Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:
"Fixes to the Synaptics RMI4 driver and fix for use after free in error
path handling of the Cypress TTSP driver"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: cyttsp4_core - fix use after free bug
Input: synaptics-rmi4 - clear IRQ enables for F54
Input: synaptics-rmi4 - remove unused result_bits mask
Input: synaptics-rmi4 - do not consume more data than we have (F11, F12)
Input: synaptics-rmi4 - disable the relative position IRQ in the F12 driver
Input: synaptics-rmi4 - fix video buffer size
+33
-19
+3
-6
drivers/input/rmi4/rmi_f11.c
+3
-6
drivers/input/rmi4/rmi_f11.c
···
510
510
struct rmi_2d_sensor_platform_data sensor_pdata;
511
511
unsigned long *abs_mask;
512
512
unsigned long *rel_mask;
513
-
unsigned long *result_bits;
514
513
};
515
514
516
515
enum f11_finger_state {
···
1056
1057
/*
1057
1058
** init instance data, fill in values and create any sysfs files
1058
1059
*/
1059
-
f11 = devm_kzalloc(&fn->dev, sizeof(struct f11_data) + mask_size * 3,
1060
+
f11 = devm_kzalloc(&fn->dev, sizeof(struct f11_data) + mask_size * 2,
1060
1061
GFP_KERNEL);
1061
1062
if (!f11)
1062
1063
return -ENOMEM;
···
1075
1076
+ sizeof(struct f11_data));
1076
1077
f11->rel_mask = (unsigned long *)((char *)f11
1077
1078
+ sizeof(struct f11_data) + mask_size);
1078
-
f11->result_bits = (unsigned long *)((char *)f11
1079
-
+ sizeof(struct f11_data) + mask_size * 2);
1080
1079
1081
1080
set_bit(fn->irq_pos, f11->abs_mask);
1082
1081
set_bit(fn->irq_pos + 1, f11->rel_mask);
···
1281
1284
valid_bytes = f11->sensor.attn_size;
1282
1285
memcpy(f11->sensor.data_pkt, drvdata->attn_data.data,
1283
1286
valid_bytes);
1284
-
drvdata->attn_data.data += f11->sensor.attn_size;
1285
-
drvdata->attn_data.size -= f11->sensor.attn_size;
1287
+
drvdata->attn_data.data += valid_bytes;
1288
+
drvdata->attn_data.size -= valid_bytes;
1286
1289
} else {
1287
1290
error = rmi_read_block(rmi_dev,
1288
1291
data_base_addr, f11->sensor.data_pkt,
+28
-4
drivers/input/rmi4/rmi_f12.c
+28
-4
drivers/input/rmi4/rmi_f12.c
···
55
55
56
56
const struct rmi_register_desc_item *data15;
57
57
u16 data15_offset;
58
+
59
+
unsigned long *abs_mask;
60
+
unsigned long *rel_mask;
58
61
};
59
62
60
63
static int rmi_f12_read_sensor_tuning(struct f12_data *f12)
···
212
209
valid_bytes = sensor->attn_size;
213
210
memcpy(sensor->data_pkt, drvdata->attn_data.data,
214
211
valid_bytes);
215
-
drvdata->attn_data.data += sensor->attn_size;
216
-
drvdata->attn_data.size -= sensor->attn_size;
212
+
drvdata->attn_data.data += valid_bytes;
213
+
drvdata->attn_data.size -= valid_bytes;
217
214
} else {
218
215
retval = rmi_read_block(rmi_dev, f12->data_addr,
219
216
sensor->data_pkt, sensor->pkt_size);
···
294
291
static int rmi_f12_config(struct rmi_function *fn)
295
292
{
296
293
struct rmi_driver *drv = fn->rmi_dev->driver;
294
+
