1. 10 3月, 2020 1 次提交
  2. 18 2月, 2020 3 次提交
  3. 14 2月, 2020 1 次提交
  4. 12 2月, 2020 4 次提交
  5. 03 2月, 2020 1 次提交
    • H
      HID: ite: Only bind to keyboard USB interface on Acer SW5-012 keyboard dock · beae5619
      Hans de Goede 提交于
      Commit 8f18eca9 ("HID: ite: Add USB id match for Acer SW5-012 keyboard
      dock") added the USB id for the Acer SW5-012's keyboard dock to the
      hid-ite driver to fix the rfkill driver not working.
      
      Most keyboard docks with an ITE 8595 keyboard/touchpad controller have the
      "Wireless Radio Control" bits which need the special hid-ite driver on the
      second USB interface (the mouse interface) and their touchpad only supports
      mouse emulation, so using generic hid-input handling for anything but
      the "Wireless Radio Control" bits is fine. On these devices we simply bind
      to all USB interfaces.
      
      But unlike other ITE8595 using keyboard docks, the Acer Aspire Switch 10
      (SW5-012)'s touchpad not only does mouse emulation it also supports
      HID-multitouch and all the keys including the "Wireless Radio Control"
      bits have been moved to the first USB interface (the keyboard intf).
      
      So we need hid-ite to handle the first (keyboard) USB interface and have
      it NOT bind to the second (mouse) USB interface so that that can be
      handled by hid-multitouch.c and we get proper multi-touch support.
      
      This commit changes the hid_device_id for the SW5-012 keyboard dock to
      only match on hid devices from the HID_GROUP_GENERIC group, this way
      hid-ite will not bind the the mouse/multi-touch interface which has
      HID_GROUP_MULTITOUCH_WIN_8 as group.
      This fixes the regression to mouse-emulation mode introduced by adding
      the keyboard dock USB id.
      
      Cc: stable@vger.kernel.org
      Fixes: 8f18eca9 ("HID: ite: Add USB id match for Acer SW5-012 keyboard dock")
      Reported-by: NZdeněk Rampas <zdenda.rampas@gmail.com>
      Signed-off-by: NHans de Goede <hdegoede@redhat.com>
      Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      beae5619
  6. 28 1月, 2020 1 次提交
    • F
      HID: logitech-hidpp: BatteryVoltage: only read chargeStatus if extPower is active · 4ab2bb3c
      Filipe Laíns 提交于
      In the HID++ 2.0 function getBatteryInfo() from the BatteryVoltage
      (0x1001) feature, chargeStatus is only valid if extPower is active.
      
      Previously we were ignoring extPower, which resulted in wrong values.
      
      Example:
          With an unplugged mouse
      
          $ cat /sys/class/power_supply/hidpp_battery_0/status
          Charging
      
      This patch fixes that, it also renames charge_sts to flags as
      charge_sts can be confused with chargeStatus from the spec.
      
      Spec:
      +--------+-------------------------------------------------------------------------+
      |  byte  |                                    2                                    |
      +--------+--------------+------------+------------+----------+----------+----------+
      |   bit  |     0..2     |      3     |      4     |     5    |     6    |     7    |
      +--------+--------------+------------+------------+----------+----------+----------+
      | buffer | chargeStatus | fastCharge | slowCharge | critical | (unused) | extPower |
      +--------+--------------+------------+------------+----------+----------+----------+
      Table 1 - battery voltage (0x1001), getBatteryInfo() (ASE 0), 3rd byte
      
      +-------+--------------------------------------+
      | value |                meaning               |
      +-------+--------------------------------------+
      |   0   | Charging                             |
      +-------+--------------------------------------+
      |   1   | End of charge (100% charged)         |
      +-------+--------------------------------------+
      |   2   | Charge stopped (any "normal" reason) |
      +-------+--------------------------------------+
      |   7   | Hardware error                       |
      +-------+--------------------------------------+
      Table 2 - chargeStatus value
      Signed-off-by: NFilipe Laíns <lains@archlinux.org>
      Tested-by: NPedro Vanzella <pedro@pedrovanzella.com>
      Reviewed-by: NPedro Vanzella <pedro@pedrovanzella.com>
      Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      4ab2bb3c
  7. 13 1月, 2020 1 次提交
  8. 10 1月, 2020 1 次提交
  9. 09 1月, 2020 1 次提交
  10. 30 12月, 2019 1 次提交
  11. 19 12月, 2019 1 次提交
  12. 18 12月, 2019 7 次提交
  13. 13 12月, 2019 5 次提交
    • D
      HID: hid-input: clear unmapped usages · 4f388217
      Dmitry Torokhov 提交于
      We should not be leaving half-mapped usages with potentially invalid
      keycodes, as that may confuse hidinput_find_key() when the key is located
      by index, which may end up feeding way too large keycode into the VT
      keyboard handler and cause OOB write there:
      
