linux.git/drivers/input/misc, branch v3.10.103

Input: uinput - handle compat ioctl for UI_SET_PHYS

2016-08-21T21:22:42+00:00

commit affa80bd97f7ca282d1faa91667b3ee9e4c590e6 upstream.

When running a 32-bit userspace on a 64-bit kernel, the UI_SET_PHYS
ioctl needs to be treated with special care, as it has the pointer
size encoded in the command.

Signed-off-by: Ricky Liang 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Willy Tarreau

Input: max8997-haptic - fix NULL pointer dereference

2016-06-07T08:42:53+00:00

commit 6ae645d5fa385f3787bf1723639cd907fe5865e7 upstream.

NULL pointer derefence happens when booting with DTB because the
platform data for haptic device is not set in supplied data from parent
MFD device.

The MFD device creates only platform data (from Device Tree) for itself,
not for haptic child.

Unable to handle kernel NULL pointer dereference at virtual address 0000009c
pgd = c0004000
	[0000009c] *pgd=00000000
	Internal error: Oops: 5 [#1] PREEMPT SMP ARM
	(max8997_haptic_probe) from [] (platform_drv_probe+0x4c/0xb0)
	(platform_drv_probe) from [] (driver_probe_device+0x214/0x2c0)
	(driver_probe_device) from [] (__driver_attach+0xac/0xb0)
	(__driver_attach) from [] (bus_for_each_dev+0x68/0x9c)
	(bus_for_each_dev) from [] (bus_add_driver+0x1a0/0x218)
	(bus_add_driver) from [] (driver_register+0x78/0xf8)
	(driver_register) from [] (do_one_initcall+0x90/0x1d8)
	(do_one_initcall) from [] (kernel_init_freeable+0x15c/0x1fc)
	(kernel_init_freeable) from [] (kernel_init+0x8/0x114)
	(kernel_init) from [] (ret_from_fork+0x14/0x3c)

Signed-off-by: Marek Szyprowski 
Cc: 
Fixes: 104594b01ce7 ("Input: add driver support for MAX8997-haptic")
[k.kozlowski: Write commit message, add CC-stable]
Signed-off-by: Krzysztof Kozlowski 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Willy Tarreau

Input: ati_remote2 - fix crashes on detecting device with invalid descriptor

2016-06-07T08:42:47+00:00

commit 950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d upstream.

The ati_remote2 driver expects at least two interfaces with one
endpoint each. If given malicious descriptor that specify one
interface or no endpoints, it will crash in the probe function.
Ensure there is at least two interfaces and one endpoint for each
interface before using it.

The full disclosure: http://seclists.org/bugtraq/2016/Mar/90

Reported-by: Ralf Spenneberg 
Signed-off-by: Vladis Dronov 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Willy Tarreau

Input: ims-pcu - sanity check against missing interfaces

2016-06-07T08:42:47+00:00

commit a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff upstream.

A malicious device missing interface can make the driver oops.
Add sanity checking.

Signed-off-by: Oliver Neukum 
CC: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Willy Tarreau

Input: powermate - fix oops with malicious USB descriptors

2016-06-07T08:42:46+00:00

commit 9c6ba456711687b794dcf285856fc14e2c76074f upstream.

The powermate driver expects at least one valid USB endpoint in its
probe function.  If given malicious descriptors that specify 0 for
the number of endpoints, it will crash.  Validate the number of
endpoints on the interface before using them.

The full report for this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/85

Reported-by: Ralf Spenneberg 
Cc: stable 
Signed-off-by: Josh Boyer 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Willy Tarreau

Input - arizona-haptics: Fix double lock of dapm_mutex

2014-03-07T05:30:12+00:00

commit c4204960e9d0ba99459dbf1db918f99a45e7a62a upstream.

snd_soc_dapm_sync takes the dapm_mutex internally, but we currently take
it externally as well. This patch fixes this.

Signed-off-by: Charles Keepax 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'gpio-for-linus' of git://git.secretlab.ca/git/linux

2013-05-09T16:59:16+00:00

Pull removal of GENERIC_GPIO from Grant Likely:
 "GENERIC_GPIO now synonymous with GPIOLIB.  There are no longer any
  valid cases for enableing GENERIC_GPIO without GPIOLIB, even though it
  is possible to do so which has been causing confusion and breakage.
  This branch does the work to completely eliminate GENERIC_GPIO."

* tag 'gpio-for-linus' of git://git.secretlab.ca/git/linux:
  gpio: update gpio Chinese documentation
  Remove GENERIC_GPIO config option
  Convert selectors of GENERIC_GPIO to GPIOLIB
  blackfin: force use of gpiolib
  m68k: coldfire: use gpiolib
  mips: pnx833x: remove requirement for GENERIC_GPIO
  openrisc: default GENERIC_GPIO to false
  avr32: default GENERIC_GPIO to false
  xtensa: remove explicit selection of GENERIC_GPIO
  sh: replace CONFIG_GENERIC_GPIO by CONFIG_GPIOLIB
  powerpc: remove redundant GENERIC_GPIO selection
  unicore32: default GENERIC_GPIO to false
  unicore32: remove unneeded select GENERIC_GPIO
  arm: plat-orion: use GPIO driver on CONFIG_GPIOLIB
  arm: remove redundant GENERIC_GPIO selection
  mips: alchemy: require gpiolib
  mips: txx9: change GENERIC_GPIO to GPIOLIB
  mips: loongson: use GPIO driver on CONFIG_GPIOLIB
  mips: remove redundant GENERIC_GPIO select

input: single_open() leak

2013-05-05T04:12:56+00:00

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-05-02T00:51:54+00:00

Pull VFS updates from Al Viro,

Misc cleanups all over the place, mainly wrt /proc interfaces (switch
create_proc_entry to proc_create(), get rid of the deprecated
create_proc_read_entry() in favor of using proc_create_data() and
seq_file etc).

7kloc removed.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (204 commits)
  don't bother with deferred freeing of fdtables
  proc: Move non-public stuff from linux/proc_fs.h to fs/proc/internal.h
  proc: Make the PROC_I() and PDE() macros internal to procfs
  proc: Supply a function to remove a proc entry by PDE
  take cgroup_open() and cpuset_open() to fs/proc/base.c
  ppc: Clean up scanlog
  ppc: Clean up rtas_flash driver somewhat
  hostap: proc: Use remove_proc_subtree()
  drm: proc: Use remove_proc_subtree()
  drm: proc: Use minor->index to label things, not PDE->name
  drm: Constify drm_proc_list[]
  zoran: Don't print proc_dir_entry data in debug
  reiserfs: Don't access the proc_dir_entry in r_open(), r_start() r_show()
  proc: Supply an accessor for getting the data from a PDE's parent
  airo: Use remove_proc_subtree()
  rtl8192u: Don't need to save device proc dir PDE
  rtl8187se: Use a dir under /proc/net/r8180/
  proc: Add proc_mkdir_data()
  proc: Move some bits from linux/proc_fs.h to linux/{of.h,signal.h,tty.h}
  proc: Move PDE_NET() to fs/proc/proc_net.c
  ...

hp_sdc_rtc: Don't use create_proc_read_entry()

2013-04-29T19:41:54+00:00

Don't use create_proc_read_entry() as that is deprecated, but rather use
proc_create_data() and seq_file instead.

Signed-off-by: David Howells 
cc: Brian S. Julin 
cc: Helge Deller 
cc: linux-m68k@lists.linux-m68k.org
Signed-off-by: Al Viro