leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

for-linus-2022083101

Browse Source 
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIVAwUAYw88R6Zi849r7WBJAQIXvQ/9EceSzn/m8bUV01Pzf6wmJs/vKprm0BJt
 6MPON2bDlBDVn2GgivoA7+Kya7awAyE+4498djR/Qg6W3MX3yp6x6/aD6jj0bZrR
 GV2quGw9MiShydOosFcBVoYy5TFgUS3F8otQ3sf8uJMlyzt7I7b9hsnY1MbkG9He
 hhGNBuzVw07OPQnSm6hebqrpfOZUsFVqxzjhzrcYkq35bnMiIyx9hYypdld77tSp
 9w1BGcxk//i7SIo7wLoHqPg2xnC4yxwdspim/dLy91twqnJAAbQlnQeDcmlhe03G
 IeBfvLEyatQ7A/lFzFQkssRKyxfnvvrNOrSvj5T3TeaHDl0vUCWEB6n105MWEbHR
 YvgNywl8kAw/s6Abf+qQ3KQDcPyS5PMVJV2toNK64KLePaKnkkUyobROiHNMVKtQ
 /4Skv/8AQGua7XO6DeOPf9yEM8JO1uHtpcNoOJn6vkBGNiI4NfYOx126LMO879gp
 darAowkN13fLbhUHyeQ4SsXB/inM6RxaR977Lx685I54S5JjYtYaGZ3BNzcj7w7D
 c07uNG74FWJG5ZWY2/34I/p3UocsYY7JnbKqaJp9WtWl1OxXRMraSfI9oMeAHRXD
 Mq/vuu2kVybUYOKsLimBlodMBcaptH5L4CX7zE1vv3LBD7dAy3uhIf0CrCVmrpC7
 rvcKioCNaPQ=
 =ckOe
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-2022083101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

Pull HID fixes from Jiri Kosina:

 - NULL pointer dereference fix for Steam driver (Lee Jones)

 - memory leak fix for hidraw (Karthik Alapati)

 - regression fix for functionality of some UCLogic tables (Benjamin
   Tissoires)

 - a few new device IDs and device-specific quirks

* tag 'for-linus-2022083101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: nintendo: fix rumble worker null pointer deref
  HID: intel-ish-hid: ipc: Add Meteor Lake PCI device ID
  HID: input: fix uclogic tablets
  HID: Add Apple Touchbar on T2 Macs in hid_have_special_driver list
  HID: add Lenovo Yoga C630 battery quirk
  HID: AMD_SFH: Add a DMI quirk entry for Chromebooks
  HID: thrustmaster: Add sparco wheel and fix array length
  hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message
  HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo
  HID: asus: ROG NKey: Ignore portion of 0x5a report
  HID: hidraw: fix memory leak in hidraw_release()
  HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
This commit is contained in:
Linus Torvalds 2022-08-31 09:54:14 -07:00
commit a1f764268f
13 changed files with 96 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
View File

@ -288,11 +288,29 @@ int amd_sfh_irq_init(struct amd_mp2_dev *privdata)
return 0;
}
static const struct dmi_system_id dmi_nodevs[] = {
{
/*
* Google Chromebooks use Chrome OS Embedded Controller Sensor
* Hub instead of Sensor Hub Fusion and leaves MP2
* uninitialized, which disables all functionalities, even
* including the registers necessary for feature detections.
*/
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "Google"),
},
},
{ }
};
static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
{
struct amd_mp2_dev *privdata;
int rc;
if (dmi_first_match(dmi_nodevs))
return -ENODEV;
privdata = devm_kzalloc(&pdev->dev, sizeof(*privdata), GFP_KERNEL);
if (!privdata)
return -ENOMEM;

7
drivers/hid/hid-asus.c
View File

@ -1212,6 +1212,13 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc,
rdesc = new_rdesc;
}
if (drvdata->quirks & QUIRK_ROG_NKEY_KEYBOARD &&
*rsize == 331 && rdesc[190] == 0x85 && rdesc[191] == 0x5a &&
rdesc[204] == 0x95 && rdesc[205] == 0x05) {
hid_info(hdev, "Fixing up Asus N-KEY keyb report descriptor\n");
rdesc[205] = 0x01;
}
return rdesc;
}

3
drivers/hid/hid-ids.h
View File

@ -185,6 +185,8 @@
#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021 0x029c
#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021 0x029a
#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2021 0x029f
#define USB_DEVICE_ID_APPLE_TOUCHBAR_BACKLIGHT 0x8102
#define USB_DEVICE_ID_APPLE_TOUCHBAR_DISPLAY 0x8302
#define USB_VENDOR_ID_ASUS 0x0486
#define USB_DEVICE_ID_ASUS_T91MT 0x0185
@ -414,6 +416,7 @@
#define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN 0x2706
#define I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN 0x261A
#define I2C_DEVICE_ID_SURFACE_GO2_TOUCHSCREEN 0x2A1C
#define I2C_DEVICE_ID_LENOVO_YOGA_C630_TOUCHSCREEN 0x279F
#define USB_VENDOR_ID_ELECOM 0x056e
#define USB_DEVICE_ID_ELECOM_BM084 0x0061