struct f12_data *f12 = dev_get_drvdata(&fn->dev);
295
+
struct rmi_2d_sensor *sensor;
297
296
int ret;
298
297
299
-
drv->set_irq_bits(fn->rmi_dev, fn->irq_mask);
298
+
sensor = &f12->sensor;
299
+
300
+
if (!sensor->report_abs)
301
+
drv->clear_irq_bits(fn->rmi_dev, f12->abs_mask);
302
+
else
303
+
drv->set_irq_bits(fn->rmi_dev, f12->abs_mask);
304
+
305
+
drv->clear_irq_bits(fn->rmi_dev, f12->rel_mask);
300
306
301
307
ret = rmi_f12_write_control_regs(fn);
302
308
if (ret)
···
327
315
struct rmi_device_platform_data *pdata = rmi_get_platform_data(rmi_dev);
328
316
struct rmi_driver_data *drvdata = dev_get_drvdata(&rmi_dev->dev);
329
317
u16 data_offset = 0;
318
+
int mask_size;
330
319
331
320
rmi_dbg(RMI_DEBUG_FN, &fn->dev, "%s\n", __func__);
321
+
322
+
mask_size = BITS_TO_LONGS(drvdata->irq_count) * sizeof(unsigned long);
332
323
333
324
ret = rmi_read(fn->rmi_dev, query_addr, &buf);
334
325
if (ret < 0) {
···
347
332
return -ENODEV;
348
333
}
349
334
350
-
f12 = devm_kzalloc(&fn->dev, sizeof(struct f12_data), GFP_KERNEL);
335
+
f12 = devm_kzalloc(&fn->dev, sizeof(struct f12_data) + mask_size * 2,
336
+
GFP_KERNEL);
351
337
if (!f12)
352
338
return -ENOMEM;
339
+
340
+
f12->abs_mask = (unsigned long *)((char *)f12
341
+
+ sizeof(struct f12_data));
342
+
f12->rel_mask = (unsigned long *)((char *)f12
343
+
+ sizeof(struct f12_data) + mask_size);
344
+
345
+
set_bit(fn->irq_pos, f12->abs_mask);
346
+
set_bit(fn->irq_pos + 1, f12->rel_mask);
353
347
354
348
f12->has_dribble = !!(buf & BIT(3));
355
349
+2
-2
drivers/input/rmi4/rmi_f54.c
+2
-2
drivers/input/rmi4/rmi_f54.c
···
359
359
static const struct vb2_queue rmi_f54_queue = {
360
360
.type = V4L2_BUF_TYPE_VIDEO_CAPTURE,
361
361
.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF | VB2_READ,
362
-
.buf_struct_size = sizeof(struct vb2_buffer),
362
+
.buf_struct_size = sizeof(struct vb2_v4l2_buffer),
363
363
.ops = &rmi_f54_queue_ops,
364
364
.mem_ops = &vb2_vmalloc_memops,
365
365
.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC,
···
601
601
{
602
602
struct rmi_driver *drv = fn->rmi_dev->driver;
603
603
604
-
drv->set_irq_bits(fn->rmi_dev, fn->irq_mask);
604
+
drv->clear_irq_bits(fn->rmi_dev, fn->irq_mask);
605
605
606
606
return 0;
607
607
}
-7
drivers/input/touchscreen/cyttsp4_core.c
-7
drivers/input/touchscreen/cyttsp4_core.c
···
1990
1990
1991
1991
/* get sysinfo */
1992
1992
md->si = &cd->sysinfo;
1993
-
if (!md->si) {
1994
-
dev_err(dev, "%s: Fail get sysinfo pointer from core p=%p\n",
1995
-
__func__, md->si);
1996
-
goto error_get_sysinfo;
1997
-
}
1998
1993
1999
1994
rc = cyttsp4_setup_input_device(cd);
2000
1995
if (rc)
···
1999
2004
2000
2005
error_init_input:
2001
2006
input_free_device(md->input);
2002
-
error_get_sysinfo:
2003
-
input_set_drvdata(md->input, NULL);
2004
2007
error_alloc_failed:
2005
2008
dev_err(dev, "%s failed.\n", __func__);
2006
2009
return rc;