1. 08 10月, 2019 1 次提交
  2. 21 9月, 2019 1 次提交
  3. 26 7月, 2019 1 次提交
  4. 23 7月, 2018 1 次提交
  5. 03 7月, 2018 3 次提交
  6. 20 6月, 2018 1 次提交
    • J
      HID: wacom: Correct logical maximum Y for 2nd-gen Intuos Pro large · d471b6b2
      Jason Gerecke 提交于
      The HID descriptor for the 2nd-gen Intuos Pro large (PTH-860) contains
      a typo which defines an incorrect logical maximum Y value. This causes
      a small portion of the bottom of the tablet to become unusable (both
      because the area is below the "bottom" of the tablet and because
      'wacom_wac_event' ignores out-of-range values). It also results in a
      skewed aspect ratio.
      
      To fix this, we add a quirk to 'wacom_usage_mapping' which overwrites
      the data with the correct value.
      Signed-off-by: NJason Gerecke <jason.gerecke@wacom.com>
      CC: stable@vger.kernel.org # v4.10+
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      d471b6b2
  7. 13 6月, 2018 1 次提交
    • K
      treewide: devm_kzalloc() -> devm_kcalloc() · a86854d0
      Kees Cook 提交于
      The devm_kzalloc() function has a 2-factor argument form, devm_kcalloc().
      This patch replaces cases of:
      
              devm_kzalloc(handle, a * b, gfp)
      
      with:
              devm_kcalloc(handle, a * b, gfp)
      
      as well as handling cases of:
      
              devm_kzalloc(handle, a * b * c, gfp)
      
      with:
      
              devm_kzalloc(handle, array3_size(a, b, c), gfp)
      
      as it's slightly less ugly than:
      
              devm_kcalloc(handle, array_size(a, b), c, gfp)
      
      This does, however, attempt to ignore constant size factors like:
      
              devm_kzalloc(handle, 4 * 1024, gfp)
      
      though any constants defined via macros get caught up in the conversion.
      
      Any factors with a sizeof() of "unsigned char", "char", and "u8" were
      dropped, since they're redundant.
      
      Some manual whitespace fixes were needed in this patch, as Coccinelle
      really liked to write "=devm_kcalloc..." instead of "= devm_kcalloc...".
      
      The Coccinelle script used for this was:
      
      // Fix redundant parens around sizeof().
      @@
      expression HANDLE;
      type TYPE;
      expression THING, E;
      @@
      
      (
        devm_kzalloc(HANDLE,
      -	(sizeof(TYPE)) * E
      +	sizeof(TYPE) * E
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	(sizeof(THING)) * E
      +	sizeof(THING) * E
        , ...)
      )
      
      // Drop single-byte sizes and redundant parens.
      @@
      expression HANDLE;
      expression COUNT;
      typedef u8;
      typedef __u8;
      @@
      
      (
        devm_kzalloc(HANDLE,
      -	sizeof(u8) * (COUNT)
      +	COUNT
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(__u8) * (COUNT)
      +	COUNT
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(char) * (COUNT)
      +	COUNT
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(unsigned char) * (COUNT)
      +	COUNT
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(u8) * COUNT
      +	COUNT
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(__u8) * COUNT
      +	COUNT
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(char) * COUNT
      +	COUNT
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(unsigned char) * COUNT
      +	COUNT
        , ...)
      )
      
      // 2-factor product with sizeof(type/expression) and identifier or constant.
      @@
      expression HANDLE;
      type TYPE;
      expression THING;
      identifier COUNT_ID;
      constant COUNT_CONST;
      @@
      
      (
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	sizeof(TYPE) * (COUNT_ID)
      +	COUNT_ID, sizeof(TYPE)
        , ...)
      |
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	sizeof(TYPE) * COUNT_ID
      +	COUNT_ID, sizeof(TYPE)
        , ...)
      |
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	sizeof(TYPE) * (COUNT_CONST)
      +	COUNT_CONST, sizeof(TYPE)
        , ...)
      |
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	sizeof(TYPE) * COUNT_CONST
      +	COUNT_CONST, sizeof(TYPE)
        , ...)
      |
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	sizeof(THING) * (COUNT_ID)
      +	COUNT_ID, sizeof(THING)
        , ...)
      |
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	sizeof(THING) * COUNT_ID
      +	COUNT_ID, sizeof(THING)
        , ...)
      |
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	sizeof(THING) * (COUNT_CONST)
      +	COUNT_CONST, sizeof(THING)
        , ...)
      |
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	sizeof(THING) * COUNT_CONST
      +	COUNT_CONST, sizeof(THING)
        , ...)
      )
      
      // 2-factor product, only identifiers.
      @@
      expression HANDLE;
      identifier SIZE, COUNT;
      @@
      
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	SIZE * COUNT
      +	COUNT, SIZE
        , ...)
      
