linux.git/drivers/input/misc, branch v3.16.81

Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD

2019-10-05T15:19:45+00:00

commit 7c7da40da1640ce6814dab1e8031b44e19e5a3f6 upstream.

In the case of compat syscall ioctl numbers for UI_BEGIN_FF_UPLOAD and
UI_END_FF_UPLOAD need to be adjusted before being passed on
uinput_ioctl_handler() since code built with -m32 will be passing
slightly different values. Extend the code already covering
UI_SET_PHYS to cover UI_BEGIN_FF_UPLOAD and UI_END_FF_UPLOAD as well.

Reported-by: Pierre-Loup A. Griffais 
Signed-off-by: Andrey Smirnov 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: bma150 - register input device after setting private data

2019-05-02T20:41:40+00:00

commit 90cc55f067f6ca0e64e5e52883ece47d8af7b67b upstream.

Otherwise we introduce a race condition where userspace can request input
before we're ready leading to null pointer dereference such as

input: bma150 as /devices/platform/i2c-gpio-2/i2c-5/5-0038/input/input3
Unable to handle kernel NULL pointer dereference at virtual address 00000018
pgd = (ptrval)
[00000018] *pgd=55dac831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] PREEMPT ARM
Modules linked in: bma150 input_polldev [last unloaded: bma150]
CPU: 0 PID: 2870 Comm: accelerometer Not tainted 5.0.0-rc3-dirty #46
Hardware name: Samsung S5PC110/S5PV210-based board
PC is at input_event+0x8/0x60
LR is at bma150_report_xyz+0x9c/0xe0 [bma150]
pc : [<80450f70>]    lr : [<7f0a614c>]    psr: 800d0013
sp : a4c1fd78  ip : 00000081  fp : 00020000
r10: 00000000  r9 : a5e2944c  r8 : a7455000
r7 : 00000016  r6 : 00000101  r5 : a7617940  r4 : 80909048
r3 : fffffff2  r2 : 00000000  r1 : 00000003  r0 : 00000000
Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 10c5387d  Table: 54e34019  DAC: 00000051
Process accelerometer (pid: 2870, stack limit = 0x(ptrval))
Stackck: (0xa4c1fd78 to 0xa4c20000)
fd60:                                                       fffffff3 fc813f6c
fd80: 40410581 d7530ce3 a5e2817c a7617f00 a5e29404 a5e2817c 00000000 7f008324
fda0: a5e28000 8044f59c a5fdd9d0 a5e2945c a46a4a00 a5e29668 a7455000 80454f10
fdc0: 80909048 a5e29668 a5fdd9d0 a46a4a00 806316d0 00000000 a46a4a00 801df5f0
fde0: 00000000 d7530ce3 a4c1fec0 a46a4a00 00000000 a5fdd9d0 a46a4a08 801df53c
fe00: 00000000 801d74bc a4c1fec0 00000000 a4c1ff70 00000000 a7038da8 00000000
fe20: a46a4a00 801e91fc a411bbe0 801f2e88 00000004 00000000 80909048 00000041
fe40: 00000000 00020000 00000000 dead4ead a6a88da0 00000000 ffffe000 806fcae8
fe60: a4c1fec8 00000000 80909048 00000002 a5fdd9d0 a7660110 a411bab0 00000001
fe80: dead4ead ffffffff ffffffff a4c1fe8c a4c1fe8c d7530ce3 20000013 80909048
fea0: 80909048 a4c1ff70 00000001 fffff000 a4c1e000 00000005 00026038 801eabd8
fec0: a7660110 a411bab0 b9394901 00000006 a696201b 76fb3000 00000000 a7039720
fee0: a5fdd9d0 00000101 00000002 00000096 00000000 00000000 00000000 a4c1ff00
ff00: a6b310f4 805cb174 a6b310f4 00000010 00000fe0 00000010 a4c1e000 d7530ce3
ff20: 00000003 a5f41400 a5f41424 00000000 a6962000 00000000 00000003 00000002
ff40: ffffff9c 000a0000 80909048 d7530ce3 a6962000 00000003 80909048 ffffff9c
ff60: a6962000 801d890c 00000000 00000000 00020000 a7590000 00000004 00000100
ff80: 00000001 d7530ce3 000288b8 00026320 000288b8 00000005 80101204 a4c1e000
ffa0: 00000005 80101000 000288b8 00026320 000288b8 000a0000 00000000 00000000
ffc0: 000288b8 00026320 000288b8 00000005 7eef3bac 000264e8 00028ad8 00026038
ffe0: 00000005 7eef3300 76f76e91 76f78546 800d0030 000288b8 00000000 00000000
[<80450f70>] (input_event) from [] (0xa5e2817c)
Code: e1a08148 eaffffa8 e351001f 812fff1e (e590c018)
---[ end trace 1c691ee85f2ff243 ]---