      BUG: KASAN: global-out-of-bounds in clear_bit include/asm-generic/bitops-instrumented.h:56 [inline]
      BUG: KASAN: global-out-of-bounds in kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline]
      BUG: KASAN: global-out-of-bounds in kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495
      Write of size 8 at addr ffffffff89a1b2d8 by task syz-executor108/1722
      ...
       kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline]
       kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495
       input_to_handler+0x3b6/0x4c0 drivers/input/input.c:118
       input_pass_values.part.0+0x2e3/0x720 drivers/input/input.c:145
       input_pass_values drivers/input/input.c:949 [inline]
       input_set_keycode+0x290/0x320 drivers/input/input.c:954
       evdev_handle_set_keycode_v2+0xc4/0x120 drivers/input/evdev.c:882
       evdev_do_ioctl drivers/input/evdev.c:1150 [inline]
      
      Cc: stable@vger.kernel.org
      Reported-by: syzbot+19340dff067c2d3835c0@syzkaller.appspotmail.com
      Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
      Tested-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      4f388217
    • P
      HID: Add quirk for incorrect input length on Lenovo Y720 · fd091376
      Pavel Balan 提交于
      Apply it to the Lenovo Y720 gaming laptop I2C peripheral then.
      
      This fixes dmesg being flooded with errors visible on un-suspend
      in Linux Mint 19 Cinnamon.
      
      Example of error log:
      
      <...>
      [    4.326588] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4)
      [    4.326845] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4)
      [    4.327095] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4)
      [    4.327341] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4)
      [    4.327609] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4)
      <...>
      
      Example of fixed log (debug on)
      
      <...>
      [ 3731.333183] i2c_hid i2c-ITE33D1:00: input: 02 00
      [ 3731.333581] i2c_hid i2c-ITE33D1:00: input: 02 00
      [ 3731.333842] i2c_hid i2c-ITE33D1:00: input: 02 00
      [ 3731.334107] i2c_hid i2c-ITE33D1:00: input: 02 00
      [ 3731.334367] i2c_hid i2c-ITE33D1:00: input: 02 00
      <...>
      
      [jkosina@suse.cz: rebase onto more recent codebase]
      Signed-off-by: NPavel Balan <admin@kryma.net>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      fd091376
    • H
      HID: asus: Ignore Asus vendor-page usage-code 0xff events · c07a0254
      Hans de Goede 提交于
      At least on a T100HA an Asus vendor-page usage-code 0xff event is send on
      every suspend and again on resume, resulting in the following warning:
      
      asus 0003:0B05:1807.0002: Unmapped Asus vendor usagepage code 0xff
      
      being logged twice on every suspend/resume.
      
      This commit silences the "Unmapped Asus vendor usagepage code ..."
      warning for usage-code 0xff to avoid these warnings being logged.
      Signed-off-by: NHans de Goede <hdegoede@redhat.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      c07a0254
    • H
      HID: ite: Add USB id match for Acer SW5-012 keyboard dock · 8f18eca9
      Hans de Goede 提交于
      The Acer SW5-012 2-in-1 keyboard dock uses a Synaptics S91028 touchpad
      which is connected to an ITE 8595 USB keyboard controller chip.
      
      This keyboard has the same quirk for its rfkill / airplane mode hotkey as
      other keyboards with the ITE 8595 chip, it only sends a single release
      event when pressed and released, it never sends a press event.
      
      This commit adds this keyboards USB id to the hid-ite id-table, fixing
      the rfkill key not working on this keyboard.
      Signed-off-by: NHans de Goede <hdegoede@redhat.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      8f18eca9
    • P
      HID: Add quirk for Xin-Mo Dual Controller · c62f7cd8
      Priit Laes 提交于
      Without the quirk, joystick shows up as single controller
      for both first and second player pads/pins.
      Signed-off-by: NPriit Laes <plaes@plaes.org>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      c62f7cd8
  14. 11 12月, 2019 2 次提交
    • M
      HID: hidraw: add support uniq ioctl · 2f48865d
      Marcel Holtmann 提交于
      Add support for reading out the uniq information from the underlying HID
      device. This might be the iSerialNumber in case of USB or the BD_ADDR in
      case of Bluetooth.
      Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      2f48865d
    • A
      HID: Fix slab-out-of-bounds read in hid_field_extract · 8ec321e9
      Alan Stern 提交于
      The syzbot fuzzer found a slab-out-of-bounds bug in the HID report
      handler.  The bug was caused by a report descriptor which included a
      field with size 12 bits and count 4899, for a total size of 7349
      bytes.
      