      // 3-factor product with 1 sizeof(type) or sizeof(expression), with
      // redundant parens removed.
      @@
      expression HANDLE;
      expression THING;
      identifier STRIDE, COUNT;
      type TYPE;
      @@
      
      (
        devm_kzalloc(HANDLE,
      -	sizeof(TYPE) * (COUNT) * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(TYPE) * (COUNT) * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(TYPE) * COUNT * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(TYPE) * COUNT * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(THING) * (COUNT) * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(THING) * (COUNT) * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(THING) * COUNT * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(THING) * COUNT * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      )
      
      // 3-factor product with 2 sizeof(variable), with redundant parens removed.
      @@
      expression HANDLE;
      expression THING1, THING2;
      identifier COUNT;
      type TYPE1, TYPE2;
      @@
      
      (
        devm_kzalloc(HANDLE,
      -	sizeof(TYPE1) * sizeof(TYPE2) * COUNT
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(THING1) * sizeof(THING2) * COUNT
      +	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(THING1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(TYPE1) * sizeof(THING2) * COUNT
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
        , ...)
      )
      
      // 3-factor product, only identifiers, with redundant parens removed.
      @@
      expression HANDLE;
      identifier STRIDE, SIZE, COUNT;
      @@
      
      (
        devm_kzalloc(HANDLE,
      -	(COUNT) * STRIDE * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	COUNT * (STRIDE) * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	COUNT * STRIDE * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	(COUNT) * (STRIDE) * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	COUNT * (STRIDE) * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	(COUNT) * STRIDE * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	(COUNT) * (STRIDE) * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	COUNT * STRIDE * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      )
      
      // Any remaining multi-factor products, first at least 3-factor products,
      // when they're not all constants...
      @@
      expression HANDLE;
      expression E1, E2, E3;
      constant C1, C2, C3;
      @@
      
      (
        devm_kzalloc(HANDLE, C1 * C2 * C3, ...)
      |
        devm_kzalloc(HANDLE,
      -	(E1) * E2 * E3
      +	array3_size(E1, E2, E3)
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	(E1) * (E2) * E3
      +	array3_size(E1, E2, E3)
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	(E1) * (E2) * (E3)
      +	array3_size(E1, E2, E3)
        , ...)
      |
        devm_kzalloc(HANDLE,
      -	E1 * E2 * E3
      +	array3_size(E1, E2, E3)
        , ...)
      )
      
      // And then all remaining 2 factors products when they're not all constants,
      // keeping sizeof() as the second factor argument.
      @@
      expression HANDLE;
      expression THING, E1, E2;
      type TYPE;
      constant C1, C2, C3;
      @@
      
      (
        devm_kzalloc(HANDLE, sizeof(THING) * C2, ...)
      |
        devm_kzalloc(HANDLE, sizeof(TYPE) * C2, ...)
      |
        devm_kzalloc(HANDLE, C1 * C2 * C3, ...)
      |
        devm_kzalloc(HANDLE, C1 * C2, ...)
      |
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	sizeof(TYPE) * (E2)
      +	E2, sizeof(TYPE)
        , ...)
      |
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	sizeof(TYPE) * E2
      +	E2, sizeof(TYPE)
        , ...)
      |
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	sizeof(THING) * (E2)
      +	E2, sizeof(THING)
        , ...)
      |
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	sizeof(THING) * E2
      +	E2, sizeof(THING)
        , ...)
      |
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	(E1) * E2
      +	E1, E2
        , ...)
      |
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	(E1) * (E2)
      +	E1, E2
        , ...)
      |
      - devm_kzalloc
      + devm_kcalloc
        (HANDLE,
      -	E1 * E2
      +	E1, E2
        , ...)
      )
      Signed-off-by: NKees Cook <keescook@chromium.org>
      a86854d0
  8. 25 4月, 2018 1 次提交
  9. 16 2月, 2018 1 次提交
  10. 23 1月, 2018 1 次提交
    • A
      HID: wacom: EKR: ensure devres groups at higher indexes are released · 791ae273
      Aaron Armstrong Skomra 提交于
      Background: ExpressKey Remotes communicate their events via usb dongle.
      Each dongle can hold up to 5 pairings at one time and one EKR (identified
      by its serial number) can unfortunately be paired with its dongle
      more than once. The pairing takes place in a round-robin fashion.
      