Signed-off-by: Jonathan Bakker 
Signed-off-by: Paweł Chmiel 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: twl6040-vibra - fix child-node lookup

2018-03-03T15:52:17+00:00

commit dcaf12a8b0bbdbfcfa2be8dff2c4948d9844b4ad upstream.

Fix child-node lookup during probe, which ended up searching the whole
device tree depth-first starting at parent rather than just matching on
its children.

Later sanity checks on node properties (which would likely be missing)
should prevent this from causing much trouble however, especially as the
original premature free of the parent node has already been fixed
separately (but that "fix" was apparently never backported to stable).

Fixes: e7ec014a47e4 ("Input: twl6040-vibra - update for device tree support")
Fixes: c52c545ead97 ("Input: twl6040-vibra - fix DT node memory management")
Signed-off-by: Johan Hovold 
Acked-by: Peter Ujfalusi 
Tested-by: H. Nikolaus Schaller  (on Pyra OMAP5 hardware)
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: twl6040-vibra - fix DT node memory management

2018-03-03T15:52:17+00:00

commit c52c545ead97fcc2f4f8ea38f1ae3c23211e09a8 upstream.

commit e7ec014a47e4 ("Input: twl6040-vibra - update for device tree support")

made the separate vibra DT node to a subnode of the twl6040.

It now calls of_find_node_by_name() to locate the "vibra" subnode.
This function has a side effect to call of_node_put on() for the twl6040
parent node passed in as a parameter. This causes trouble later on.

Solution: we must call of_node_get() before of_find_node_by_name()

Signed-off-by: H. Nikolaus Schaller 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: twl4030-vibra - fix sibling-node lookup

2018-03-03T15:52:17+00:00

commit 5b189201993ab03001a398de731045bfea90c689 upstream.

A helper purported to look up a child node based on its name was using
the wrong of-helper and ended up prematurely freeing the parent of-node
while searching the whole device tree depth-first starting at the parent
node.

Fixes: 64b9e4d803b1 ("input: twl4030-vibra: Support for DT booted kernel")
Fixes: e661d0a04462 ("Input: twl4030-vibra - fix ERROR: Bad of_node_put() warning")
Signed-off-by: Johan Hovold 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: twl4030-vibra - fix ERROR: Bad of_node_put() warning

2018-03-03T15:52:16+00:00

commit e661d0a04462dd98667f8947141bd8defab5b34a upstream.

Fix following:
[    8.862274] ERROR: Bad of_node_put() on /ocp/i2c@48070000/twl@48/audio
[    8.869293] CPU: 0 PID: 1003 Comm: modprobe Not tainted 4.2.0-rc2-letux+ #1175
[    8.876922] Hardware name: Generic OMAP36xx (Flattened Device Tree)
[    8.883514] [] (unwind_backtrace) from [] (show_stack+0x10/0x14)
[    8.891693] [] (show_stack) from [] (dump_stack+0x78/0x94)
[    8.899322] [] (dump_stack) from [] (kobject_release+0x68/0x7c)
[    8.907409] [] (kobject_release) from [] (twl4030_vibra_probe+0x74/0x188 [twl4030_vibra])
[    8.917877] [] (twl4030_vibra_probe [twl4030_vibra]) from [] (platform_drv_probe+0x48/0x90)
[    8.928497] [] (platform_drv_probe) from [] (really_probe+0xd4/0x238)
[    8.937103] [] (really_probe) from [] (driver_probe_device+0x30/0x48)
[    8.945678] [] (driver_probe_device) from [] (__driver_attach+0x68/0x8c)
[    8.954589] [] (__driver_attach) from [] (bus_for_each_dev+0x50/0x84)
[    8.963226] [] (bus_for_each_dev) from [] (bus_add_driver+0xcc/0x1e4)
[    8.971832] [] (bus_add_driver) from [] (driver_register+0x9c/0xe0)
[    8.980255] [] (driver_register) from [] (do_one_initcall+0x100/0x1b8)
[    8.988983] [] (do_one_initcall) from [] (do_init_module+0x58/0x1c0)
[    8.997497] [] (do_init_module) from [] (SyS_init_module+0x54/0x64)
[    9.005950] [] (SyS_init_module) from [] (ret_fast_syscall+0x0/0x54)
[    9.015838] input: twl4030:vibrator as /devices/platform/68000000.ocp/48070000.i2c/i2c-0/0-0048/48070000.i2c:twl@48:audio/input/input2

