github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-02 19:43:40 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Input updates for v7.1-rc5

Browse Source 
- updates to Elan I2C touchpad driver to handle a new IC type and to
   validate size of supplied firmware to prevent OOB access
 
 - updates to Xpad controller driver to recognize ASUS ROG RAIKIRI II and
   "Nova 2 Lite" from GameSir controllers as well as a fix to prevent a
   potential OOB access when handling "Share" button
 
 - an update to Synaptics touchpad driver to use RMI mode for touchpad in
   Thinkpad E490
 
 - updates to Atmel MXT driver adding checks to prevent potential OOB
   accesses
 
 - a fix to IMS PCU driver to free correct amount of memory when
   tearing it down
 
 - a fixup to the recent change to Atlas buttons driver
 
 - a small cleanup in fm801-fp for PCI IDs table initialisation
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCahvBFwAKCRBAj56VGEWX
 nP7XAQDH9WIYBX7XEHSPInN6GH8GngWA/94v3b6UpBSL2UFdQQEAo1+WoyOGL/Dh
 0U0g5CcvDwx9irF8qJBWX2a3DRNPngo=
 =hDBA
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:

 - updates to Elan I2C touchpad driver to handle a new IC type and to
   validate size of supplied firmware to prevent OOB access

 - updates to Xpad controller driver to recognize ASUS ROG RAIKIRI II
   and "Nova 2 Lite" from GameSir controllers as well as a fix to
   prevent a potential OOB access when handling "Share" button

 - an update to Synaptics touchpad driver to use RMI mode for touchpad
   in Thinkpad E490

 - updates to Atmel MXT driver adding checks to prevent potential OOB
   accesses

 - a fix to IMS PCU driver to free correct amount of memory when tearing
   it down

 - a fixup to the recent change to Atlas buttons driver

 - a small cleanup in fm801-fp for PCI IDs table initialisation

* tag 'input-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
  Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
  Input: atlas - check ACPI_COMPANION() against NULL
  Input: atmel_mxt_ts - check mem_size before calculating config memory size
  Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
  Input: fm801-gp - simplify initialisation of pci_device_id array
  Input: xpad - add "Nova 2 Lite" from GameSir
  Input: xpad - add support for ASUS ROG RAIKIRI II
  Input: elan_i2c - validate firmware size before use
  Input: xpad - fix out-of-bounds access for Share button
  Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
  Input: elan_i2c - increase device reset wait timeout after update FW
  Input: elan_i2c - add ic type 0x19
This commit is contained in:
Linus Torvalds 2026-05-31 08:27:18 -07:00
commit 227abb780c
9 changed files with 43 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/input/gameport/fm801-gp.c
View File

@ -125,8 +125,8 @@ static void fm801_gp_remove(struct pci_dev *pci)
}
static const struct pci_device_id fm801_gp_id_table[] = {
{ PCI_VENDOR_ID_FORTEMEDIA, PCI_DEVICE_ID_FM801_GP, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
{ 0 }
{ PCI_VDEVICE(FORTEMEDIA, PCI_DEVICE_ID_FM801_GP) },
{ }
};
MODULE_DEVICE_TABLE(pci, fm801_gp_id_table);

14
drivers/input/joystick/xpad.c
View File

@ -186,6 +186,10 @@ static const struct xpad_device {
{ 0x07ff, 0xffff, "Mad Catz GamePad", 0, XTYPE_XBOX360 },
{ 0x0b05, 0x1a38, "ASUS ROG RAIKIRI", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x0b05, 0x1abb, "ASUS ROG RAIKIRI PRO", 0, XTYPE_XBOXONE },
{ 0x0b05, 0x1c91, "ASUS ROG RAIKIRI II", 0, XTYPE_XBOX360 },
{ 0x0b05, 0x1c92, "ASUS ROG RAIKIRI II WIRELESS", 0, XTYPE_XBOX360 },
{ 0x0b05, 0x1c96, "ASUS ROG RAIKIRI II XBOX", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x0b05, 0x1d04, "ASUS ROG RAIKIRI II XBOX WIRELESS", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x0c12, 0x0005, "Intec wireless", 0, XTYPE_XBOX },
{ 0x0c12, 0x8801, "Nyko Xbox Controller", 0, XTYPE_XBOX },
{ 0x0c12, 0x8802, "Zeroplus Xbox Controller", 0, XTYPE_XBOX },
@ -391,6 +395,7 @@ static const struct xpad_device {
{ 0x3285, 0x0662, "Nacon Revolution5 Pro", 0, XTYPE_XBOX360 },
{ 0x3285, 0x0663, "Nacon Evol-X", 0, XTYPE_XBOXONE },
{ 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 },
{ 0x3537, 0x100f, "GameSir Nova 2 Lite", 0, XTYPE_XBOX360 },
{ 0x3537, 0x1010, "GameSir G7 SE", 0, XTYPE_XBOXONE },
{ 0x3651, 0x1000, "CRKD SG", 0, XTYPE_XBOX360 },
{ 0x366c, 0x0005, "ByoWave Proteus Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE, FLAG_DELAY_INIT },
@ -507,6 +512,7 @@ static const struct usb_device_id xpad_table[] = {
{ USB_DEVICE(0x0738, 0x4540) }, /* Mad Catz Beat Pad */
XPAD_XBOXONE_VENDOR(0x0738), /* Mad Catz FightStick TE 2 */
XPAD_XBOX360_VENDOR(0x07ff), /* Mad Catz Gamepad */
XPAD_XBOX360_VENDOR(0x0b05), /* ASUS controllers */
XPAD_XBOXONE_VENDOR(0x0b05), /* ASUS controllers */
XPAD_XBOX360_VENDOR(0x0c12), /* Zeroplus X-Box 360 controllers */
XPAD_XBOX360_VENDOR(0x0db0), /* Micro Star International X-Box 360 controllers */
@ -1077,10 +1083,10 @@ static void xpadone_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char
input_report_key(dev, BTN_START, data[4] & BIT(2));
input_report_key(dev, BTN_SELECT, data[4] & BIT(3));
if (xpad->mapping & MAP_SHARE_BUTTON) {
if (xpad->mapping & MAP_SHARE_OFFSET)
input_report_key(dev, KEY_RECORD, data[len - 26] & BIT(0));
else
input_report_key(dev, KEY_RECORD, data[len - 18] & BIT(0));
u32 offset = (xpad->mapping & MAP_SHARE_OFFSET) ? 26 : 18;
if (len >= offset)
input_report_key(dev, KEY_RECORD, data[len - offset] & BIT(0));
}
/* buttons A,B,X,Y */