      Input devices are only created once per EKR, when a new serial number
      is seen in the list of pairings. However, if a device is created for
      a "higher" paring index and subsequently a second pairing occurs at a
      lower pairing index, unpairing the remote with that serial number from
      any pairing index will currently cause a driver crash. This occurs
      infrequently, as two remotes are necessary to trigger this bug and most
      users have only one remote.
      
      As an illustration, to trigger the bug you need to have two remotes,
      and pair them in this order:
      
      1. slot 0 -> remote 1 (input device created for remote 1)
      2. slot 1 -> remote 1 (duplicate pairing - no device created)
      3. slot 2 -> remote 1 (duplicate pairing - no device created)
      4. slot 3 -> remote 1 (duplicate pairing - no device created)
      5. slot 4 -> remote 2 (input device created for remote 2)
      
      6. slot 0 -> remote 2 (1 destroyed and recreated at slot 1)
      7. slot 1 -> remote 2 (1 destroyed and recreated at slot 2)
      8. slot 2 -> remote 2 (1 destroyed and recreated at slot 3)
      9. slot 3 -> remote 2 (1 destroyed and not recreated)
      10. slot 4 -> remote 2 (2 was already in this slot so no changes)
      
      11. slot 0 -> remote 1 (The current code sees remote 2 was paired over in
                              one of the dongle slots it occupied and attempts
                              to remove all information about remote 2 [1]. It
                              calls wacom_remote_destroy_one for remote 2, but
                              the destroy function assumes the lowest index is
                              where the remote's input device was created. The
                              code "cleans up" the other remote 2 pairings
                              including the one which the input device was based
                              on, assuming they were were just duplicate
                              pairings. However, the cleanup doesn't call the
                              devres release function for the input device that
                              was created in slot 4).
      
      This issue is fixed by this commit.
      
      [1] Remote 2 should subsequently be re-created on the next packet from the
      EKR at the lowest numbered slot that it occupies (here slot 1).
      
      Fixes: f9036bd4 ("HID: wacom: EKR: use devres groups to manage resources")
      Cc: stable <stable@vger.kernel.org> #4.9
      Signed-off-by: NAaron Armstrong Skomra <aaron.skomra@wacom.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      791ae273
  11. 21 11月, 2017 1 次提交
    • J
      HID: wacom: Queue events with missing type/serial data for later processing · 83417206
      Jason Gerecke 提交于
      Userspace expects to receive tool type and serial number information
      for the active pen in the very first kernel report, if such data is
      supported by the hardware. While this expectation is not an issue for
      EMR devices, AES sensors will often send several packets worth of in-
      range data before relaying type/serial data to the kernel. Sending this
      data "late" can result in proximity-tracking issues by xf86-input-wacom,
      or an inability to distinguish different pens by input-wacom.
      
      Options for dealing with this situation include ignoring reports from
      the tablet until we get the necessary data, or using the information
      from the last-seen pen instead of the (eventual) real data. Neither
      option is particularly attractive: the former results in truncated
      strokes and the latter causes issues with switching between pens.
      
      This commit instead opts to queue up events with missing information
      until we receive a report which contains it. At that point, we can
      update the driver's state variables (id[0] and serial[0]) and replay
      the queued events.
      Signed-off-by: NJason Gerecke <jason.gerecke@wacom.com>
      Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      83417206
  12. 10 11月, 2017 1 次提交
  13. 02 10月, 2017 1 次提交
    • J
      HID: wacom: Always increment hdev refcount within wacom_get_hdev_data · 2a5e597c
      Jason Gerecke 提交于
      The wacom_get_hdev_data function is used to find and return a reference to
      the "other half" of a Wacom device (i.e., the touch device associated with
      a pen, or vice-versa). To ensure these references are properly accounted
      for, the function is supposed to automatically increment the refcount before
      returning. This was not done, however, for devices which have pen & touch
      on different interfaces of the same USB device. This can lead to a WARNING
      ("refcount_t: underflow; use-after-free") when removing the module or device
      as we call kref_put() more times than kref_get(). Triggering an "actual" use-
      after-free would be difficult since both devices will disappear nearly-
      simultaneously. To silence this warning and prevent the potential error, we
      need to increment the refcount for all cases within wacom_get_hdev_data.
      