node passed to of_find_node_by_name is put inside that function and new node
is returned if found. Free returned node not already freed node.

Signed-off-by: Marek Belisko 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: adxl34x - do not treat FIFO_MODE() as boolean

2018-02-13T18:42:02+00:00

commit 1dbc080c9ef6bcfba652ef0d6ae919b8c7c85a1d upstream.

FIFO_MODE() is a macro expression with a '<<' operator, which gcc points
out could be misread as a '<':

drivers/input/misc/adxl34x.c: In function 'adxl34x_probe':
drivers/input/misc/adxl34x.c:799:36: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context]

While utility of this warning is being disputed (Chief Penguin: "This
warning is clearly pure garbage.") FIFO_MODE() extracts range of values,
with 0 being FIFO_BYPASS, and not something that is logically boolean.

This converts the test to an explicit comparison with FIFO_BYPASS,
making it clearer to gcc and the reader what is intended.

Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: ims-psu - check if CDC union descriptor is sane

2018-01-01T20:52:08+00:00

commit ea04efee7635c9120d015dcdeeeb6988130cb67a upstream.

Before trying to use CDC union descriptor, try to validate whether that it
is sane by checking that intf->altsetting->extra is big enough and that
descriptor bLength is not too big and not too small.

Reported-by: Andrey Konovalov 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: uinput - avoid crash when sending FF request to device going away

2018-01-01T20:51:36+00:00

commit 6b4877c7bdc6ae39ce03716df7caeecf204697eb upstream.

If FF request comes in while uinput device is going away,
uinput_request_send() will fail with -ENODEV, and uinput_request_submit()
will attempt to mark the slot as unused by calling uinput_request_done().
Unfortunately in this case we haven't initialized request->done completion
yet, and we get a crash:

[   39.402036] BUG: spinlock bad magic on CPU#1, fftest/3108
[   39.402046]  lock: 0xffff88006a93bb00, .magic: 00000000, .owner: /39, .owner_cpu: 1217155072
[   39.402055] CPU: 1 PID: 3108 Comm: fftest Tainted: G        W 4.13.0+ #15
[   39.402059] Hardware name: LENOVO 20HQS0EG02/20HQS0EG02, BIOS N1MET37W (1.22 ) 07/04/2017
[   39.402064]  0000000000000086 f0fad82f3ceaa120 ffff88006a93b9a0 ffffffff9de941bb
[   39.402077]  ffff88026df8ae00 ffff88006a93bb00 ffff88006a93b9c0 ffffffff9dca62b7
[   39.402088]  ffff88006a93bb00 ffff88006a93baf8 ffff88006a93b9e0 ffffffff9dca62e7
[   39.402099] Call Trace:
[   39.402112]  [] dump_stack+0x4d/0x63
[   39.402123]  [] spin_dump+0x97/0x9c
[   39.402130]  [] spin_bug+0x2b/0x2d
[   39.402138]  [] do_raw_spin_lock+0x28/0xfd
[   39.402147]  [] _raw_spin_lock_irqsave+0x19/0x1f
[   39.402154]  [] complete+0x1d/0x48
[   39.402162]  [] 0xffffffffc04f30af
[   39.402167]  [] 0xffffffffc04f468c
[   39.402177]  [] ? __slab_free+0x22f/0x359
[   39.402184]  [] ? tk_clock_read+0xc/0xe
[   39.402189]  [] 0xffffffffc04f471f
[   39.402195]  [] ? __wake_up+0x44/0x4b
[   39.402200]  [] ? 0xffffffffc04f3240
[   39.402207]  [] erase_effect+0xa1/0xd2
[   39.402214]  [] input_ff_flush+0x43/0x5c
[   39.402219]  [] 0xffffffffc04f32ad
[   39.402227]  [] input_flush_device+0x3d/0x51
[   39.402234]  [] evdev_flush+0x49/0x5c
[   39.402243]  [] filp_close+0x3f/0x65
[   39.402253]  [] put_files_struct+0x66/0xc1
[   39.402261]  [] exit_files+0x47/0x4e
[   39.402270]  [] do_exit+0x483/0x969
[   39.402278]  [] ? recalc_sigpending_tsk+0x3d/0x44
[   39.402285]  [] do_group_exit+0x42/0xb0
[   39.402293]  [] get_signal+0x58d/0x5bf
[   39.402300]  [] do_signal+0x37/0x53e
[   39.402307]  [] ? evdev_ioctl_handler+0xac8/0xb04
[   39.402314]  [] ? evdev_ioctl+0x10/0x12
[   39.402321]  [] ? do_vfs_ioctl+0x42e/0x501
[   39.402328]  [] prepare_exit_to_usermode+0x66/0x90
[   39.402333]  [] syscall_return_slowpath+0xe3/0xec
[   39.402339]  [] int_ret_from_sys_call+0x25/0x8f