7
drivers/hid/hid-input.c
View File

@ -383,6 +383,8 @@ static const struct hid_device_id hid_battery_quirks[] = {
HID_BATTERY_QUIRK_IGNORE },
{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO2_TOUCHSCREEN),
HID_BATTERY_QUIRK_IGNORE },
{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_LENOVO_YOGA_C630_TOUCHSCREEN),
HID_BATTERY_QUIRK_IGNORE },
{}
};
@ -1532,7 +1534,10 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
* assume ours
*/
if (!report->tool)
hid_report_set_tool(report, input, usage->code);
report->tool = usage->code;
/* drivers may have changed the value behind our back, resend it */
hid_report_set_tool(report, input, report->tool);
} else {
hid_report_release_tool(report, input, usage->code);
}

6
drivers/hid/hid-nintendo.c
View File

@ -1221,6 +1221,7 @@ static void joycon_parse_report(struct joycon_ctlr *ctlr,
spin_lock_irqsave(&ctlr->lock, flags);
if (IS_ENABLED(CONFIG_NINTENDO_FF) && rep->vibrator_report &&
ctlr->ctlr_state != JOYCON_CTLR_STATE_REMOVED &&
(msecs - ctlr->rumble_msecs) >= JC_RUMBLE_PERIOD_MS &&
(ctlr->rumble_queue_head != ctlr->rumble_queue_tail ||
ctlr->rumble_zero_countdown > 0)) {
@ -1545,12 +1546,13 @@ static int joycon_set_rumble(struct joycon_ctlr *ctlr, u16 amp_r, u16 amp_l,
ctlr->rumble_queue_head = 0;
memcpy(ctlr->rumble_data[ctlr->rumble_queue_head], data,
JC_RUMBLE_DATA_SIZE);
spin_unlock_irqrestore(&ctlr->lock, flags);
/* don't wait for the periodic send (reduces latency) */
if (schedule_now)
if (schedule_now && ctlr->ctlr_state != JOYCON_CTLR_STATE_REMOVED)
queue_work(ctlr->rumble_queue, &ctlr->rumble_worker);
spin_unlock_irqrestore(&ctlr->lock, flags);
return 0;
}

2
drivers/hid/hid-quirks.c
View File

@ -314,6 +314,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_TOUCHBAR_BACKLIGHT) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_TOUCHBAR_DISPLAY) },
#endif
#if IS_ENABLED(CONFIG_HID_APPLEIR)
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL) },

10
drivers/hid/hid-steam.c
View File

@ -134,6 +134,11 @@ static int steam_recv_report(struct steam_device *steam,
int ret;
r = steam->hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0];
if (!r) {
hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n");
return -EINVAL;
}
if (hid_report_len(r) < 64)
return -EINVAL;
@ -165,6 +170,11 @@ static int steam_send_report(struct steam_device *steam,
int ret;
r = steam->hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0];
if (!r) {
hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n");
return -EINVAL;
}
if (hid_report_len(r) < 64)
return -EINVAL;

3
drivers/hid/hid-thrustmaster.c
View File

@ -67,12 +67,13 @@ static const struct tm_wheel_info tm_wheels_infos[] = {
{0x0200, 0x0005, "Thrustmaster T300RS (Missing Attachment)"},
{0x0206, 0x0005, "Thrustmaster T300RS"},
{0x0209, 0x0005, "Thrustmaster T300RS (Open Wheel Attachment)"},
{0x020a, 0x0005, "Thrustmaster T300RS (Sparco R383 Mod)"},
{0x0204, 0x0005, "Thrustmaster T300 Ferrari Alcantara Edition"},
{0x0002, 0x0002, "Thrustmaster T500RS"}
//{0x0407, 0x0001, "Thrustmaster TMX"}
};
static const uint8_t tm_wheels_infos_length = 4;
static const uint8_t tm_wheels_infos_length = 7;
/*
* This structs contains (in little endian) the response data

2
drivers/hid/hidraw.c
View File

@ -350,6 +350,8 @@ static int hidraw_release(struct inode * inode, struct file * file)
down_write(&minors_rwsem);
spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
for (int i = list->tail; i < list->head; i++)
kfree(list->buffer[i].value);
list_del(&list->node);
spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
kfree(list);

1
drivers/hid/intel-ish-hid/ipc/hw-ish.h
View File

@ -32,6 +32,7 @@
#define ADL_P_DEVICE_ID 0x51FC
#define ADL_N_DEVICE_ID 0x54FC
#define RPL_S_DEVICE_ID 0x7A78
#define MTL_P_DEVICE_ID 0x7E45
#define REVISION_ID_CHT_A0 0x6
#define REVISION_ID_CHT_Ax_SI 0x0

