Backports for Input Wacom 1.7.0 Release#513
Merged
Merged
Conversation
wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE
usage is always located in the first field (field[0]) of the feature report.
However, a device can specify HID_DG_INPUTMODE in a different field.
If HID_DG_INPUTMODE is in a field other than the first one and the first
field has a report_count smaller than the usage_index of HID_DG_INPUTMODE,
this leads to an out-of-bounds write to r->field[0]->value.
Fix this by storing the field index of HID_DG_INPUTMODE in 'struct
hid_data' during feature mapping. In wacom_hid_set_device_mode(), use
this stored field index to access the correct field and add bounds
checks to ensure both the field index and the value index are within
valid ranges before writing.
Cc: stable@vger.kernel.org
Fixes: 5ae6e89f7409 ("HID: wacom: implement the finger part of the HID generic handling")
Tested-by: Ping Cheng <ping.cheng@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
[joshua.dickens@wacom.com: Imported into input-wacom (c0a8899e02dd)]
Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org> [joshua.dickens@wacom.com: Imported into input-wacom (69050f8d6d07)] Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
This was done entirely with mindless brute force, using
git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' |
xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/'
to convert the new alloc_obj() users that had a simple GFP_KERNEL
argument to just drop that argument.
Note that due to the extreme simplicity of the scripting, any slightly
more complex cases spread over multiple lines would not be triggered:
they definitely exist, but this covers the vast bulk of the cases, and
the resulting diff is also then easier to check automatically.
For the same reason the 'flex' versions will be done as a separate
conversion.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[joshua.dickens@wacom.com: Imported into input-wacom (bf4afc53b77a)]
Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
In Kernel ver 7.0 a new definition was added for alloc_objs that was soon used to replace older uses of older allocs. This commit seeks to properly set which to use based on kernel version.
…ptr() SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the __maybe_unused markings. Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Cc: Alistair Francis <alistair@alistair23.me> Reviewed-by: Alistair Francis <alistair@alistair23.me> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://lore.kernel.org/r/20230102181842.718010-65-jic23@kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> [joshua.dickens@wacom.com: Imported into input-wacom (5ca74320a748)] Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
wacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo
doesn't have enough space for the incoming report. If the kfifo is
empty, kfifo_skip() reads stale data left in the kmalloc'd buffer
via __kfifo_peek_n() and interprets it as a record length, advancing
fifo->out by that garbage value. This corrupts the internal kfifo
state, causing kfifo_unused() to return a value much larger than the
actual buffer size, which bypasses __kfifo_in_r()'s guard:
if (len + recsize > kfifo_unused(fifo))
return 0;
kfifo_copy_in() then performs an out-of-bounds memcpy, writing up to
3842 bytes past the 256-byte buffer.
Add a !kfifo_is_empty() condition to the while loop so kfifo_skip()
is never called on an empty fifo, and check the return value of
kfifo_in() to reject reports that are too large for the fifo.
Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Fixes: 5e013ad20689 ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit")
Cc: stable@vger.kernel.org
Signed-off-by: Jinmo Yang <jinmo44.yang@gmail.com>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
[joshua.dickens@wacom.com: Imported into input-wacom (6b3014ec0e9a)]
Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
wacom_wac_queue_flush() is called via the .raw_event callback
(wacom_raw_event → wacom_wac_pen_serial_enforce → wacom_wac_queue_flush).
For USB HID devices, this callback is invoked from hid_irq_in(), which
is a URB completion handler running in atomic context. Using GFP_KERNEL
in this path can sleep, leading to a "scheduling while atomic" bug.
Use GFP_ATOMIC instead. The existing code already handles allocation
failure by skipping the fifo entry and continuing.
Reported-by: Sashiko-bot <sashiko-bot@kernel.org>
Fixes: 5e013ad20689 ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit")
Cc: stable@vger.kernel.org
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jinmo Yang <jinmo44.yang@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
[joshua.dickens@wacom.com: Imported into input-wacom (55f1ad573e34)]
Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
Use __free(kfree) cleanup facility for the temporary buffer in wacom_wac_queue_flush() to simplify error paths and ensure the buffer is freed automatically when it goes out of scope. Signed-off-by: Jinmo Yang <jinmo44.yang@gmail.com> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> [joshua.dickens@wacom.com: Imported into input-wacom (cb605d48dac9)] Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
wacom_parse_and_register() starts HID hardware before registering inputs
and initializing pad LEDs/remotes. Those later steps can fail, but their
error paths currently release Wacom resources without stopping the HID
hardware.
