Skip to content

Commit 672bb0f

Browse files
torvaldstorvalds
committed
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov: - a fix for use-after-free in Synaptics RMI4 driver - correction to multitouch contact tracking on certain ALPS touchpads (which got broken when we tried to fix the 2-finger scrolling) - touchpad on Lenovo T640p is switched over to SMbus/RMI - a few device node refcount fixes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: synaptics-rmi4 - prevent UAF reported by KASAN Input: ALPS - fix multi-touch decoding on SS4 plus touchpads Input: synaptics - Lenovo Thinkpad T460p devices should use RMI Input: of_touchscreen - add MODULE_LICENSE Input: 88pm860x-ts - fix child-node lookup Input: twl6040-vibra - fix child-node lookup Input: twl4030-vibra - fix sibling-node lookup
2 parents 9bdbaeb + 55edde9 commit 672bb0f

File tree

8 files changed

+44
-23
lines changed

8 files changed

+44
-23
lines changed

‎drivers/input/misc/twl4030-vibra.c‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -178,12 +178,14 @@ static SIMPLE_DEV_PM_OPS(twl4030_vibra_pm_ops,
178178
twl4030_vibra_suspend, twl4030_vibra_resume);
179179

180180
static bool twl4030_vibra_check_coexist(struct twl4030_vibra_data *pdata,
181-
struct device_node *node)
181+
struct device_node *parent)
182182
{
183+
struct device_node *node;
184+
183185
if (pdata && pdata->coexist)
184186
return true;
185187

186-
node = of_find_node_by_name(node, "codec");
188+
node = of_get_child_by_name(parent, "codec");
187189
if (node) {
188190
of_node_put(node);
189191
return true;

‎drivers/input/misc/twl6040-vibra.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -248,8 +248,7 @@ static int twl6040_vibra_probe(struct platform_device *pdev)
248248
int vddvibr_uV = 0;
249249
int error;
250250

251-
of_node_get(twl6040_core_dev->of_node);
252-
twl6040_core_node = of_find_node_by_name(twl6040_core_dev->of_node,
251+
twl6040_core_node = of_get_child_by_name(twl6040_core_dev->of_node,
253252
"vibra");
254253
if (!twl6040_core_node) {
255254
dev_err(&pdev->dev, "parent of node is missing?\n");

‎drivers/input/mouse/alps.c‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1250,29 +1250,32 @@ static int alps_decode_ss4_v2(struct alps_fields *f,
12501250
case SS4_PACKET_ID_MULTI:
12511251
if (priv->flags & ALPS_BUTTONPAD) {
12521252
if (IS_SS4PLUS_DEV(priv->dev_id)) {
1253-
f->mt[0].x = SS4_PLUS_BTL_MF_X_V2(p, 0);
1254-
f->mt[1].x = SS4_PLUS_BTL_MF_X_V2(p, 1);
1253+
f->mt[2].x = SS4_PLUS_BTL_MF_X_V2(p, 0);
1254+
f->mt[3].x = SS4_PLUS_BTL_MF_X_V2(p, 1);
1255+
no_data_x = SS4_PLUS_MFPACKET_NO_AX_BL;
12551256
} else {
12561257
f->mt[2].x = SS4_BTL_MF_X_V2(p, 0);
12571258
f->mt[3].x = SS4_BTL_MF_X_V2(p, 1);
1259+
no_data_x = SS4_MFPACKET_NO_AX_BL;
12581260
}
1261+
no_data_y = SS4_MFPACKET_NO_AY_BL;
12591262

12601263
f->mt[2].y = SS4_BTL_MF_Y_V2(p, 0);
12611264
f->mt[3].y = SS4_BTL_MF_Y_V2(p, 1);
1262-
no_data_x = SS4_MFPACKET_NO_AX_BL;
1263-
no_data_y = SS4_MFPACKET_NO_AY_BL;
12641265
} else {
12651266
if (IS_SS4PLUS_DEV(priv->dev_id)) {
1266-
f->mt[0].x = SS4_PLUS_STD_MF_X_V2(p, 0);
1267-
f->mt[1].x = SS4_PLUS_STD_MF_X_V2(p, 1);
1267+
f->mt[2].x = SS4_PLUS_STD_MF_X_V2(p, 0);
1268+
f->mt[3].x = SS4_PLUS_STD_MF_X_V2(p, 1);
1269+
no_data_x = SS4_PLUS_MFPACKET_NO_AX;
12681270
} else {
1269-
f->mt[0].x = SS4_STD_MF_X_V2(p, 0);
1270-
f->mt[1].x = SS4_STD_MF_X_V2(p, 1);
1271+
f->mt[2].x = SS4_STD_MF_X_V2(p, 0);
1272+
f->mt[3].x = SS4_STD_MF_X_V2(p, 1);
1273+
no_data_x = SS4_MFPACKET_NO_AX;
12711274
}
1275+
no_data_y = SS4_MFPACKET_NO_AY;
1276+
12721277
f->mt[2].y = SS4_STD_MF_Y_V2(p, 0);
12731278
f->mt[3].y = SS4_STD_MF_Y_V2(p, 1);
1274-
no_data_x = SS4_MFPACKET_NO_AX;
1275-
no_data_y = SS4_MFPACKET_NO_AY;
12761279
}
12771280

