Pull HID fixes from Jiri Kosina:
- fixes for potential memory corruption problems in magicmouse and
picolcd drivers (the HW would have to be manufactured to be
deliberately evil to trigger those) which were found by Steven
Vittitoe
- fix for false error message appearing in dmesg from logitech-dj
driver, from Benjamin Tissoires
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: picolcd: sanity check report size in raw_event() callback
HID: magicmouse: sanity check report size in raw_event() callback
HID: logitech-dj: prevent false errors to be shown
The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that raw_data
that we hold in picolcd_pending structure are always kept within proper
bounds.
Cc: stable@vger.kernel.org
Reported-by: Steven Vittitoe <scvitti@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that
magicmouse_emit_touch() gets only valid values of raw_id.
Cc: stable@vger.kernel.org
Reported-by: Steven Vittitoe <scvitti@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Commit "HID: logitech: perform bounds checking on device_id early
enough" unfortunately leaks some errors to dmesg which are not real
ones:
- if the report is not a DJ one, then there is not point in checking
the device_id
- the receiver (index 0) can also receive some notifications which
can be safely ignored given the current implementation
Move out the test regarding the report_id and also discards
printing errors when the receiver got notified.
Fixes: ad3e14d7c5
Cc: stable@vger.kernel.org
Reported-and-tested-by: Markus Trippelsdorf <markus@trippelsdorf.de>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Pull HID fixes from Jiri Kosina:
- fixes for a couple potential memory corruption problems (the HW would
have to be manufactured to be deliberately evil to trigger those)
found by Ben Hawkes
- fix for potential infinite loop when using sysfs interface of
logitech driver, from Simon Wood
- a couple more simple driver fixes
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: fix a couple of off-by-ones
HID: logitech: perform bounds checking on device_id early enough
HID: logitech: fix bounds checking on LED report size
HID: logitech: Prevent possibility of infinite loop when using /sys interface
HID: rmi: print an error if F11 is not found instead of stopping the device
HID: hid-sensor-hub: use devm_ functions consistently
HID: huion: Use allocated buffer for DMA
HID: huion: Fail on parameter retrieval errors
There are a few very theoretical off-by-one bugs in report descriptor size
checking when performing a pre-parsing fixup. Fix those.
Cc: stable@vger.kernel.org
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
device_index is a char type and the size of paired_dj_deivces is 7
elements, therefore proper bounds checking has to be applied to
device_index before it is used.
We are currently performing the bounds checking in
logi_dj_recv_add_djhid_device(), which is too late, as malicious device
could send REPORT_TYPE_NOTIF_DEVICE_UNPAIRED early enough and trigger the
problem in one of the report forwarding functions called from
logi_dj_raw_event().
Fix this by performing the check at the earliest possible ocasion in
logi_dj_raw_event().
Cc: stable@vger.kernel.org
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The check on report size for REPORT_TYPE_LEDS in logi_dj_ll_raw_request()
is wrong; the current check doesn't make any sense -- the report allocated
by HID core in hid_hw_raw_request() can be much larger than
DJREPORT_SHORT_LENGTH, and currently logi_dj_ll_raw_request() doesn't
handle this properly at all.
Fix the check by actually trimming down the report size properly if it is
too large.
Cc: stable@vger.kernel.org
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Pull input layer fixes from Dmitry Torokhov:
"Second round of updates for the input subsystem. Mostly small fixups
to the code merged in the first round (atmel_mxt_ts, wacom) but also a
smallish patch to xbox driver to support Xbox One controllers and a
patch to better handle Synaptics profile sensors found in Cr-48
Chromebooks that should not affect any other devices"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: edt-ft5x06 - remove superfluous assignment
Input: xpad - add support for Xbox One controllers
Input: atmel_mxt_ts - fix a few issues reported by Coverity
Input: atmel_mxt_ts - split config update a bit
Input: atmel_mxt_ts - simplify mxt_initialize a bit
Input: joystick - use get_cycles on ARMv8
Input: wacom - fix compiler warning if !CONFIG_PM
Input: cap1106 - allow changing key mapping from userspace
Input: synaptics - use firmware data for Cr-48
Input: synaptics - properly initialize slots for semi-MT
Input: MT - make slot cleanup callable outside mt_sync_frame()
Input: atmel_mxt_ts - mXT224 DMA quirk was fixed in firmware v2.0.AA
If the device data is not accessible for some reason, returning 0 will cause the call to be
continuously called again as none of the string has been 'consumed'.