      Fixes: 41372d5d ("HID: wacom: Augment 'oVid' and 'oPid' with heuristics for HID_GENERIC")
      Cc: <stable@vger.kernel.org> # v4.9+
      Signed-off-by: NJason Gerecke <jason.gerecke@wacom.com>
      Reviewed-by: NPing Cheng <ping.cheng@wacom.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      2a5e597c
  14. 06 9月, 2017 1 次提交
  15. 27 7月, 2017 1 次提交
    • J
      HID: wacom: Improve generic name generation · 09dc28ac
      Jason Gerecke 提交于
      The 'wacom_update_name' function is responsible for producing names for
      the input device nodes based on the hardware device name. Commit f2209d4a
      added the ability to strip off prefixes like "Wacom Co.,Ltd." where the
      prefix was immediately (and redundantly) followed by "Wacom". The
      2nd-generation Intuos Pro 2 has such a prefix, but with a small error
      (the period and comma are swapped) that prevents the existing code from
      matching it. We're loath to extend the number of cases out endlessly and
      so instead try to be smarter about name generation.
      
      We observe that the cause of the redundant prefixes is HID combining the
      manufacturer and product strings of USB devices together. By using the
      original product name (with "Wacom" prefixed, if it does not already
      exist in the string) we can bypass the gyrations to find and remove
      redundant prefixes. Other devices either don't have a manufacturer string
      that needs to be removed (Bluetooth, uhid) or should have their name
      generated from scratch (I2C).
      Signed-off-by: NJason Gerecke <jason.gerecke@wacom.com>
      Acked-By: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      09dc28ac
  16. 20 7月, 2017 1 次提交
  17. 06 5月, 2017 1 次提交
    • J
      HID: wacom: Add ability to provide explicit battery status info · 16e45989
      Jason Gerecke 提交于
      At the moment, our driver relies on 'wacom_battery_get_property()' to
      determine the most likely battery state (e.g charging, discharging, or
      full) based on the information available. It is not always possible
      for the function to properly determine this, however. For instance,
      whenever an AES pen leaves proximity the battery state becomes
      indeterminite. This commit adds the ability to provide it with explict
      state information if desired. Whenever explicit state is not required
      (the majority of circumstances), WACOM_POWER_SUPPLY_STATUS_AUTO can
      be used in its place.
      
      Three uses of explicit battery status are added: two wireless disconnect
      paths and the AES case mentioned above.
      Signed-off-by: NJason Gerecke <jason.gerecke@wacom.com>
      Reviewed-by: NPing Cheng <ping.cheng@wacom.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      16e45989
  18. 30 3月, 2017 2 次提交
  19. 21 3月, 2017 1 次提交
  20. 06 3月, 2017 2 次提交
  21. 27 1月, 2017 5 次提交
  22. 23 1月, 2017 3 次提交
  23. 19 1月, 2017 1 次提交
    • J
      HID: wacom: Fix sibling detection regression · a9ce7856
      Jason Gerecke 提交于
      Commit 345857bb ("HID: wacom: generic: Add support for sensor offsets") included
      a change to the operation and location of the call to 'wacom_add_shared_data'
      in 'wacom_parse_and_register'. The modifications included moving it higher up
      so that it would occur before the call to 'wacom_retrieve_hid_descriptor'. This
      was done to prevent a crash that would have occured when the report containing
      tablet offsets was fed into the driver with 'wacom_hid_report_raw_event'
      (specifically: the various 'wacom_wac_*_report' functions were written with the
      assumption that they would only be called once tablet setup had completed;
      'wacom_wac_pen_report' in particular dereferences 'shared' which wasn't yet
      allocated).
      
      Moving the call to 'wacom_add_shared_data' effectively prevented the crash but
      also broke the sibiling detection code which assumes that the HID descriptor
      has been read and the various device_type flags set.
      
      To fix this situation, we restore the original 'wacom_add_shared_data'
      operation and location and instead implement an alternative change that can
      also prevent the crash. Specifically, we notice that the report functions
      mentioned above expect to be called only for input reports.  By adding a check,
      we can prevent feature reports (such as the offset report) from
      causing trouble.
      
      Fixes: 345857bb ("HID: wacom: generic: Add support for sensor offsets")
      Signed-off-by: NJason Gerecke <jason.gerecke@wacom.com>
      Tested-by: NPing Cheng <pingc@wacom.com>
      Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      a9ce7856
  24. 06 1月, 2017 1 次提交
  25. 20 10月, 2016 5 次提交
  26. 10 8月, 2016 1 次提交