Skip to content

Commit 227abb7

Browse files
torvaldstorvalds
committed
Merge tag 'input-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov: - updates to Elan I2C touchpad driver to handle a new IC type and to validate size of supplied firmware to prevent OOB access - updates to Xpad controller driver to recognize ASUS ROG RAIKIRI II and "Nova 2 Lite" from GameSir controllers as well as a fix to prevent a potential OOB access when handling "Share" button - an update to Synaptics touchpad driver to use RMI mode for touchpad in Thinkpad E490 - updates to Atmel MXT driver adding checks to prevent potential OOB accesses - a fix to IMS PCU driver to free correct amount of memory when tearing it down - a fixup to the recent change to Atlas buttons driver - a small cleanup in fm801-fp for PCI IDs table initialisation * tag 'input-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Input: atlas - check ACPI_COMPANION() against NULL Input: atmel_mxt_ts - check mem_size before calculating config memory size Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Input: fm801-gp - simplify initialisation of pci_device_id array Input: xpad - add "Nova 2 Lite" from GameSir Input: xpad - add support for ASUS ROG RAIKIRI II Input: elan_i2c - validate firmware size before use Input: xpad - fix out-of-bounds access for Share button Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size Input: elan_i2c - increase device reset wait timeout after update FW Input: elan_i2c - add ic type 0x19
2 parents 174914e + dab48a7 commit 227abb7

9 files changed

Lines changed: 43 additions & 12 deletions

File tree

‎drivers/input/gameport/fm801-gp.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -125,8 +125,8 @@ static void fm801_gp_remove(struct pci_dev *pci)
125125
}
126126

127127
static const struct pci_device_id fm801_gp_id_table[] = {
128-
{ PCI_VENDOR_ID_FORTEMEDIA, PCI_DEVICE_ID_FM801_GP, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
129-
{ 0 }
128+
{ PCI_VDEVICE(FORTEMEDIA, PCI_DEVICE_ID_FM801_GP) },
129+
{ }
130130
};
131131
MODULE_DEVICE_TABLE(pci, fm801_gp_id_table);
132132

‎drivers/input/joystick/xpad.c‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,10 @@ static const struct xpad_device {
186186
{ 0x07ff, 0xffff, "Mad Catz GamePad", 0, XTYPE_XBOX360 },
187187
{ 0x0b05, 0x1a38, "ASUS ROG RAIKIRI", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
188188
{ 0x0b05, 0x1abb, "ASUS ROG RAIKIRI PRO", 0, XTYPE_XBOXONE },
189+
{ 0x0b05, 0x1c91, "ASUS ROG RAIKIRI II", 0, XTYPE_XBOX360 },
190+
{ 0x0b05, 0x1c92, "ASUS ROG RAIKIRI II WIRELESS", 0, XTYPE_XBOX360 },
191+
{ 0x0b05, 0x1c96, "ASUS ROG RAIKIRI II XBOX", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
192+
{ 0x0b05, 0x1d04, "ASUS ROG RAIKIRI II XBOX WIRELESS", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
189193
{ 0x0c12, 0x0005, "Intec wireless", 0, XTYPE_XBOX },
190194
{ 0x0c12, 0x8801, "Nyko Xbox Controller", 0, XTYPE_XBOX },
191195
{ 0x0c12, 0x8802, "Zeroplus Xbox Controller", 0, XTYPE_XBOX },
@@ -391,6 +395,7 @@ static const struct xpad_device {
391395
{ 0x3285, 0x0662, "Nacon Revolution5 Pro", 0, XTYPE_XBOX360 },
392396
{ 0x3285, 0x0663, "Nacon Evol-X", 0, XTYPE_XBOXONE },
393397
{ 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 },
398+
{ 0x3537, 0x100f, "GameSir Nova 2 Lite", 0, XTYPE_XBOX360 },
394399
{ 0x3537, 0x1010, "GameSir G7 SE", 0, XTYPE_XBOXONE },
395400
{ 0x3651, 0x1000, "CRKD SG", 0, XTYPE_XBOX360 },
396401
{ 0x366c, 0x0005, "ByoWave Proteus Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE, FLAG_DELAY_INIT },
@@ -507,6 +512,7 @@ static const struct usb_device_id xpad_table[] = {
507512
{ USB_DEVICE(0x0738, 0x4540) }, /* Mad Catz Beat Pad */
508513
XPAD_XBOXONE_VENDOR(0x0738), /* Mad Catz FightStick TE 2 */
509514
XPAD_XBOX360_VENDOR(0x07ff), /* Mad Catz Gamepad */
515+
XPAD_XBOX360_VENDOR(0x0b05), /* ASUS controllers */
510516
XPAD_XBOXONE_VENDOR(0x0b05), /* ASUS controllers */
511517
XPAD_XBOX360_VENDOR(0x0c12), /* Zeroplus X-Box 360 controllers */
512518
XPAD_XBOX360_VENDOR(0x0db0), /* Micro Star International X-Box 360 controllers */
@@ -1077,10 +1083,10 @@ static void xpadone_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char
10771083
input_report_key(dev, BTN_START, data[4] & BIT(2));
10781084
input_report_key(dev, BTN_SELECT, data[4] & BIT(3));
10791085
if (xpad->mapping & MAP_SHARE_BUTTON) {
1080-
if (xpad->mapping & MAP_SHARE_OFFSET)
1081-
input_report_key(dev, KEY_RECORD, data[len - 26] & BIT(0));
1082-
else
1083-
input_report_key(dev, KEY_RECORD, data[len - 18] & BIT(0));
1086+
u32 offset = (xpad->mapping & MAP_SHARE_OFFSET) ? 26 : 18;
1087+
1088+
if (len >= offset)
1089+
input_report_key(dev, KEY_RECORD, data[len - offset] & BIT(0));
10841090
}
10851091