Signed-off-by: Simon Wood <simon@mungewell.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Currently rmi_probe will return -EIO if the device doesn't report that it has F11.
This would indicate that something happened and the device is in the bootloader.
We can recover the device using a userspace firmware update tool, but it needs
access to the device through the hidraw device file. If the probe returns -EIO
the hidraw device won't be created. So instead of failing the probe, just print
an error message, but leave the device accessible from userspace.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
If CONFIG_PM is not set:
drivers/hid/wacom_sys.c:1436: warning: ‘wacom_reset_resume’ defined but
not used
Protect the unused functions by #ifdef CONFIG_PM to fix this.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Use devm_kzalloc for all calls to kzalloc and not just the first. Use
devm functions for other allocations as well. The calls to free the
allocated memory in the probe and remove functions are done away with
and a label is removed in the probe function.
The semantic match that finds the inconsistency is as follows:
// <smpl>
@@
@@
*devm_kzalloc(...)
...
*kzalloc(...)
// </smpl>
Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Reviewed-by: Srinivas Pandruvada <srinivas.pandruvada@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Allocate a buffer with kmalloc for receiving the parameters string
descriptor with usb_control_msg, instead of using a buffer on the stack,
as the latter is unsafe. Use an enum for indices into the buffer to
ensure the buffer size if sufficient.
This fixes the static checker error "doing dma on the stack (buf)".
Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Fail Huion tablet interface enabling and probing, if parameter retrieval
fails. Move the main code path out of the else block accordingly.
This should prevent devices appearing in a half-working state due to
original report descriptor being used, simplifying diagnostics. This
also makes it easier to add cleanup in later commits, as error handling
is simplified.
Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Pull input updates from Dmitry Torokhov:
- big update to Wacom driver by Benjamin Tissoires, converting it to
HID infrastructure and unifying USB and Bluetooth models
- large update to ALPS driver by Hans de Goede, which adds support for
newer touchpad models as well as cleans up and restructures the code
- more changes to Atmel MXT driver, including device tree support
- new driver for iPaq x3xxx touchscreen
- driver for serial Wacom tablets
- driver for Microchip's CAP1106
- assorted cleanups and improvements to existing drover and input core
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (93 commits)
Input: wacom - update the ABI doc according to latest changes
Input: wacom - only register once the MODULE_* macros
Input: HID - remove hid-wacom Bluetooth driver
Input: wacom - add copyright note and bump version to 2.0
Input: wacom - remove passing id for wacom_set_report
Input: wacom - check for bluetooth protocol while setting OLEDs
Input: wacom - handle Intuos 4 BT in wacom.ko
Input: wacom - handle Graphire BT tablets in wacom.ko
Input: wacom - prepare the driver to include BT devices
Input: hyperv-keyboard - register as a wakeup source
Input: imx_keypad - remove ifdef round PM methods
Input: jornada720_ts - get rid of space indentation and use tab
Input: jornada720_ts - switch to using managed resources
Input: alps - Rushmore and v7 resolution support
Input: mcs5000_ts - remove ifdef around power management methods
Input: mcs5000_ts - protect PM functions with CONFIG_PM_SLEEP
Input: ads7846 - release resources on failure for clean exit
Input: wacom - add support for 0x12C ISDv4 sensor
Input: atmel_mxt_ts - use deep sleep mode when stopped
ARM: dts: am437x-gp-evm: Update binding for touchscreen size
...
