Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:
- fix gtco tablet driver, tightening parsing of HID descriptors
- add ACPI ID added to Elan driver to be able to handle touchpads found
in Lenovo Ideapad 320/520
- fix the Symaptics RMI4 driver to adjust handling of buttons
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: synaptics-rmi4 - limit the range of what GPIOs are buttons
Input: gtco - fix potential out-of-bound access
Input: elan_i2c - add ELAN0611 to the ACPI table
+14
-9
+1
drivers/input/mouse/elan_i2c_core.c
+1
drivers/input/mouse/elan_i2c_core.c
+3
-2
drivers/input/rmi4/rmi_f30.c
+3
-2
drivers/input/rmi4/rmi_f30.c
···
232
232
unsigned int trackstick_button = BTN_LEFT;
233
233
bool button_mapped = false;
234
234
int i;
235
+
int button_count = min_t(u8, f30->gpioled_count, TRACKSTICK_RANGE_END);
235
236
236
237
f30->gpioled_key_map = devm_kcalloc(&fn->dev,
237
-
f30->gpioled_count,
238
+
button_count,
238
239
sizeof(f30->gpioled_key_map[0]),
239
240
GFP_KERNEL);
240
241
if (!f30->gpioled_key_map) {
···
243
242
return -ENOMEM;
244
243
}
245
244
246
-
for (i = 0; i < f30->gpioled_count; i++) {
245
+
for (i = 0; i < button_count; i++) {
247
246
if (!rmi_f30_is_valid_button(i, f30->ctrl))
248
247
continue;
249
248
+10
-7
drivers/input/tablet/gtco.c
+10
-7
drivers/input/tablet/gtco.c
···
230
230
231
231
/* Walk this report and pull out the info we need */
232
232
while (i < length) {
233
-
prefix = report[i];
234
-
235
-
/* Skip over prefix */
236
-
i++;
233
+
prefix = report[i++];
237
234
238
235
/* Determine data size and save the data in the proper variable */
239
-
size = PREF_SIZE(prefix);
236
+
size = (1U << PREF_SIZE(prefix)) >> 1;
237
+
if (i + size > length) {
238
+
dev_err(ddev,
239
+
"Not enough data (need %d, have %d)\n",
240
+
i + size, length);
241
+
break;
242
+
}
243
+
240
244
switch (size) {
241
245
case 1:
242
246
data = report[i];
···
248
244
case 2:
249
245
data16 = get_unaligned_le16(&report[i]);
250
246
break;
251
-
case 3:
252
-
size = 4;
247
+
case 4:
253
248
data32 = get_unaligned_le32(&report[i]);
254
249
break;
255
250
}