12781281
f->first_mp = 0;

‎drivers/input/mouse/alps.h‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -141,10 +141,12 @@ enum SS4_PACKET_ID {
141141
#define SS4_TS_Z_V2(_b) (s8)(_b[4] & 0x7F)
142142

143143

144-
#define SS4_MFPACKET_NO_AX 8160 /* X-Coordinate value */
145-
#define SS4_MFPACKET_NO_AY 4080 /* Y-Coordinate value */
146-
#define SS4_MFPACKET_NO_AX_BL 8176 /* Buttonless X-Coordinate value */
147-
#define SS4_MFPACKET_NO_AY_BL 4088 /* Buttonless Y-Coordinate value */
144+
#define SS4_MFPACKET_NO_AX 8160 /* X-Coordinate value */
145+
#define SS4_MFPACKET_NO_AY 4080 /* Y-Coordinate value */
146+
#define SS4_MFPACKET_NO_AX_BL 8176 /* Buttonless X-Coord value */
147+
#define SS4_MFPACKET_NO_AY_BL 4088 /* Buttonless Y-Coord value */
148+
#define SS4_PLUS_MFPACKET_NO_AX 4080 /* SS4 PLUS, X */
149+
#define SS4_PLUS_MFPACKET_NO_AX_BL 4088 /* Buttonless SS4 PLUS, X */
148150

149151
/*
150152
* enum V7_PACKET_ID - defines the packet type for V7

‎drivers/input/mouse/synaptics.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,7 @@ static const char * const smbus_pnp_ids[] = {
173173
"LEN0046", /* X250 */
174174
"LEN004a", /* W541 */
175175
"LEN200f", /* T450s */
176+
"LEN2018", /* T460p */
176177
NULL
177178
};
178179

‎drivers/input/rmi4/rmi_driver.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -230,8 +230,10 @@ static irqreturn_t rmi_irq_fn(int irq, void *dev_id)
230230
rmi_dbg(RMI_DEBUG_CORE, &rmi_dev->dev,
231231
"Failed to process interrupt request: %d\n", ret);
232232

233-
if (count)
233+
if (count) {
234234
kfree(attn_data.data);
235+
attn_data.data = NULL;
236+
}
235237

236238
if (!kfifo_is_empty(&drvdata->attn_fifo))
237239
return rmi_irq_fn(irq, dev_id);

‎drivers/input/touchscreen/88pm860x-ts.c‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ static int pm860x_touch_dt_init(struct platform_device *pdev,
126126
int data, n, ret;
127127
if (!np)
128128
return -ENODEV;
129-
np = of_find_node_by_name(np, "touch");
129+
np = of_get_child_by_name(np, "touch");
130130
if (!np) {
131131
dev_err(&pdev->dev, "Can't find touch node\n");
132132
return -EINVAL;
@@ -144,13 +144,13 @@ static int pm860x_touch_dt_init(struct platform_device *pdev,
144144
if (data) {
145145
ret = pm860x_reg_write(i2c, PM8607_GPADC_MISC1, data);
146146
if (ret < 0)
147-
return -EINVAL;
147+
goto err_put_node;
148148
}
149149
/* set tsi prebias time */
150150
if (!of_property_read_u32(np, "marvell,88pm860x-tsi-prebias", &data)) {
151151
ret = pm860x_reg_write(i2c, PM8607_TSI_PREBIAS, data);
152152
if (ret < 0)
153-
return -EINVAL;
153+
goto err_put_node;
154154
}
155155
/* set prebias & prechg time of pen detect */
156156
data = 0;
@@ -161,10 +161,18 @@ static int pm860x_touch_dt_init(struct platform_device *pdev,
161161
if (data) {
162162
ret = pm860x_reg_write(i2c, PM8607_PD_PREBIAS, data);
163163
if (ret < 0)
164-
return -EINVAL;
164+
goto err_put_node;
165165
}
166166
of_property_read_u32(np, "marvell,88pm860x-resistor-X", res_x);
167+
168+
of_node_put(np);
169+
167170
return 0;
171+
172+
err_put_node:
173+
of_node_put(np);
174+
175+
return -EINVAL;
168176
}
169177
#else
170178
#define pm860x_touch_dt_init(x, y, z) (-1)

‎drivers/input/touchscreen/of_touchscreen.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
#include <linux/input.h>
1414
#include <linux/input/mt.h>
1515
#include <linux/input/touchscreen.h>
16+
#include <linux/module.h>
1617

1718
static bool touchscreen_get_prop_u32(struct device *dev,
1819
const char *property,
@@ -185,3 +186,6 @@ void touchscreen_report_pos(struct input_dev *input,
185186
input_report_abs(input, multitouch ? ABS_MT_POSITION_Y : ABS_Y, y);
186187
}
187188
EXPORT_SYMBOL(touchscreen_report_pos);
189+
190+
MODULE_LICENSE("GPL v2");
191+
MODULE_DESCRIPTION("Device-tree helpers functions for touchscreen devices");

0 commit comments

Comments
 (0)