      The usbhid driver uses at most a single-page 4-KB buffer for reports.
      In the test there wasn't any problem about overflowing the buffer,
      since only one byte was received from the device.  Rather, the bug
      occurred when the HID core tried to extract the data from the report
      fields, which caused it to try reading data beyond the end of the
      allocated buffer.
      
      This patch fixes the problem by rejecting any report whose total
      length exceeds the HID_MAX_BUFFER_SIZE limit (minus one byte to allow
      for a possible report index).  In theory a device could have a report
      longer than that, but if there was such a thing we wouldn't handle it
      correctly anyway.
      
      Reported-and-tested-by: syzbot+09ef48aa58261464b621@syzkaller.appspotmail.com
      Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
      CC: <stable@vger.kernel.org>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      8ec321e9
  15. 09 12月, 2019 4 次提交
  16. 22 11月, 2019 1 次提交
  17. 18 11月, 2019 3 次提交
    • A
      HID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI transport device · 8725aa4f
      Andrew Duggan 提交于
      In the event that the RMI device is unreachable, the calls to rmi_set_mode() or
      rmi_set_page() will fail before registering the RMI transport device. When the
      device is removed, rmi_remove() will call rmi_unregister_transport_device()
      which will attempt to access the rmi_dev pointer which was not set.
      This patch adds a check of the RMI_STARTED bit before calling
      rmi_unregister_transport_device().  The RMI_STARTED bit is only set
      after rmi_register_transport_device() completes successfully.
      
      The kernel oops was reported in this message:
      https://www.spinics.net/lists/linux-input/msg58433.html
      
      [jkosina@suse.cz: reworded changelog as agreed with Andrew]
      Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
      Reported-by: NFederico Cerutti <federico@ceres-c.it>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      8725aa4f
    • H
      HID: quirks: remove hid-led devices from hid_have_special_driver · b03e5774
      Heiner Kallweit 提交于
      Since e04a0442 ("HID: core: remove the absolute need of
      hid_have_special_driver[]") it's no longer needed to list these LED
      devices in hid_have_special_driver[]. This allows libraries needing
      access to the hidraw device to work properly.
      Signed-off-by: NHeiner Kallweit <hkallweit1@gmail.com>
      Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      b03e5774
    • B
      HID: Improve Windows Precision Touchpad detection. · 2dbc6f11
      Blaž Hrastnik 提交于
      Per Microsoft spec, usage 0xC5 (page 0xFF) returns a blob containing
      data used to verify the touchpad as a Windows Precision Touchpad.
      
         0x85, REPORTID_PTPHQA,    //    REPORT_ID (PTPHQA)
          0x09, 0xC5,              //    USAGE (Vendor Usage 0xC5)
          0x15, 0x00,              //    LOGICAL_MINIMUM (0)
          0x26, 0xff, 0x00,        //    LOGICAL_MAXIMUM (0xff)
          0x75, 0x08,              //    REPORT_SIZE (8)
          0x96, 0x00, 0x01,        //    REPORT_COUNT (0x100 (256))
          0xb1, 0x02,              //    FEATURE (Data,Var,Abs)
      
      However, some devices, namely Microsoft's Surface line of products
      instead implement a "segmented device certification report" (usage 0xC6)
      which returns the same report, but in smaller chunks.
      
          0x06, 0x00, 0xff,        //     USAGE_PAGE (Vendor Defined)
          0x85, REPORTID_PTPHQA,   //     REPORT_ID (PTPHQA)
          0x09, 0xC6,              //     USAGE (Vendor usage for segment #)
          0x25, 0x08,              //     LOGICAL_MAXIMUM (8)
          0x75, 0x08,              //     REPORT_SIZE (8)
          0x95, 0x01,              //     REPORT_COUNT (1)
          0xb1, 0x02,              //     FEATURE (Data,Var,Abs)
          0x09, 0xC7,              //     USAGE (Vendor Usage)
          0x26, 0xff, 0x00,        //     LOGICAL_MAXIMUM (0xff)
          0x95, 0x20,              //     REPORT_COUNT (32)
          0xb1, 0x02,              //     FEATURE (Data,Var,Abs)
      
      By expanding Win8 touchpad detection to also look for the segmented
      report, all Surface touchpads are now properly recognized by
      hid-multitouch.
      Signed-off-by: NBlaž Hrastnik <blaz@mxxn.io>
      Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
      2dbc6f11
  18. 15 11月, 2019 2 次提交