Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:

- a fix for use-after-free in Synaptics RMI4 driver

- correction to multitouch contact tracking on certain ALPS touchpads
(which got broken when we tried to fix the 2-finger scrolling)

- touchpad on Lenovo T640p is switched over to SMbus/RMI

- a few device node refcount fixes

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: synaptics-rmi4 - prevent UAF reported by KASAN
Input: ALPS - fix multi-touch decoding on SS4 plus touchpads
Input: synaptics - Lenovo Thinkpad T460p devices should use RMI
Input: of_touchscreen - add MODULE_LICENSE
Input: 88pm860x-ts - fix child-node lookup
Input: twl6040-vibra - fix child-node lookup
Input: twl4030-vibra - fix sibling-node lookup

+44 -23
+4 -2
drivers/input/misc/twl4030-vibra.c
··· 178 178 twl4030_vibra_suspend, twl4030_vibra_resume); 179 179 180 180 static bool twl4030_vibra_check_coexist(struct twl4030_vibra_data *pdata, 181 - struct device_node *node) 181 + struct device_node *parent) 182 182 { 183 + struct device_node *node; 184 + 183 185 if (pdata && pdata->coexist) 184 186 return true; 185 187 186 - node = of_find_node_by_name(node, "codec"); 188 + node = of_get_child_by_name(parent, "codec"); 187 189 if (node) { 188 190 of_node_put(node); 189 191 return true;
+1 -2
drivers/input/misc/twl6040-vibra.c
··· 248 248 int vddvibr_uV = 0; 249 249 int error; 250 250 251 - of_node_get(twl6040_core_dev->of_node); 252 - twl6040_core_node = of_find_node_by_name(twl6040_core_dev->of_node, 251 + twl6040_core_node = of_get_child_by_name(twl6040_core_dev->of_node, 253 252 "vibra"); 254 253 if (!twl6040_core_node) { 255 254 dev_err(&pdev->dev, "parent of node is missing?\n");
+13 -10
drivers/input/mouse/alps.c
··· 1250 1250 case SS4_PACKET_ID_MULTI: 1251 1251 if (priv->flags & ALPS_BUTTONPAD) { 1252 1252 if (IS_SS4PLUS_DEV(priv->dev_id)) { 1253 - f->mt[0].x = SS4_PLUS_BTL_MF_X_V2(p, 0); 1254 - f->mt[1].x = SS4_PLUS_BTL_MF_X_V2(p, 1); 1253 + f->mt[2].x = SS4_PLUS_BTL_MF_X_V2(p, 0); 1254 + f->mt[3].x = SS4_PLUS_BTL_MF_X_V2(p, 1); 1255 + no_data_x = SS4_PLUS_MFPACKET_NO_AX_BL; 1255 1256 } else { 1256 1257 f->mt[2].x = SS4_BTL_MF_X_V2(p, 0); 1257 1258 f->mt[3].x = SS4_BTL_MF_X_V2(p, 1); 1259 + no_data_x = SS4_MFPACKET_NO_AX_BL; 1258 1260 } 1261 + no_data_y = SS4_MFPACKET_NO_AY_BL; 1259 1262 1260 1263 f->mt[2].y = SS4_BTL_MF_Y_V2(p, 0); 1261 1264 f->mt[3].y = SS4_BTL_MF_Y_V2(p, 1); 1262 - no_data_x = SS4_MFPACKET_NO_AX_BL; 1263 - no_data_y = SS4_MFPACKET_NO_AY_BL; 1264 1265 } else { 1265 1266 if (IS_SS4PLUS_DEV(priv->dev_id)) { 1266 - f->mt[0].x = SS4_PLUS_STD_MF_X_V2(p, 0); 1267 - f->mt[1].x = SS4_PLUS_STD_MF_X_V2(p, 1); 1267 + f->mt[2].x = SS4_PLUS_STD_MF_X_V2(p, 0); 1268 + f->mt[3].x = SS4_PLUS_STD_MF_X_V2(p, 1); 1269 + no_data_x = SS4_PLUS_MFPACKET_NO_AX; 1268 1270 } else { 1269 - f->mt[0].x = SS4_STD_MF_X_V2(p, 0); 1270 - f->mt[1].x = SS4_STD_MF_X_V2(p, 1); 1271 + f->mt[2].x = SS4_STD_MF_X_V2(p, 0); 1272 + f->mt[3].x = SS4_STD_MF_X_V2(p, 1); 1273 + no_data_x = SS4_MFPACKET_NO_AX; 1271 1274 } 1275 + no_data_y = SS4_MFPACKET_NO_AY; 1276 + 1272 1277 f->mt[2].y = SS4_STD_MF_Y_V2(p, 0); 1273 1278 f->mt[3].y = SS4_STD_MF_Y_V2(p, 1); 1274 - no_data_x = SS4_MFPACKET_NO_AX; 1275 - no_data_y = SS4_MFPACKET_NO_AY; 1276 1279 } 1277 1280 1278 1281 f->first_mp = 0;