10861092
/* buttons A,B,X,Y */

‎drivers/input/misc/atlas_btns.c‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,15 @@ static acpi_status acpi_atlas_button_handler(u32 function,
6060

6161
static int atlas_acpi_button_probe(struct platform_device *pdev)
6262
{
63-
struct acpi_device *device = ACPI_COMPANION(&pdev->dev);
63+
struct acpi_device *device;
6464
acpi_status status;
6565
int i;
6666
int err;
6767

68+
device = ACPI_COMPANION(&pdev->dev);
69+
if (!device)
70+
return -ENODEV;
71+
6872
input_dev = input_allocate_device();
6973
if (!input_dev) {
7074
pr_err("unable to allocate input device\n");

‎drivers/input/misc/ims-pcu.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1624,7 +1624,7 @@ static void ims_pcu_buffers_free(struct ims_pcu *pcu)
16241624
usb_kill_urb(pcu->urb_in);
16251625
usb_free_urb(pcu->urb_in);
16261626

1627-
usb_free_coherent(pcu->udev, pcu->max_out_size,
1627+
usb_free_coherent(pcu->udev, pcu->max_in_size,
16281628
pcu->urb_in_buf, pcu->read_dma);
16291629

16301630
kfree(pcu->urb_out_buf);

‎drivers/input/mouse/elan_i2c_core.c‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,9 @@ static int elan_get_fwinfo(u16 ic_type, u8 iap_version, u16 *validpage_count,
162162
case 0x15:
163163
*validpage_count = 1024;
164164
break;
165+
case 0x19:
166+
*validpage_count = 2032;
167+
break;
165168
default:
166169
/* unknown ic type clear value */
167170
*validpage_count = 0;
@@ -645,6 +648,11 @@ static ssize_t elan_sysfs_update_fw(struct device *dev,
645648
return error;
646649
}
647650

651+
if (fw->size < data->fw_signature_address + sizeof(signature)) {
652+
dev_err(dev, "firmware file too small\n");
653+
return -EBADF;
654+
}
655+
648656
/* Firmware file must match signature data */
649657
fw_signature = &fw->data[data->fw_signature_address];
650658
if (memcmp(fw_signature, signature, sizeof(signature)) != 0) {

‎drivers/input/mouse/elan_i2c_i2c.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -690,7 +690,7 @@ static int elan_i2c_finish_fw_update(struct i2c_client *client,
690690
if (error) {
691691
dev_err(dev, "device reset failed: %d\n", error);
692692
} else if (!wait_for_completion_timeout(completion,
693-
msecs_to_jiffies(300))) {
693+
msecs_to_jiffies(700))) {
694694
dev_err(dev, "timeout waiting for device reset\n");
695695
error = -ETIMEDOUT;
696696
}

‎drivers/input/mouse/synaptics.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,7 @@ static const char * const smbus_pnp_ids[] = {
190190
"LEN2044", /* L470 */
191191
"LEN2054", /* E480 */
192192
"LEN2055", /* E580 */
193+
"LEN2058", /* E490 */
193194
"LEN2068", /* T14 Gen 1 */
194195
"SYN1221", /* TUXEDO InfinityBook Pro 14 v5 */
195196
"SYN3003", /* HP EliteBook 850 G1 */

‎drivers/input/touchscreen/atmel_mxt_ts.c‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -275,8 +275,8 @@ struct mxt_cfg {
275275
off_t raw_pos;
276276

277277
u8 *mem;
278-
size_t mem_size;
279-
int start_ofs;
278+
u16 mem_size;
279+
u16 start_ofs;
280280

281281
struct mxt_info info;
282282
};
@@ -1473,7 +1473,7 @@ static int mxt_prepare_cfg_mem(struct mxt_data *data, struct mxt_cfg *cfg)
14731473
}
14741474
cfg->raw_pos += offset;
14751475

1476-
if (i > mxt_obj_size(object))
1476+
if (i >= mxt_obj_size(object))
14771477
continue;
14781478

14791479
byte_offset = reg + i - cfg->start_ofs;
@@ -1627,6 +1627,13 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *fw)
16271627
cfg.start_ofs = MXT_OBJECT_START +
16281628
data->info->object_num * sizeof(struct mxt_object) +
16291629
MXT_INFO_CHECKSUM_SIZE;
1630+
1631+
if (data->mem_size <= cfg.start_ofs) {
1632+
dev_err(dev, "Memory size too small: %u < %u\n",
1633+
data->mem_size, cfg.start_ofs);
1634+
return -EINVAL;
1635+
}
1636+
16301637
cfg.mem_size = data->mem_size - cfg.start_ofs;
16311638

16321639
u8 *mem_buf __free(kfree) = cfg.mem = kzalloc(cfg.mem_size, GFP_KERNEL);

‎drivers/input/touchscreen/usbtouchscreen.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1067,6 +1067,11 @@ static int nexio_read_data(struct usbtouch_usb *usbtouch, unsigned char *pkt)
10671067
if (x_len > 0xff)
10681068
x_len -= 0x80;
10691069

1070+
if (data_len > usbtouch->data_size - sizeof(*packet))
1071+
data_len = usbtouch->data_size - sizeof(*packet);
1072+
if (x_len > data_len)
1073+
x_len = data_len;
1074+
10701075
/* send ACK */
10711076
ret = usb_submit_urb(priv->ack, GFP_ATOMIC);
10721077
if (ret)

0 commit comments

Comments
 (0)