Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:
 "Fixes to the Synaptics RMI4 driver and fix for use after free in error
  path handling of the Cypress TTSP driver"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: cyttsp4_core - fix use after free bug
  Input: synaptics-rmi4 - clear IRQ enables for F54
  Input: synaptics-rmi4 - remove unused result_bits mask
  Input: synaptics-rmi4 - do not consume more data than we have (F11, F12)
  Input: synaptics-rmi4 - disable the relative position IRQ in the F12 driver
  Input: synaptics-rmi4 - fix video buffer size

diff --git a/drivers/input/rmi4/rmi_f11.c b/drivers/input/rmi4/rmi_f11.c
index f28a7158b2efc572d88dc941481e8b41d62ef825..bbf9ae9f3f0cbfa98144cbe6560db3fcbd425cf9 100644 (file)
--- a/drivers/input/rmi4/rmi_f11.c
+++ b/drivers/input/rmi4/rmi_f11.c
@@ -510,7 +510,6 @@ struct f11_data {
        struct rmi_2d_sensor_platform_data sensor_pdata;
        unsigned long *abs_mask;
        unsigned long *rel_mask;
-       unsigned long *result_bits;
 };
 
 enum f11_finger_state {
@@ -1057,7 +1056,7 @@ static int rmi_f11_initialize(struct rmi_function *fn)
        /*
        ** init instance data, fill in values and create any sysfs files
        */
-       f11 = devm_kzalloc(&fn->dev, sizeof(struct f11_data) + mask_size * 3,
+       f11 = devm_kzalloc(&fn->dev, sizeof(struct f11_data) + mask_size * 2,
                        GFP_KERNEL);
        if (!f11)
                return -ENOMEM;
@@ -1076,8 +1075,6 @@ static int rmi_f11_initialize(struct rmi_function *fn)
                        + sizeof(struct f11_data));
        f11->rel_mask = (unsigned long *)((char *)f11
                        + sizeof(struct f11_data) + mask_size);
-       f11->result_bits = (unsigned long *)((char *)f11
-                       + sizeof(struct f11_data) + mask_size * 2);
 
        set_bit(fn->irq_pos, f11->abs_mask);
        set_bit(fn->irq_pos + 1, f11->rel_mask);
@@ -1284,8 +1281,8 @@ static irqreturn_t rmi_f11_attention(int irq, void *ctx)
                        valid_bytes = f11->sensor.attn_size;
                memcpy(f11->sensor.data_pkt, drvdata->attn_data.data,
                        valid_bytes);
-               drvdata->attn_data.data += f11->sensor.attn_size;
-               drvdata->attn_data.size -= f11->sensor.attn_size;
+               drvdata->attn_data.data += valid_bytes;
+               drvdata->attn_data.size -= valid_bytes;
        } else {
                error = rmi_read_block(rmi_dev,
                                data_base_addr, f11->sensor.data_pkt,

diff --git a/drivers/input/rmi4/rmi_f12.c b/drivers/input/rmi4/rmi_f12.c
index d20a5d6780d1d40b209f40da0c9342493aef9ed3..7e97944f76165339e4302c2e4c7875d27d8b4550 100644 (file)
--- a/drivers/input/rmi4/rmi_f12.c
+++ b/drivers/input/rmi4/rmi_f12.c
@@ -55,6 +55,9 @@ struct f12_data {
 
        const struct rmi_register_desc_item *data15;
        u16 data15_offset;
+
+       unsigned long *abs_mask;
+       unsigned long *rel_mask;
 };
 
 static int rmi_f12_read_sensor_tuning(struct f12_data *f12)
@@ -209,8 +212,8 @@ static irqreturn_t rmi_f12_attention(int irq, void *ctx)
                        valid_bytes = sensor->attn_size;
                memcpy(sensor->data_pkt, drvdata->attn_data.data,
                        valid_bytes);
-               drvdata->attn_data.data += sensor->attn_size;
-               drvdata->attn_data.size -= sensor->attn_size;
+               drvdata->attn_data.data += valid_bytes;
+               drvdata->attn_data.size -= valid_bytes;
        } else {
                retval = rmi_read_block(rmi_dev, f12->data_addr,
                                        sensor->data_pkt, sensor->pkt_size);
@@ -291,9 +294,18 @@ static int rmi_f12_write_control_regs(struct rmi_function *fn)
 static int rmi_f12_config(struct rmi_function *fn)
 {
        struct rmi_driver *drv = fn->rmi_dev->driver;
+       struct f12_data *f12 = dev_get_drvdata(&fn->dev);
+       struct rmi_2d_sensor *sensor;
        int ret;
 