6
drivers/input/misc/atlas_btns.c
View File

@ -60,11 +60,15 @@ static acpi_status acpi_atlas_button_handler(u32 function,
static int atlas_acpi_button_probe(struct platform_device *pdev)
{
struct acpi_device *device = ACPI_COMPANION(&pdev->dev);
struct acpi_device *device;
acpi_status status;
int i;
int err;
device = ACPI_COMPANION(&pdev->dev);
if (!device)
return -ENODEV;
input_dev = input_allocate_device();
if (!input_dev) {
pr_err("unable to allocate input device\n");

2
drivers/input/misc/ims-pcu.c
View File

@ -1624,7 +1624,7 @@ static void ims_pcu_buffers_free(struct ims_pcu *pcu)
usb_kill_urb(pcu->urb_in);
usb_free_urb(pcu->urb_in);
usb_free_coherent(pcu->udev, pcu->max_out_size,
usb_free_coherent(pcu->udev, pcu->max_in_size,
pcu->urb_in_buf, pcu->read_dma);
kfree(pcu->urb_out_buf);

8
drivers/input/mouse/elan_i2c_core.c
View File

@ -162,6 +162,9 @@ static int elan_get_fwinfo(u16 ic_type, u8 iap_version, u16 *validpage_count,
case 0x15:
*validpage_count = 1024;
break;
case 0x19:
*validpage_count = 2032;
break;
default:
/* unknown ic type clear value */
*validpage_count = 0;
@ -645,6 +648,11 @@ static ssize_t elan_sysfs_update_fw(struct device *dev,
return error;
}
if (fw->size < data->fw_signature_address + sizeof(signature)) {
dev_err(dev, "firmware file too small\n");
return -EBADF;
}
/* Firmware file must match signature data */
fw_signature = &fw->data[data->fw_signature_address];
if (memcmp(fw_signature, signature, sizeof(signature)) != 0) {

2
drivers/input/mouse/elan_i2c_i2c.c
View File

@ -690,7 +690,7 @@ static int elan_i2c_finish_fw_update(struct i2c_client *client,
if (error) {
dev_err(dev, "device reset failed: %d\n", error);
} else if (!wait_for_completion_timeout(completion,
msecs_to_jiffies(300))) {
msecs_to_jiffies(700))) {
dev_err(dev, "timeout waiting for device reset\n");
error = -ETIMEDOUT;
}

1
drivers/input/mouse/synaptics.c
View File

@ -190,6 +190,7 @@ static const char * const smbus_pnp_ids[] = {
"LEN2044", /* L470 */
"LEN2054", /* E480 */
"LEN2055", /* E580 */
"LEN2058", /* E490 */
"LEN2068", /* T14 Gen 1 */
"SYN1221", /* TUXEDO InfinityBook Pro 14 v5 */
"SYN3003", /* HP EliteBook 850 G1 */

13
drivers/input/touchscreen/atmel_mxt_ts.c
View File

@ -275,8 +275,8 @@ struct mxt_cfg {
off_t raw_pos;
u8 *mem;
size_t mem_size;
int start_ofs;
u16 mem_size;
u16 start_ofs;
struct mxt_info info;
};
@ -1473,7 +1473,7 @@ static int mxt_prepare_cfg_mem(struct mxt_data *data, struct mxt_cfg *cfg)
}
cfg->raw_pos += offset;
if (i > mxt_obj_size(object))
if (i >= mxt_obj_size(object))
continue;
byte_offset = reg + i - cfg->start_ofs;
@ -1627,6 +1627,13 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *fw)
cfg.start_ofs = MXT_OBJECT_START +
data->info->object_num * sizeof(struct mxt_object) +
MXT_INFO_CHECKSUM_SIZE;
if (data->mem_size <= cfg.start_ofs) {
dev_err(dev, "Memory size too small: %u < %u\n",
data->mem_size, cfg.start_ofs);
return -EINVAL;
}
cfg.mem_size = data->mem_size - cfg.start_ofs;
u8 *mem_buf __free(kfree) = cfg.mem = kzalloc(cfg.mem_size, GFP_KERNEL);

5
drivers/input/touchscreen/usbtouchscreen.c
View File

@ -1067,6 +1067,11 @@ static int nexio_read_data(struct usbtouch_usb *usbtouch, unsigned char *pkt)
if (x_len > 0xff)
x_len -= 0x80;
if (data_len > usbtouch->data_size - sizeof(*packet))
data_len = usbtouch->data_size - sizeof(*packet);
if (x_len > data_len)
x_len = data_len;
/* send ACK */
ret = usb_submit_urb(priv->ack, GFP_ATOMIC);
if (ret)