Pull HID updates from Jiri Kosina:
"Some highlights:
- hid-sony improvements of Sixaxis device support by Antonio Ospite
- hid-hyperv driven devices can now be used as wakeup source, by
Dexuan Cui
- hid-lenovo driver is now more generic and supports more devices, by
Jamie Lentin
- hid-huion now supports wider range of tablets, by Nikolai
Kondrashov
- other various unsorted fixes and device ID additions"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (30 commits)
HID: hyperv: register as a wakeup source
HID: sony: Default initialize all elements of the LED max_brightness array to 1
HID: huion: Fix sparse warnings
HID: usbhid: Use flag HID_DISCONNECTED when a usb device is removed
HID: ignore jabra gn9350e
HID: cp2112: add I2C mode
HID: use multi input quirk for 22b9:2968
HID: rmi: only bind the hid-rmi driver to the mouse interface of composite USB devices
HID: rmi: check that report ids exist in the report_id_hash before accessing their size
HID: lenovo: Add support for Compact (BT|USB) keyboard
HID: lenovo: Don't call function in condition, show error codes
HID: lenovo: Prepare support for adding other devices
HID: lenovo: Rename hid-lenovo-tpkbd to hid-lenovo
HID: huion: Handle tablets with UC-Logic vendor ID
HID: huion: Switch to generating report descriptor
HID: huion: Don't ignore other interfaces
HID: huion: Use "tablet" instead of specific model
HID: add quirk for 0x04d9:0xa096 device
HID: i2c-hid: call the hid driver's suspend and resume callbacks
HID: rmi: change logging level of log messages related to unexpected reports
...
Putting the various MODULE_* makes them appear several times in modinfo
because wacom.h is used both in wacom_sys.c and wacom_wac.h.
Having the macros near the module declaration makes them appear only once.
Add also MODULE_VERSION(DRIVER_VERSION) to export the current version
number.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Bluetooth Wacom tablets are now handled by the regular wacom.ko driver.
Remove the now useless hid-wacom driver.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: Ping Cheng <pingc@wacom.com>
Tested-by: Przemo Firszt <przemo@firszt.eu>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Every call of wacom_set_report was passing "id" as a separate parameter
and buffer also passed the same information. We can use first u8 of the
buffer instead of "id"
Signed-off-by: Przemo Firszt <przemo@firszt.eu>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: Ping Cheng <pingc@wacom.com>
Tested-by: Przemo Firszt <przemo@firszt.eu>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Bluetooth Intuos 4 use 1-bit definition while the USB ones use a 4-bits
definition. This changes the size of the raw image we receive, and thus
the kernel will only accept 1-bit images for Bluetooth and 4-bits for
USB.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Przemo Firszt <przemo@firszt.eu>
Reviewed-by: Ping Cheng <pingc@wacom.com>
Tested-by: Przemo Firszt <przemo@firszt.eu>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
A good point of this change is that now, the Intuos4 bluetooth can handle
the different tools (artpen, airbrush, mice), and we get a common interface
between USB and BT for accessing the LEDs/OLEDs.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: Ping Cheng <pingc@wacom.com>
Tested-by: Przemo Firszt <przemo@firszt.eu>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Now that wacom is a hid driver, there is no point in having a separate
driver for bluetooth devices. This patch prepares the common paths of
Bluetooth devices in the common wacom driver. It also adds the sysfs file
"speed" used by Bluetooth devices.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: Ping Cheng <pingc@wacom.com>
Tested-by: Przemo Firszt <przemo@firszt.eu>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
With this patch, we can move the mouse to wake up the VM after the VM executes
"echo freeze > /sys/power/state".
This addresses part of https://bugzilla.redhat.com/show_bug.cgi?id=1086100
Signed-off-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Previously only the first element of the array was initialized to 1
leading to potential incorrect max brightness values for the LEDs
on the Dualshock 3 and buzzer controllers.
Use a designated initializer to initialize the whole array to the
correct value.
Signed-off-by: Frank Praznik <frank.praznik@oh.rr.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Fix sparse warnings in hid-huion.c by using correct buffer type for
retrieved string descriptor.
The warnings in question were:
drivers/hid/hid-huion.c:144:44: sparse: cast to restricted __le16
drivers/hid/hid-huion.c:145:44: sparse: cast to restricted __le16
drivers/hid/hid-huion.c:146:51: sparse: cast to restricted __le16
drivers/hid/hid-huion.c:147:30: sparse: cast to restricted __le16
Reported-by: fengguang.wu@intel.com
Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Ignore Jabra GN9350E HID interface. USB audio is working nicely, but
registering as HID blocks USB mouse buttons. Since special userspace programs
are needed we will avoid attaching usbhid drivers in general.