Route post-hid_hw_start() failures through hid_hw_stop() before
releasing driver resources.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: c1d6708bf0d3 ("HID: wacom: Do not register input devices until after hid_hw_start")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
[joshua.dickens@wacom.com: Imported into input-wacom (ec2612b8ad9e)]
Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
wacom_intuos_bt_irq() duplicates the received Bluetooth report with kmemdup() so that it can pass 10-byte input report payloads to the common Intuos parser. The helper then copies each payload back into wacom->data before calling wacom_intuos_irq(). Avoid the allocation and copy by temporarily pointing wacom->data at the current 10-byte payload while the common parser runs, then restoring the original report pointer. The Bluetooth report parser keeps using the original report buffer for dispatch and battery parsing, while the common parser sees the same payload bytes as before. This also removes the unchecked kmemdup() result from the Bluetooth IRQ path. Suggested-by: Jason Gerecke <jason.gerecke@wacom.com> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> [joshua.dickens@wacom.com: Imported into input-wacom (8310cdeefc8a)] Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
Switch the driver to use guard notation when acquiring mutex to have it released automatically. Link: https://lore.kernel.org/r/Zmkyvkr9AFyywy1V@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> [joshua.dickens@wacom.com: Imported into input-wacom (68bf7a8cc5f3)] Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
…ata to 0 These drivers don't use the driver_data member of struct i2c_device_id, so don't explicitly initialize this member. This prepares putting driver_data in an anonymous union which requires either no initialization or named designators. But it's also a nice cleanup on its own. While add it, also remove commas after the sentinel entries. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Link: https://lore.kernel.org/r/20240509174158.2211071-2-u.kleine-koenig@pengutronix.de Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> [joshua.dickens@wacom.com: Imported into input-wacom (5852f2afcdd9)] Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org> [joshua.dickens@wacom.com: Imported into input-wacom (69050f8d6d07)] Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
This was done entirely with mindless brute force, using
git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' |
xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/'
to convert the new alloc_obj() users that had a simple GFP_KERNEL
argument to just drop that argument.
Note that due to the extreme simplicity of the scripting, any slightly
more complex cases spread over multiple lines would not be triggered:
they definitely exist, but this covers the vast bulk of the cases, and
the resulting diff is also then easier to check automatically.
For the same reason the 'flex' versions will be done as a separate
conversion.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[joshua.dickens@wacom.com: Imported into input-wacom (bf4afc53b77a)]
Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
With the deprecation of Node.js 20 in Github Actions this commit updates certain actions we use that relied on Node.js 20 to versions that use Node.js 24
Adding a flag for the definition of hid_warn_ratelimited introduced in kernel v6.17 Adding a flag for the usage of __free which was introduced in kernel version v6.5. Adding flags for the new guard and secure_guard methods implemented in kernel v6.5 Adding flag for DEFINE_SIMPLE_DEV_PM_OPS definition implemented in kernel v5.17
Pinglinux
approved these changes
Jul 7, 2026
Pinglinux
left a comment
Pinglinux
left a comment
Member
There was a problem hiding this comment.
Patches look good to me. Thank you Josh!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Multiple Backports for the upcoming Input Wacom 1.7.0 release that touches on wacom_i2c, wacom_sys, and wacom_w8001.
These changes required 7 new definitions/flags in order to ensure older kernel version could compile.
WACOM_HID_REPORT_RAW_EVENT_BUFSIZE
WACOM_KZALLOC_OBJ
WACOM_HID_WARN_RATELIMITED
WACOM_CLEANUP_FREE
WACOM_SCOPED_GUARD
WACOM_GUARD
WACOM_DEFINE_SIMPLE_DEV_PM_OPS
I also added a few kernel versions to the testing workflow at the kernel versions these new definitions exist at to ensure they are being covered properly.