1. 19 4月, 2017 1 次提交
    • J
      HID: wacom: Treat HID_DG_TOOLSERIALNUMBER as unsigned · 286f3f47
      Jason Gerecke 提交于
      Because HID_DG_TOOLSERIALNUMBER doesn't first cast the value recieved from HID
      to an unsigned type, sign-extension rules can cause the value of
      wacom_wac->serial[0] to inadvertently wind up with all 32 of its highest bits
      set if the highest bit of "value" was set.
      
      This can cause problems for Tablet PC devices which use AES sensors and the
      xf86-input-wacom userspace driver. It is not uncommon for AES sensors to send a
      serial number of '0' while the pen is entering or leaving proximity. The
      xf86-input-wacom driver ignores events with a serial number of '0' since it
      cannot match them up to an in-use tool.  To ensure the xf86-input-wacom driver
      does not ignore the final out-of-proximity event, the kernel does not send
      MSC_SERIAL events when the value of wacom_wac->serial[0] is '0'. If the highest
      bit of HID_DG_TOOLSERIALNUMBER is set by an in-prox pen which later leaves
      proximity and sends a '0' for HID_DG_TOOLSERIALNUMBER, then only the lowest 32
      bits of wacom_wac->serial[0] are actually cleared, causing the kernel to send
      an MSC_SERIAL event. Since the 'input_event' function takes an 'int' as
      argument, only those lowest (now-cleared) 32 bits of wacom_wac->serial[0] are
      sent to userspace, causing xf86-input-wacom to ignore the event. If the event
      was the final out-of-prox event, then xf86-input-wacom may remain in a state
      where it believes the pen is in proximity and refuses to allow other devices
      under its control (e.g. the touchscreen) to move the cursor.
      
      It should be noted that EMR devices and devices which use both the
      HID_DG_TOOLSERIALNUMBER and WACOM_HID_WD_SERIALHI usages (in that order) would
      be immune to this issue. It appears only AES devices are affected.
      
      Fixes: f85c9dc6 ("HID: wacom: generic: Support tool ID and additional tool types")
      Cc: stable@vger.kernel.org
      Signed-off-by: NJason Gerecke <jason.gerecke@wacom.com>
      Acked-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      286f3f47
  2. 21 3月, 2017 2 次提交
  3. 14 2月, 2017 1 次提交
  4. 03 2月, 2017 1 次提交
  5. 27 1月, 2017 8 次提交
  6. 19 1月, 2017 1 次提交
    • J
      HID: wacom: Fix sibling detection regression · a9ce7856
      Jason Gerecke 提交于
      Commit 345857bb ("HID: wacom: generic: Add support for sensor offsets") included
      a change to the operation and location of the call to 'wacom_add_shared_data'
      in 'wacom_parse_and_register'. The modifications included moving it higher up
      so that it would occur before the call to 'wacom_retrieve_hid_descriptor'. This
      was done to prevent a crash that would have occured when the report containing
      tablet offsets was fed into the driver with 'wacom_hid_report_raw_event'
      (specifically: the various 'wacom_wac_*_report' functions were written with the
      assumption that they would only be called once tablet setup had completed;
      'wacom_wac_pen_report' in particular dereferences 'shared' which wasn't yet
      allocated).
      
      Moving the call to 'wacom_add_shared_data' effectively prevented the crash but
      also broke the sibiling detection code which assumes that the HID descriptor
      has been read and the various device_type flags set.
      
      To fix this situation, we restore the original 'wacom_add_shared_data'
      operation and location and instead implement an alternative change that can
      also prevent the crash. Specifically, we notice that the report functions
      mentioned above expect to be called only for input reports.  By adding a check,
      we can prevent feature reports (such as the offset report) from
      causing trouble.
      
      Fixes: 345857bb ("HID: wacom: generic: Add support for sensor offsets")
      Signed-off-by: NJason Gerecke <jason.gerecke@wacom.com>
      Tested-by: NPing Cheng <pingc@wacom.com>
      Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      a9ce7856
  7. 09 12月, 2016 4 次提交
  8. 15 11月, 2016 2 次提交
  9. 20 10月, 2016 14 次提交
  10. 12 8月, 2016 1 次提交
    • J
      HID: wacom: Update last_slot_field during pre_report phase · 003f50ab
      Jason Gerecke 提交于
      If a touchscreen contains both multitouch and single-touch reports in its
      descriptor in that order, the driver may overwrite information it saved
      about the format of the multitouch report. This can cause the report
      processing code to get tripped up and send an incorrect event stream to
      userspace.
      
      In particular, this can cause last_slot_field to be overwritten with the
      result that the driver prematurely assumes it has finished processing a
      slot and sending the ABS_MT_SLOT event at the wrong point in time,
      associating events for the current contact with the following contact
      instead.
      
      To prevent this from occurring, we update the value of last_slot_field
      durring the pre_report phase to ensure that it is correct for the report
      that is to be processed.
      Signed-off-by: NJason Gerecke <jason.gerecke@wacom.com>
      Reviewed-by: NPing Cheng <pingc@wacom.com>
      Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      003f50ab
  11. 10 8月, 2016 3 次提交
  12. 05 8月, 2016 2 次提交