While we could solve this by simply initializing the completion earlier, we
are better off rearranging the code a bit so we avoid calling complete() on
requests that we did not send out. This patch consolidates marking request
slots as free in one place (in uinput_request_submit(), the same place
where we acquire them) and having everyone else simply signal completion
of the requests.

Fixes: 00ce756ce53a ("Input: uinput - mark failed submission requests as free")
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings

Input: uinput - avoid FF flush when destroying device

2018-01-01T20:51:36+00:00

commit e8b95728f724797f958912fd9b765a695595d3a6 upstream.

Normally, when input device supporting force feedback effects is being
destroyed, we try to "flush" currently playing effects, so that the
physical device does not continue vibrating (or executing other effects).
Unfortunately this does not work well for uinput as flushing of the effects
deadlocks with the destroy action:

- if device is being destroyed because the file descriptor is being closed,
  then there is noone to even service FF requests;

- if device is being destroyed because userspace sent UI_DEV_DESTROY,
  while theoretically it could be possible to service FF requests,
  userspace is unlikely to do so (they'd need to make sure FF handling
  happens on a separate thread) even if kernel solves the issue with FF
  ioctls deadlocking with UI_DEV_DESTROY ioctl on udev->mutex.

To avoid lockups like the one below, let's install a custom input device
flush handler, and avoid trying to flush force feedback effects when we
destroying the device, and instead rely on uinput to shut off the device
properly.

NMI watchdog: Watchdog detected hard LOCKUP on cpu 3
...
 <>  [] _raw_spin_lock_irqsave+0x37/0x40
 [] complete+0x1d/0x50
 [] uinput_request_done+0x3c/0x40 [uinput]
 [] uinput_request_submit.part.7+0x47/0xb0 [uinput]
 [] uinput_dev_erase_effect+0x5b/0x76 [uinput]
 [] erase_effect+0xad/0xf0
 [] flush_effects+0x4d/0x90
 [] input_flush_device+0x40/0x60
 [] evdev_cleanup+0xac/0xc0
 [] evdev_disconnect+0x2b/0x60
 [] __input_unregister_device+0xac/0x150
 [] input_unregister_device+0x47/0x70
 [] uinput_destroy_device+0xb5/0xc0 [uinput]
 [] uinput_ioctl_handler.isra.9+0x65e/0x740 [uinput]
 [] ? do_futex+0x12b/0xad0
 [] uinput_ioctl+0x18/0x20 [uinput]
 [] do_vfs_ioctl+0x298/0x480
 [] ? security_file_ioctl+0x43/0x60
 [] SyS_ioctl+0x79/0x90
 [] entry_SYSCALL_64_fastpath+0x12/0x71

Reported-by: Rodrigo Rivas Costa 
Reported-by: Clément VUCHENER 
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=193741
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Ben Hutchings