Commit bf929479 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 

Pull input fixes from Dmitry Torokhov:
 "Fixes to the Synaptics RMI4 driver and fix for use after free in error
  path handling of the Cypress TTSP driver"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: cyttsp4_core - fix use after free bug
  Input: synaptics-rmi4 - clear IRQ enables for F54
  Input: synaptics-rmi4 - remove unused result_bits mask
  Input: synaptics-rmi4 - do not consume more data than we have (F11, F12)
  Input: synaptics-rmi4 - disable the relative position IRQ in the F12 driver
  Input: synaptics-rmi4 - fix video buffer size
parents afd7a718 79aae6ac

drivers/input/rmi4/rmi_f11.c

+3 −6
Original line number Diff line number Diff line
@@ -510,7 +510,6 @@ struct f11_data { 
	struct rmi_2d_sensor_platform_data sensor_pdata;

	unsigned long *abs_mask;

	unsigned long *rel_mask;

	unsigned long *result_bits;

};



enum f11_finger_state {
@@ -1057,7 +1056,7 @@ static int rmi_f11_initialize(struct rmi_function *fn) 
	/*

	** init instance data, fill in values and create any sysfs files

	*/

	f11 = devm_kzalloc(&fn->dev, sizeof(struct f11_data) + mask_size * 3,

	f11 = devm_kzalloc(&fn->dev, sizeof(struct f11_data) + mask_size * 2,

			GFP_KERNEL);

	if (!f11)

		return -ENOMEM;
@@ -1076,8 +1075,6 @@ static int rmi_f11_initialize(struct rmi_function *fn) 
			+ sizeof(struct f11_data));

	f11->rel_mask = (unsigned long *)((char *)f11

			+ sizeof(struct f11_data) + mask_size);

	f11->result_bits = (unsigned long *)((char *)f11

			+ sizeof(struct f11_data) + mask_size * 2);



	set_bit(fn->irq_pos, f11->abs_mask);

	set_bit(fn->irq_pos + 1, f11->rel_mask);
@@ -1284,8 +1281,8 @@ static irqreturn_t rmi_f11_attention(int irq, void *ctx) 
			valid_bytes = f11->sensor.attn_size;

		memcpy(f11->sensor.data_pkt, drvdata->attn_data.data,

			valid_bytes);

		drvdata->attn_data.data += f11->sensor.attn_size;

		drvdata->attn_data.size -= f11->sensor.attn_size;

		drvdata->attn_data.data += valid_bytes;

		drvdata->attn_data.size -= valid_bytes;

	} else {

		error = rmi_read_block(rmi_dev,

				data_base_addr, f11->sensor.data_pkt,

drivers/input/rmi4/rmi_f12.c

+28 −4
Original line number Diff line number Diff line
@@ -55,6 +55,9 @@ struct f12_data { 


	const struct rmi_register_desc_item *data15;

	u16 data15_offset;



	unsigned long *abs_mask;

	unsigned long *rel_mask;

};



static int rmi_f12_read_sensor_tuning(struct f12_data *f12)
@@ -209,8 +212,8 @@ static irqreturn_t rmi_f12_attention(int irq, void *ctx) 
			valid_bytes = sensor->attn_size;

		memcpy(sensor->data_pkt, drvdata->attn_data.data,

			valid_bytes);

		drvdata->attn_data.data += sensor->attn_size;

		drvdata->attn_data.size -= sensor->attn_size;

		drvdata->attn_data.data += valid_bytes;

		drvdata->attn_data.size -= valid_bytes;

	} else {

		retval = rmi_read_block(rmi_dev, f12->data_addr,

					sensor->data_pkt, sensor->pkt_size);
@@ -291,9 +294,18 @@ static int rmi_f12_write_control_regs(struct rmi_function *fn) 
static int rmi_f12_config(struct rmi_function *fn)

