1. 03 2月, 2018 2 次提交
  2. 01 2月, 2018 3 次提交
    • D
      Merge branch 'next' into for-linus · d67ad78e
      Dmitry Torokhov 提交于
      Prepare input updates for 4.16 merge window.
      d67ad78e
    • M
      Input: goodix - use generic touchscreen_properties · fafef982
      Marcin Niestroj 提交于
      Use touchscreen_properties structure instead of implementing all
      properties by our own. It allows us to reuse generic code for parsing
      device-tree properties (which was implemented manually in the driver for
      now). Additionally, it allows us to report events using generic
      touchscreen_report_pos(), which automatically handles inverted and
      swapped axes.
      
      This fixes the issue with the custom code incorrectly handling case where
      ts->inverted_x and ts->swapped_x_y were true, but ts->inverted_y was
      false. Assuming we have 720x1280 touch panel, ts->abs_x_max == 1279 and
      ts->abs_y_max == 719 (because we inverted that in goodix_read_config()).
      Now let's assume that we received event from (0:0) position (in touch
      panel original coordinates). In function goodix_ts_report_touch() we
      calculate input_x as 1279, but after swapping input_y takes that value
      (which is more that maximum 719 value reported during initialization).
      
      Note that since touchscreen coordinates are 0-indexed, we now report
      touchscreen range as (0:size-1).
      
      Developed and tested on custom DT-based device with gt1151 touch
      panel.
      Signed-off-by: NMarcin Niestroj <m.niestroj@grinn-global.com>
      [dtor: fix endianness annotation reported by sparse, handle errors when
       initializing MT slots]
      Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
      fafef982
    • A
      Input: mms114 - fix typo in definition · 13e94540
      Andi Shyti 提交于
      It's 'MMS114_INFORMATION', not 'MMS114_INFOMATION'
      Signed-off-by: NAndi Shyti <andi.shyti@samsung.com>
      Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
      13e94540
  3. 31 1月, 2018 2 次提交
  4. 27 1月, 2018 4 次提交
  5. 25 1月, 2018 2 次提交
  6. 23 1月, 2018 14 次提交
  7. 20 1月, 2018 2 次提交
  8. 19 1月, 2018 3 次提交
    • N
      Input: synaptics-rmi4 - prevent UAF reported by KASAN · 55edde9f
      Nick Desaulniers 提交于
      KASAN found a UAF due to dangling pointer. As the report below says,
      rmi_f11_attention() accesses drvdata->attn_data.data, which was freed in
      rmi_irq_fn.
      
      [  311.424062] BUG: KASAN: use-after-free in rmi_f11_attention+0x526/0x5e0 [rmi_core]
      [  311.424067] Read of size 27 at addr ffff88041fd610db by task irq/131-i2c_hid/1162
      [  311.424075] CPU: 0 PID: 1162 Comm: irq/131-i2c_hid Not tainted 4.15.0-rc8+ #2
      [  311.424076] Hardware name: Razer Blade Stealth/Razer, BIOS 6.05 01/26/2017
      [  311.424078] Call Trace:
      [  311.424086]  dump_stack+0xae/0x12d
      [  311.424090]  ? _atomic_dec_and_lock+0x103/0x103
      [  311.424094]  ? show_regs_print_info+0xa/0xa
      [  311.424099]  ? input_handle_event+0x10b/0x810
      [  311.424104]  print_address_description+0x65/0x229
      [  311.424108]  kasan_report.cold.5+0xa7/0x281
      [  311.424117]  rmi_f11_attention+0x526/0x5e0 [rmi_core]
      [  311.424123]  ? memcpy+0x1f/0x50
      [  311.424132]  ? rmi_f11_attention+0x526/0x5e0 [rmi_core]
      [  311.424143]  ? rmi_f11_probe+0x1e20/0x1e20 [rmi_core]
      [  311.424153]  ? rmi_process_interrupt_requests+0x220/0x2a0 [rmi_core]
      [  311.424163]  ? rmi_irq_fn+0x22c/0x270 [rmi_core]
      [  311.424173]  ? rmi_process_interrupt_requests+0x2a0/0x2a0 [rmi_core]
      [  311.424177]  ? free_irq+0xa0/0xa0
      [  311.424180]  ? irq_finalize_oneshot.part.39+0xeb/0x180
      [  311.424190]  ? rmi_process_interrupt_requests+0x2a0/0x2a0 [rmi_core]
      [  311.424193]  ? irq_thread_fn+0x3d/0x80
      [  311.424197]  ? irq_finalize_oneshot.part.39+0x180/0x180
      [  311.424200]  ? irq_thread+0x21d/0x290
      [  311.424203]  ? irq_thread_check_affinity+0x170/0x170
      [  311.424207]  ? remove_wait_queue+0x150/0x150
      [  311.424212]  ? kasan_unpoison_shadow+0x30/0x40
      [  311.424214]  ? __init_waitqueue_head+0xa0/0xd0
      [  311.424218]  ? task_non_contending.cold.55+0x18/0x18
      [  311.424221]  ? irq_forced_thread_fn+0xa0/0xa0
      [  311.424226]  ? irq_thread_check_affinity+0x170/0x170
      [  311.424230]  ? kthread+0x19e/0x1c0
      [  311.424233]  ? kthread_create_worker_on_cpu+0xc0/0xc0
      [  311.424237]  ? ret_from_fork+0x32/0x40
      