-       drv->set_irq_bits(fn->rmi_dev, fn->irq_mask);
+       sensor = &f12->sensor;
+
+       if (!sensor->report_abs)
+               drv->clear_irq_bits(fn->rmi_dev, f12->abs_mask);
+       else
+               drv->set_irq_bits(fn->rmi_dev, f12->abs_mask);
+
+       drv->clear_irq_bits(fn->rmi_dev, f12->rel_mask);
 
        ret = rmi_f12_write_control_regs(fn);
        if (ret)
@@ -315,9 +327,12 @@ static int rmi_f12_probe(struct rmi_function *fn)
        struct rmi_device_platform_data *pdata = rmi_get_platform_data(rmi_dev);
        struct rmi_driver_data *drvdata = dev_get_drvdata(&rmi_dev->dev);
        u16 data_offset = 0;
+       int mask_size;
 
        rmi_dbg(RMI_DEBUG_FN, &fn->dev, "%s\n", __func__);
 
+       mask_size = BITS_TO_LONGS(drvdata->irq_count) * sizeof(unsigned long);
+
        ret = rmi_read(fn->rmi_dev, query_addr, &buf);
        if (ret < 0) {
                dev_err(&fn->dev, "Failed to read general info register: %d\n",
@@ -332,10 +347,19 @@ static int rmi_f12_probe(struct rmi_function *fn)
                return -ENODEV;
        }
 
-       f12 = devm_kzalloc(&fn->dev, sizeof(struct f12_data), GFP_KERNEL);
+       f12 = devm_kzalloc(&fn->dev, sizeof(struct f12_data) + mask_size * 2,
+                       GFP_KERNEL);
        if (!f12)
                return -ENOMEM;
 
+       f12->abs_mask = (unsigned long *)((char *)f12
+                       + sizeof(struct f12_data));
+       f12->rel_mask = (unsigned long *)((char *)f12
+                       + sizeof(struct f12_data) + mask_size);
+
+       set_bit(fn->irq_pos, f12->abs_mask);
+       set_bit(fn->irq_pos + 1, f12->rel_mask);
+
        f12->has_dribble = !!(buf & BIT(3));
 
        if (fn->dev.of_node) {

diff --git a/drivers/input/rmi4/rmi_f54.c b/drivers/input/rmi4/rmi_f54.c
index 710b025954860f7c3a8253668ead8068b65ca971..484ae1f973304001ea4320196852b61f6066a7ce 100644 (file)
--- a/drivers/input/rmi4/rmi_f54.c
+++ b/drivers/input/rmi4/rmi_f54.c
@@ -359,7 +359,7 @@ static const struct vb2_ops rmi_f54_queue_ops = {
 static const struct vb2_queue rmi_f54_queue = {
        .type = V4L2_BUF_TYPE_VIDEO_CAPTURE,
        .io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF | VB2_READ,
-       .buf_struct_size = sizeof(struct vb2_buffer),
+       .buf_struct_size = sizeof(struct vb2_v4l2_buffer),
        .ops = &rmi_f54_queue_ops,
        .mem_ops = &vb2_vmalloc_memops,
        .timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC,
@@ -601,7 +601,7 @@ static int rmi_f54_config(struct rmi_function *fn)
 {
        struct rmi_driver *drv = fn->rmi_dev->driver;
 
-       drv->set_irq_bits(fn->rmi_dev, fn->irq_mask);
+       drv->clear_irq_bits(fn->rmi_dev, fn->irq_mask);
 
        return 0;
 }

diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c
index 4b22d49a0f49add22299e9c2d0bcc6d6937bd276..6bcffc930384a4f5fbd8cbf0d4c334b934bd470c 100644 (file)
--- a/drivers/input/touchscreen/cyttsp4_core.c
+++ b/drivers/input/touchscreen/cyttsp4_core.c
@@ -1990,11 +1990,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd)
 
        /* get sysinfo */
        md->si = &cd->sysinfo;
-       if (!md->si) {
-               dev_err(dev, "%s: Fail get sysinfo pointer from core p=%p\n",
-                       __func__, md->si);
-               goto error_get_sysinfo;
-       }
 
        rc = cyttsp4_setup_input_device(cd);
        if (rc)
@@ -2004,8 +1999,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd)
 
 error_init_input:
        input_free_device(md->input);
-error_get_sysinfo:
-       input_set_drvdata(md->input, NULL);
 error_alloc_failed:
        dev_err(dev, "%s failed.\n", __func__);
        return rc;