x200 kernel/time/timer.c:1474 [<ffffffff812f5586>] expire_timers kernel/time/timer.c:1519 [inline] [<ffffffff812f5586>] __run_timers.part.0+0x316/0x430 kernel/time/timer.c:1790 [<ffffffff812f56e4>] __run_timers kernel/time/timer.c:1768 [inline] [<ffffffff812f56e4>] run_timer_softirq+0x44/0x90 kernel/time/timer.c:1803 [<ffffffff848000e6>] __do_softirq+0xe6/0x2ea kernel/softirq.c:571 [<ffffffff81246db0>] invoke_softirq kernel/softirq.c:445 [inline] [<ffffffff81246db0>] __irq_exit_rcu kernel/softirq.c:650 [inline] [<ffffffff81246db0>] irq_exit_rcu+0xc0/0x110 kernel/softirq.c:662 [<ffffffff84574f02>] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1106 [<ffffffff84600c8b>] asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649 [<ffffffff8458a070>] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] [<ffffffff8458a070>] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] [<ffffffff8458a070>] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline] [<ffffffff8458a070>] acpi_idle_do_entry+0xc0/0xd0 drivers/acpi/processor_idle.c:554 Link: https://syzkaller.appspot.com/bug?id=19a04b43c75ed1092021010419b5e560a8172c4f Reported-by: syzbot+f59100a0428e6ded9443@syzkaller.appspotmail.com Signed-off-by: Karthik Alapati <mail@karthek.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_reportLee Jones1-0/+10
It is possible for a malicious device to forgo submitting a Feature Report. The HID Steam driver presently makes no prevision for this and de-references the 'struct hid_report' pointer obtained from the HID devices without first checking its validity. Let's change that. Cc: Jiri Kosina <jikos@kernel.org> Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> Cc: linux-input@vger.kernel.org Fixes: c164d6abf3841 ("HID: add driver for Valve Steam Controller") Signed-off-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-05Merge tag 'platform-drivers-x86-v6.0-1' of ↵Linus Torvalds1-1/+37
git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Hans de Goede: - Microsoft Surface: - SSAM hot unplug support - Surface Pro 8 keyboard cover support - Tablet mode switch support for Surface Pro 8 and Surface Laptop Studio - thinkpad_acpi: - AMD Automatice Mode Transitions (AMT) support - Mellanox: - Vulcan chassis COMe NVSwitch management support - XH3000 support - New generic/shared Intel P2SB (Primary to Sideband) support - Lots of small cleanups - Various small bugfixes - Various new hardware ids / quirks additions * tag 'platform-drivers-x86-v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (105 commits) platform/x86/intel/vsec: Fix wrong type for local status variables platform/x86: p2sb: Move out of X86_PLATFORM_DEVICES dependency platform/x86: pmc_atom: Fix comment typo platform/surface: gpe: Add support for 13" Intel version of Surface Laptop 4 platform/olpc: Fix uninitialized data in debugfs write platform/mellanox: mlxreg-lc: Fix error flow and extend verbosity platform/x86: pmc_atom: Match all Lex BayTrail boards with critclk_systems DMI table platform/x86: sony-laptop: Remove useless comparisons in sony_pic_read_possible_resource() tools/power/x86/intel-speed-select: Remove unneeded semicolon tools/power/x86/intel-speed-select: Fix off by one check platform/surface: tabletsw: Fix __le32 integer access Documentation/ABI: Add new attributes for mlxreg-io sysfs interfaces Documentation/ABI: mlxreg-io: Fix contact info platform/mellanox: mlxreg-io: Add locking for io operations platform/x86: mlx-platform: Add COME board revision register platform/x86: mlx-platform: Add support for new system XH3000 platform/x86: mlx-platform: Introduce support for COMe NVSwitch management module for Vulcan chassis platform/x86: mlx-platform: Add support for systems equipped with two ASICs platform/x86: mlx-platform: Add cosmetic changes for alignment platform/x86: mlx-platform: Make activation of some drivers conditional ...
2022-08-05Merge tag 'for-linus-2022080201' of ↵Linus Torvalds41-208/+2001
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - support for AMD SOCs using SFH1.1 memory access (Basavaraj Natikar) - XP-PEN Deco L support (José Expósito) - support for Elan eKTH6915 touchscreens (Douglas Anderson) - other small assorted fixes and device ID additions * tag 'for-linus-2022080201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (39 commits) HID: amd_sfh: Handle condition of "no sensors" HID: amd_sfh: Fix implicit declaration error on i386 HID: apple: Add "GANSS" to the non-Apple list HID: alps: Declare U1_UNICORN_LEGACY support HID: wacom: Force pen out of prox if no events have been received in a while HID: nintendo: Add missing array termination HID: lg-g15: Fix comment typo HID: amd_sfh: Implement SFH1.1 functionality HID: amd_sfh: Move interrupt handling to common interface HID: amd_sfh: Move amd_sfh_work to common interface HID: amd_sfh: Move global functions to static HID: amd_sfh: Add remove operation in amd_mp2_ops HID: amd_sfh: Add PM operations in amd_mp2_ops HID: amd_sfh: Add descriptor operations in amd_mp2_ops HID: amd_sfh: Move request_list variable to client data HID: amd_sfh: Move request_list struct to header file HID: amd_sfh: Move common macros and structures HID: amd_sfh: Add NULL check for hid device HID: core: remove unneeded assignment in hid_process_report() ID: intel-ish-hid: hid-client: drop unexpected word "the" in the comments ...