      [  311.424244] Allocated by task 899:
      [  311.424249]  kasan_kmalloc+0xbf/0xe0
      [  311.424252]  __kmalloc_track_caller+0xd9/0x1f0
      [  311.424255]  kmemdup+0x17/0x40
      [  311.424264]  rmi_set_attn_data+0xa4/0x1b0 [rmi_core]
      [  311.424269]  rmi_raw_event+0x10b/0x1f0 [hid_rmi]
      [  311.424278]  hid_input_report+0x1a8/0x2c0 [hid]
      [  311.424283]  i2c_hid_irq+0x146/0x1d0 [i2c_hid]
      [  311.424286]  irq_thread_fn+0x3d/0x80
      [  311.424288]  irq_thread+0x21d/0x290
      [  311.424291]  kthread+0x19e/0x1c0
      [  311.424293]  ret_from_fork+0x32/0x40
      
      [  311.424296] Freed by task 1162:
      [  311.424300]  kasan_slab_free+0x71/0xc0
      [  311.424303]  kfree+0x90/0x190
      [  311.424311]  rmi_irq_fn+0x1b2/0x270 [rmi_core]
      [  311.424319]  rmi_irq_fn+0x257/0x270 [rmi_core]
      [  311.424322]  irq_thread_fn+0x3d/0x80
      [  311.424324]  irq_thread+0x21d/0x290
      [  311.424327]  kthread+0x19e/0x1c0
      [  311.424330]  ret_from_fork+0x32/0x40
      
      [  311.424334] The buggy address belongs to the object at ffff88041fd610c0 which belongs to the cache kmalloc-64 of size 64
      [  311.424340] The buggy address is located 27 bytes inside of 64-byte region [ffff88041fd610c0, ffff88041fd61100)
      [  311.424344] The buggy address belongs to the page:
      [  311.424348] page:ffffea00107f5840 count:1 mapcount:0 mapping: (null) index:0x0
      [  311.424353] flags: 0x17ffffc0000100(slab)
      [  311.424358] raw: 0017ffffc0000100 0000000000000000 0000000000000000 00000001802a002a
      [  311.424363] raw: dead000000000100 dead000000000200 ffff8804228036c0 0000000000000000
      [  311.424366] page dumped because: kasan: bad access detected
      
      [  311.424369] Memory state around the buggy address:
      [  311.424373]  ffff88041fd60f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  311.424377]  ffff88041fd61000: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb
      [  311.424381] >ffff88041fd61080: fb fb fb fb fc fc fc fc fb fb fb fb fb fb fb fb
      [  311.424384]                                                     ^
      [  311.424387]  ffff88041fd61100: fc fc fc fc fb fb fb fb fb fb fb fb fc fc fc fc
      [  311.424391]  ffff88041fd61180: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb
      
      Cc: stable@vger.kernel.org
      Signed-off-by: NNick Desaulniers <nick.desaulniers@gmail.com>
      Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
      55edde9f
    • C
      Input: cyapa - remove redundant assignment to 'pwr_cmd' · deb106be
      Colin Ian King 提交于
      The variable pwr_cmd is being assigned to cyapa->suspend_power_mode
      twice, once during the declaration and once after taking an
      interruptible mutex lock.  Remove the redundant first assignment
      since the value is never read and it is outside the mutex lock.
      
      Cleans up clang warning:
      drivers/input/mouse/cyapa.c:743:5: warning: Value stored to 'pwr_cmd'
      during its initialization is never read
      Signed-off-by: NColin Ian King <colin.king@canonical.com>
      Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
      deb106be
    • C
      Input: remove at32psif · 0de45027
      Corentin Labbe 提交于
      Since AVR32 arch is gone, at32psif driver is useless.
      Signed-off-by: NCorentin Labbe <clabbe.montjoie@gmail.com>
      Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
      0de45027
  9. 18 1月, 2018 1 次提交
  10. 17 1月, 2018 7 次提交
新手
引导
客服 返回
顶部