+6 -4
drivers/input/mouse/alps.h
··· 141 141 #define SS4_TS_Z_V2(_b) (s8)(_b[4] & 0x7F) 142 142 143 143 144 - #define SS4_MFPACKET_NO_AX 8160 /* X-Coordinate value */ 145 - #define SS4_MFPACKET_NO_AY 4080 /* Y-Coordinate value */ 146 - #define SS4_MFPACKET_NO_AX_BL 8176 /* Buttonless X-Coordinate value */ 147 - #define SS4_MFPACKET_NO_AY_BL 4088 /* Buttonless Y-Coordinate value */ 144 + #define SS4_MFPACKET_NO_AX 8160 /* X-Coordinate value */ 145 + #define SS4_MFPACKET_NO_AY 4080 /* Y-Coordinate value */ 146 + #define SS4_MFPACKET_NO_AX_BL 8176 /* Buttonless X-Coord value */ 147 + #define SS4_MFPACKET_NO_AY_BL 4088 /* Buttonless Y-Coord value */ 148 + #define SS4_PLUS_MFPACKET_NO_AX 4080 /* SS4 PLUS, X */ 149 + #define SS4_PLUS_MFPACKET_NO_AX_BL 4088 /* Buttonless SS4 PLUS, X */ 148 150 149 151 /* 150 152 * enum V7_PACKET_ID - defines the packet type for V7
+1
drivers/input/mouse/synaptics.c
··· 173 173 "LEN0046", /* X250 */ 174 174 "LEN004a", /* W541 */ 175 175 "LEN200f", /* T450s */ 176 + "LEN2018", /* T460p */ 176 177 NULL 177 178 }; 178 179
+3 -1
drivers/input/rmi4/rmi_driver.c
··· 230 230 rmi_dbg(RMI_DEBUG_CORE, &rmi_dev->dev, 231 231 "Failed to process interrupt request: %d\n", ret); 232 232 233 - if (count) 233 + if (count) { 234 234 kfree(attn_data.data); 235 + attn_data.data = NULL; 236 + } 235 237 236 238 if (!kfifo_is_empty(&drvdata->attn_fifo)) 237 239 return rmi_irq_fn(irq, dev_id);
+12 -4
drivers/input/touchscreen/88pm860x-ts.c
··· 126 126 int data, n, ret; 127 127 if (!np) 128 128 return -ENODEV; 129 - np = of_find_node_by_name(np, "touch"); 129 + np = of_get_child_by_name(np, "touch"); 130 130 if (!np) { 131 131 dev_err(&pdev->dev, "Can't find touch node\n"); 132 132 return -EINVAL; ··· 144 144 if (data) { 145 145 ret = pm860x_reg_write(i2c, PM8607_GPADC_MISC1, data); 146 146 if (ret < 0) 147 - return -EINVAL; 147 + goto err_put_node; 148 148 } 149 149 /* set tsi prebias time */ 150 150 if (!of_property_read_u32(np, "marvell,88pm860x-tsi-prebias", &data)) { 151 151 ret = pm860x_reg_write(i2c, PM8607_TSI_PREBIAS, data); 152 152 if (ret < 0) 153 - return -EINVAL; 153 + goto err_put_node; 154 154 } 155 155 /* set prebias & prechg time of pen detect */ 156 156 data = 0; ··· 161 161 if (data) { 162 162 ret = pm860x_reg_write(i2c, PM8607_PD_PREBIAS, data); 163 163 if (ret < 0) 164 - return -EINVAL; 164 + goto err_put_node; 165 165 } 166 166 of_property_read_u32(np, "marvell,88pm860x-resistor-X", res_x); 167 + 168 + of_node_put(np); 169 + 167 170 return 0; 171 + 172 + err_put_node: 173 + of_node_put(np); 174 + 175 + return -EINVAL; 168 176 } 169 177 #else 170 178 #define pm860x_touch_dt_init(x, y, z) (-1)
+4
drivers/input/touchscreen/of_touchscreen.c
··· 13 13 #include <linux/input.h> 14 14 #include <linux/input/mt.h> 15 15 #include <linux/input/touchscreen.h> 16 + #include <linux/module.h> 16 17 17 18 static bool touchscreen_get_prop_u32(struct device *dev, 18 19 const char *property, ··· 186 185 input_report_abs(input, multitouch ? ABS_MT_POSITION_Y : ABS_Y, y); 187 186 } 188 187 EXPORT_SYMBOL(touchscreen_report_pos); 188 + 189 + MODULE_LICENSE("GPL v2"); 190 + MODULE_DESCRIPTION("Device-tree helpers functions for touchscreen devices");