Signed-off-by: Patrick Plattes <patrick@erdbeere.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
cp2112 supports single I2C read/write transactions. It can't combine I2C
transactions.
Add master_xfer, using similar code flow as for smbus_xfer.
Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
On composite HID devices there may be multiple HID devices on separate interfaces, but hid-rmi
should only bind to the mouse interface. One example is the Dell Venue 11 Pro's keyboard dock
which contains a composite USB device with a HID touchpad and HID keyboard on separate intefaces.
Since the USB Vendor ID is Synaptic's, hid-core is currently trying to bind hid-rmi to all\of
the HID devices. This patch ensures that hid-rmi only binds to the mouse interface.
related bug:
https://bugzilla.kernel.org/show_bug.cgi?id=80091
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
It is possible that the hid-rmi driver could get loaded onto a device which does not have the
expected report ids. This should not happen because it would indicate that the hid-rmi driver is
not compatible with that device. However, if it does happen it should return an error from probe
instead of dereferencing a null pointer.
related bug:
https://bugzilla.kernel.org/show_bug.cgi?id=80091
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Add support for both ThinkPad Compact Bluetooth Keyboard with
TrackPoint and ThinkPad Compact USB Keyboard with TrackPoint.
Signed-off-by: Jamie Lentin <jm@lentin.co.uk>
Reviewed-by: Antonio Ospite <ao2@ao2.it>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Ensure all tpkbd specifics are within a postfixed function, the
main functions for the driver should just switch to the appropriate
function depending on product ID. Given this, we can add extra devices
by including extra postfixed functions.
Signed-off-by: Jamie Lentin <jm@lentin.co.uk>
Reviewed-by: Antonio Ospite <ao2@ao2.it>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Rename module and all functions within so we can add support for other
keyboards in the same file. Rename the _tp postfix to _tpkbd, to
signify functions relevant to the TP USB keyboard.
Signed-off-by: Jamie Lentin <jm@lentin.co.uk>
Reviewed-by: Antonio Ospite <ao2@ao2.it>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Add handling of Huion tablets with UC-Logic vendor ID, but the same
product ID to hid-huion driver. A Huion H580 was seen using it.
Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Switch to generating tablet pen report descriptor from a template and
parameters retrieved from string descriptor 0x64.
Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Don't ignore non pen-reporting interfaces as they may be used by some
models reusing the same product ID.
Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Use word "tablet" in identifiers and comments instead of referring to specific
Huion tablet model name, as the product ID is used by at least several tablet
models.
Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
I am using a USB keyborad that give me "usb_submit_urb(ctrl) failed: -1" error
when I plugin it. and I need to wait for 10s for this device to be ready.
By adding this quirks, the usb keyborad is usable right after plugin
Signed-off-by: Wangzhao Cai <microcaicai@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Currently, the i2c-hid driver does not call the suspend, resume, and
reset_resume callbacks in the hid_driver struct when those events occur.
This means that HID drivers for i2c-hid devices will not be able to execute
commands which may be needed during suspend or resume. One example is when a
touchpad using the hid-multitouch driver gets reset by i2c-hid coming out of
resume. Since the reset_resume callback never gets called the device is never
put back into the correct input mode. This patch calls the suspend and resume
callbacks and tries to duplicate the functionality of the usb-hid driver.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Vincent Huang <vincent.huang@tw.synaptics.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Userspace tools may use hidraw to perform operations on the device from userspace while
hid-rmi is bound to the device. This can cause hid-rmi to print error messages when its
->raw_event() callback gets called as the reports pass through the HID stack. In this case
receiving responses which were not initiated by hid-rmi is not actually an error so the resulting
error messages are incorrect and misleading. This patch changes the log messages to debug so
that the messages can be turned on in the event that there is a problem and there is not
a userspace tool running.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
There are additional queries which are optional and may not be present
depending on the configuration of the firmware. Knowing which queries are
present is needed to properly compute the address of Query 12 and all
subsequent queries. Additional bits in Query 1 are used to indicate the
presence of these optional queries.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