2022-08-02Merge branch 'for-5.20/uclogic' into for-linusJiri Kosina9-14/+581
- XP-PEN Deco L support (José Expósito)
2022-08-02Merge branch 'for-5.20/nintendo' into for-linusJiri Kosina1-0/+2
2022-08-02Merge branch 'for-5.20/elan' into for-linusJiri Kosina3-0/+146
- support for Elan eKTH6915 touchscreens (Douglas Anderson)
2022-08-02Merge branch 'for-5.20/core' into for-linusJiri Kosina1-1/+1
2022-08-02Merge branch 'for-5.20/apple' into for-linusJiri Kosina1-5/+30
2022-08-02Merge branch 'for-5.20/amd-sfh' into for-linusJiri Kosina14-143/+1103
- support for AMD SOCs using SFH1.1 memory access (Basavaraj Natikar)
2022-07-23HID: amd_sfh: Handle condition of "no sensors"Basavaraj Natikar1-0/+2
Add a check for num_hid_devices to handle special case the situation of "no sensors". Fixes: 4b2c53d93a4b ("SFH:Transport Driver to add support of AMD Sensor Fusion Hub (SFH)") Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-23HID: amd_sfh: Fix implicit declaration error on i386Basavaraj Natikar1-0/+2
Add depended header file to fix error on i386 due to implicit declaration of function ‘writeq’. Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality") Reported-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-22HID: apple: Add "GANSS" to the non-Apple listHilton Chain1-1/+2
While using the name "SONiX USB DEVICE" for wired mode, my GANSS keyboard uses "GANSS" for bluetooth mode as well, so adding this to the list. Signed-off-by: Hilton Chain <hako@ultrarare.space> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-22HID: alps: Declare U1_UNICORN_LEGACY supportArtem Borisov1-0/+2
U1_UNICORN_LEGACY id was added to the driver, but was not declared in the device id table, making it impossible to use. Fixes: 640e403 ("HID: alps: Add AUI1657 device ID") Signed-off-by: Artem Borisov <dedsa2002@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-21HID: wacom: Force pen out of prox if no events have been received in a whileJason Gerecke3-0/+44
Prox-out events may not be reliably sent by some AES firmware. This can cause problems for users, particularly due to arbitration logic disabling touch input while the pen is in prox. This commit adds a timer which is reset every time a new prox event is received. When the timer expires we check to see if the pen is still in prox and force it out if necessary. This is patterend off of the same solution used by 'hid-letsketch' driver which has a similar problem. Link: https://github.com/linuxwacom/input-wacom/issues/310 Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-21HID: nintendo: Add missing array terminationGuenter Roeck1-0/+1
joycon_dpad_inputs_jc[] is unterminated. This may result in odd warnings such as input: input_set_capability: invalid code 3077588140 for type 1 or in kernel crashes in nintendo_hid_probe(). Terminate the array to fix the problem. Fixes: 2af16c1f846bd ("HID: nintendo: add nintendo switch controller driver") Cc: Daniel J. Ogorchock <djogorchock@gmail.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-21HID: lg-g15: Fix comment typoJason Wang1-1/+1
The double `with' is duplicated in line 769, remove one. Signed-off-by: Jason Wang <wangborong@cdjrlc.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-21HID: amd_sfh: Implement SFH1.1 functionalityBasavaraj Natikar8-0/+895
Newer AMD SOCs use SFH1.1 memory access with new PCI-id. Hence add new sfh1_1 sub directory to implement SFH1.1 functionality by defining new PCI id, interface functions, descriptor functions and handlers which invokes sfh1.1. Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-21HID: amd_sfh: Move interrupt handling to common interfaceBasavaraj Natikar3-8/+10
Interrupt handling can be used in multiple files to support all AMD SOCs. Hence move interrupt handling to common interface. Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-21HID: amd_sfh: Move amd_sfh_work to common interfaceBasavaraj Natikar2-2/+4
amd_sfh_work can be used in multiple files to support all AMD SOCs. Hence move amd_sfh_work to common interface. Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-21HID: amd_sfh: Move global functions to staticBasavaraj Natikar3-12/+5
Move global functions declared from header files and make them as static functions wherever applicable. Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-21HID: amd_sfh: Add remove operation in amd_mp2_opsBasavaraj Natikar2-1/+4
Add remove operation as part of amd_mp2_ops structure to support all AMD SOCs and use wherever applicable. Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-21HID: amd_sfh: Add PM operations in amd_mp2_opsBasavaraj Natikar3-39/+58
Add PM operations as part of amd_mp2_ops structure to support all AMD SOCs and use wherever applicable. Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-21HID: amd_sfh: Add descriptor operations in amd_mp2_opsBasavaraj Natikar7-25/+42
Add dynamic descriptor operations as part of amd_mp2_ops structure to support all AMD SOCs and use wherever applicable. Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-21HID: amd_sfh: Move request_list variable to client dataBasavaraj Natikar2-5/+8
request_list variable can be used in multiple files to support all AMD SOCs. Hence move request_list variable to client data. Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-07-21HID: amd_sfh: Move request_list struct to header fileBasavaraj Natikar2-10/+9
request_list structure can be used in multiple files to support all AMD SOCs. Hence move request_list structure to header file. Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>