{

	struct rmi_driver *drv = fn->rmi_dev->driver;

	struct f12_data *f12 = dev_get_drvdata(&fn->dev);

	struct rmi_2d_sensor *sensor;

	int ret;



	drv->set_irq_bits(fn->rmi_dev, fn->irq_mask);

	sensor = &f12->sensor;



	if (!sensor->report_abs)

		drv->clear_irq_bits(fn->rmi_dev, f12->abs_mask);

	else

		drv->set_irq_bits(fn->rmi_dev, f12->abs_mask);



	drv->clear_irq_bits(fn->rmi_dev, f12->rel_mask);



	ret = rmi_f12_write_control_regs(fn);

	if (ret)
@@ -315,9 +327,12 @@ static int rmi_f12_probe(struct rmi_function *fn) 
	struct rmi_device_platform_data *pdata = rmi_get_platform_data(rmi_dev);

	struct rmi_driver_data *drvdata = dev_get_drvdata(&rmi_dev->dev);

	u16 data_offset = 0;

	int mask_size;



	rmi_dbg(RMI_DEBUG_FN, &fn->dev, "%s\n", __func__);



	mask_size = BITS_TO_LONGS(drvdata->irq_count) * sizeof(unsigned long);



	ret = rmi_read(fn->rmi_dev, query_addr, &buf);

	if (ret < 0) {

		dev_err(&fn->dev, "Failed to read general info register: %d\n",
@@ -332,10 +347,19 @@ static int rmi_f12_probe(struct rmi_function *fn) 
		return -ENODEV;

	}



	f12 = devm_kzalloc(&fn->dev, sizeof(struct f12_data), GFP_KERNEL);

	f12 = devm_kzalloc(&fn->dev, sizeof(struct f12_data) + mask_size * 2,

			GFP_KERNEL);

	if (!f12)

		return -ENOMEM;



	f12->abs_mask = (unsigned long *)((char *)f12

			+ sizeof(struct f12_data));

	f12->rel_mask = (unsigned long *)((char *)f12

			+ sizeof(struct f12_data) + mask_size);



	set_bit(fn->irq_pos, f12->abs_mask);

	set_bit(fn->irq_pos + 1, f12->rel_mask);



	f12->has_dribble = !!(buf & BIT(3));



	if (fn->dev.of_node) {

drivers/input/rmi4/rmi_f54.c

+2 −2
Original line number Diff line number Diff line
@@ -359,7 +359,7 @@ static const struct vb2_ops rmi_f54_queue_ops = { 
static const struct vb2_queue rmi_f54_queue = {

	.type = V4L2_BUF_TYPE_VIDEO_CAPTURE,

	.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF | VB2_READ,

	.buf_struct_size = sizeof(struct vb2_buffer),

	.buf_struct_size = sizeof(struct vb2_v4l2_buffer),

	.ops = &rmi_f54_queue_ops,

	.mem_ops = &vb2_vmalloc_memops,

	.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC,
@@ -601,7 +601,7 @@ static int rmi_f54_config(struct rmi_function *fn) 
{

	struct rmi_driver *drv = fn->rmi_dev->driver;



	drv->set_irq_bits(fn->rmi_dev, fn->irq_mask);

	drv->clear_irq_bits(fn->rmi_dev, fn->irq_mask);



	return 0;

}

drivers/input/touchscreen/cyttsp4_core.c

+0 −7
Original line number Diff line number Diff line
@@ -1990,11 +1990,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd) 


	/* get sysinfo */

	md->si = &cd->sysinfo;

	if (!md->si) {

		dev_err(dev, "%s: Fail get sysinfo pointer from core p=%p\n",

			__func__, md->si);

		goto error_get_sysinfo;

	}



	rc = cyttsp4_setup_input_device(cd);

	if (rc)
@@ -2004,8 +1999,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd) 


error_init_input:

	input_free_device(md->input);

error_get_sysinfo:

	input_set_drvdata(md->input, NULL);

error_alloc_failed:

	dev_err(dev, "%s failed.\n", __func__);

	return rc;

CRA Git | Maintained and supported by SUSTech CRA and CCSE