1
drivers/hid/intel-ish-hid/ipc/pci-ish.c
View File

@ -43,6 +43,7 @@ static const struct pci_device_id ish_pci_tbl[] = {
{PCI_DEVICE(PCI_VENDOR_ID_INTEL, ADL_P_DEVICE_ID)},
{PCI_DEVICE(PCI_VENDOR_ID_INTEL, ADL_N_DEVICE_ID)},
{PCI_DEVICE(PCI_VENDOR_ID_INTEL, RPL_S_DEVICE_ID)},
{PCI_DEVICE(PCI_VENDOR_ID_INTEL, MTL_P_DEVICE_ID)},
{0, }
};
MODULE_DEVICE_TABLE(pci, ish_pci_tbl);

2
drivers/hid/intel-ish-hid/ishtp-hid.h
View File

@ -105,7 +105,7 @@ struct report_list {
* @multi_packet_cnt: Count of fragmented packet count
*
* This structure is used to store completion flags and per client data like
* like report description, number of HID devices etc.
* report description, number of HID devices etc.
*/
struct ishtp_cl_data {
/* completion flags */

68
drivers/hid/intel-ish-hid/ishtp/client.c
View File

@ -626,13 +626,14 @@ static void ishtp_cl_read_complete(struct ishtp_cl_rb *rb)
}
/**
* ipc_tx_callback() - IPC tx callback function
* ipc_tx_send() - IPC tx send function
* @prm: Pointer to client device instance
*
* Send message over IPC either first time or on callback on previous message
* completion
* Send message over IPC. Message will be split into fragments
* if message size is bigger than IPC FIFO size, and all
* fragments will be sent one by one.
*/
static void ipc_tx_callback(void *prm)
static void ipc_tx_send(void *prm)
{
struct ishtp_cl *cl = prm;
struct ishtp_cl_tx_ring *cl_msg;
@ -677,32 +678,41 @@ static void ipc_tx_callback(void *prm)
list);
rem = cl_msg->send_buf.size - cl->tx_offs;
ishtp_hdr.host_addr = cl->host_client_id;
ishtp_hdr.fw_addr = cl->fw_client_id;
ishtp_hdr.reserved = 0;
pmsg = cl_msg->send_buf.data + cl->tx_offs;
while (rem > 0) {
ishtp_hdr.host_addr = cl->host_client_id;
ishtp_hdr.fw_addr = cl->fw_client_id;
ishtp_hdr.reserved = 0;
pmsg = cl_msg->send_buf.data + cl->tx_offs;
if (rem <= dev->mtu) {
ishtp_hdr.length = rem;
ishtp_hdr.msg_complete = 1;
cl->sending = 0;
list_del_init(&cl_msg->list); /* Must be before write */
spin_unlock_irqrestore(&cl->tx_list_spinlock, tx_flags);
/* Submit to IPC queue with no callback */
ishtp_write_message(dev, &ishtp_hdr, pmsg);
spin_lock_irqsave(&cl->tx_free_list_spinlock, tx_free_flags);
list_add_tail(&cl_msg->list, &cl->tx_free_list.list);
++cl->tx_ring_free_size;
spin_unlock_irqrestore(&cl->tx_free_list_spinlock,
tx_free_flags);
} else {
/* Send IPC fragment */
spin_unlock_irqrestore(&cl->tx_list_spinlock, tx_flags);
cl->tx_offs += dev->mtu;
ishtp_hdr.length = dev->mtu;
ishtp_hdr.msg_complete = 0;
ishtp_send_msg(dev, &ishtp_hdr, pmsg, ipc_tx_callback, cl);
if (rem <= dev->mtu) {
/* Last fragment or only one packet */
ishtp_hdr.length = rem;
ishtp_hdr.msg_complete = 1;
/* Submit to IPC queue with no callback */
ishtp_write_message(dev, &ishtp_hdr, pmsg);
cl->tx_offs = 0;
cl->sending = 0;
break;
} else {
/* Send ipc fragment */
ishtp_hdr.length = dev->mtu;
ishtp_hdr.msg_complete = 0;
/* All fregments submitted to IPC queue with no callback */
ishtp_write_message(dev, &ishtp_hdr, pmsg);
cl->tx_offs += dev->mtu;
rem = cl_msg->send_buf.size - cl->tx_offs;
}
}
list_del_init(&cl_msg->list);
spin_unlock_irqrestore(&cl->tx_list_spinlock, tx_flags);
spin_lock_irqsave(&cl->tx_free_list_spinlock, tx_free_flags);
list_add_tail(&cl_msg->list, &cl->tx_free_list.list);
++cl->tx_ring_free_size;
spin_unlock_irqrestore(&cl->tx_free_list_spinlock,
tx_free_flags);
}
/**
@ -720,7 +730,7 @@ static void ishtp_cl_send_msg_ipc(struct ishtp_device *dev,
return;
cl->tx_offs = 0;
ipc_tx_callback(cl);
ipc_tx_send(cl);
++cl->send_msg_cnt_ipc;
}