commit 248d3a73a0 upstream.
The current validation 'wire_order[i] > ARRAY_SIZE(config_pins)' allows
wire_order[i] to equal ARRAY_SIZE(config_pins), which causes out-of-bounds
access when used as index in 'config_pins[wire_order[i]]'.
Since config_pins has 4 elements (indices 0-3), the valid range for
wire_order should be 0-3. Fix the off-by-one error by using >= instead
of > in the validation check.
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Link: https://patch.msgid.link/20251114062817.852698-1-junjie.cao@intel.com
Fixes: bb76dc09dd ("input: ti_am33x_tsc: Order of TSC wires, made configurable")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Pull input fixes from Dmitry Torokhov:
- a fix for regression in input core introduced in 6.11 preventing
re-registering input handlers
- a fix for adp5588-keys driver tyring to disable interrupt 0 at
suspend when devices is used without interrupt
- a fix for edt-ft5x06 to stop leaking regmap structure when probing
fails and to make sure it is not released too early on removal.
* tag 'input-for-v6.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: fix regression when re-registering input handlers
Input: adp5588-keys - do not try to disable interrupt 0
Input: edt-ft5x06 - fix regmap leak when probe fails
The driver neglects to free the instance of I2C regmap constructed at
the beginning of the edt_ft5x06_ts_probe() method when probe fails.
Additionally edt_ft5x06_ts_remove() is freeing the regmap too early,
before the rest of the device resources that are managed by devm are
released.
Fix this by installing a custom devm action that will ensure that the
regmap is released at the right time during normal teardown as well as
in case of probe failure.
Note that devm_regmap_init_i2c() could not be used because the driver
may replace the original regmap with a regmap specific for M06 devices
in the middle of the probe, and using devm_regmap_init_i2c() would
result in releasing the M06 regmap too early.
Reported-by: Li Zetao <lizetao1@huawei.com>
Fixes: 9dfd9708ff ("Input: edt-ft5x06 - convert to use regmap API")
Cc: stable@vger.kernel.org
Reviewed-by: Oliver Graute <oliver.graute@kococonnector.com>
Link: https://lore.kernel.org/r/ZxL6rIlVlgsAu-Jv@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Pull input fixes from Dmitry Torokhov:
- a fix for Zinitix driver to not fail probing if the property enabling
touch keys functionality is not defined. Support for touch keys was
added in 6.12 merge window so this issue does not affect users of
released kernels
- a couple new vendor/device IDs in xpad driver to enable support for
more hardware
* tag 'input-for-v6.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: zinitix - don't fail if linux,keycodes prop is absent
Input: xpad - add support for MSI Claw A1M
Input: xpad - add support for 8BitDo Ultimate 2C Wireless Controller
asm/unaligned.h is always an include of asm-generic/unaligned.h;
might as well move that thing to linux/unaligned.h and include
that - there's nothing arch-specific in that header.
auto-generated by the following:
for i in `git grep -l -w asm/unaligned.h`; do
sed -i -e "s/asm\/unaligned.h/linux\/unaligned.h/" $i
done
for i in `git grep -l -w asm-generic/unaligned.h`; do
sed -i -e "s/asm-generic\/unaligned.h/linux\/unaligned.h/" $i
done
git mv include/asm-generic/unaligned.h include/linux/unaligned.h
git mv tools/include/asm-generic/unaligned.h tools/include/linux/unaligned.h
sed -i -e "/unaligned.h/d" include/asm-generic/Kbuild
sed -i -e "s/__ASM_GENERIC/__LINUX/" include/linux/unaligned.h tools/include/linux/unaligned.h
This regulator is not optional from the controller point of view,
so stop treating it as such. For hard-wired designs that omit the
regulator from their device trees regulator subsystem will create
a dummy instance.
This may introduce unnecessary delay of 100us in case of dummy
regulator, but if it is important the driver should be marked as
using asynchronous probing to avoid even longer delays waiting for
the command completions.
Also use usleep_range() instead of udelay() to avoid spinning.
Tested-by: Andreas Kemnade <andreas@kemnade.info> # Tolino Shine2HD
Link: https://lore.kernel.org/r/20240824055047.1706392-15-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Zforce touch data packet consists of a byte representing number of
contacts followed by several chunks with length of 9 bytes representing
each contact. Instead of accounting for the leading byte by increasing
offset of each field in contacts by one introduce a pointer to contact
data and point it appropriately. This avoids awkward constructs like:
point.prblty = payload[9 * i + 9];
which makes it seem like there is off-by-one error, in favor of more
straightforward:
point.prblty = p[8];
Tested-by: Andreas Kemnade <andreas@kemnade.info> # Tolino Shine2HD
Link: https://lore.kernel.org/r/20240824055047.1706392-11-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
There is a small chance that ts->suspending flag may change while the
interrupt handler is running. To make sure call to pm_relax() is not
skipped on accident use a temporary to hold the original value at the
beginning of interrupt. Use READ_ONCE() so that the value is actually
fetched at the right time.
Tested-by: Andreas Kemnade <andreas@kemnade.info> # Tolino Shine2HD
Link: https://lore.kernel.org/r/20240824055047.1706392-8-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Pull input fixes from Dmitry Torokhov:
- a tweak to uinput interface to reject requests with abnormally large
number of slots. 100 slots/contacts should be enough for real devices
- support for FocalTech FT8201 added to the edt-ft5x06 driver
- tweaks to i8042 to handle more devices that have issue with its
emulation
- Synaptics touchpad switched to native SMbus/RMI mode on HP Elitebook
840 G2
- other minor fixes
* tag 'input-for-v6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: himax_hx83112b - fix incorrect size when reading product ID
Input: i8042 - use new forcenorestore quirk to replace old buggy quirk combination
Input: i8042 - add forcenorestore quirk to leave controller untouched even on s3
Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
Input: uinput - reject requests with unreasonable number of slots
Input: edt-ft5x06 - add support for FocalTech FT8201
dt-bindings: input: touchscreen: edt-ft5x06: Document FT8201 support
Input: adc-joystick - fix optional value handling
Input: synaptics - enable SMBus for HP Elitebook 840 G2
Input: ads7846 - ratelimit the spi_sync error message
The cyttsp4 touchscreen driver was contributed in 2013 and since then
has seen no updates. The driver uses platform data (no device tree
support) and there are no users of it in the mainline kernel. There were
occasional fixes to it for issues either found by static code analysis
tools or via visual inspection, but otherwise the driver is completely
untested.
Remove the driver.
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://lore.kernel.org/r/ZrAZ2cUow_z838tp@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The driver does not try to power down the rails at system suspend or
when touchscreen is not in use, but rather enables regulators at probe
time. Power savings are achieved by requesting the controller to enter
low power mode.
Switch to devm_regulator_bulk_get_enable() instead of separately
requesting regulators, enabling them, and installing a custom
devm-action to disable them on unbind/remove, which simplifies the
code.
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/ZrAgj9rG6oVqfdoK@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Instead of setting irq_set_irq_wake() directly in probe(), mark the device
as wakeup-capable, and use enable_irq_wake() and disable_irq_wake() in
suspend/resume path.
This also allows changing the wakeup setting dynamically at runtime using
/sys/devices/.../tsc2005/power/wakeup.
Reviewed-By: Sebastian Reichel <sre@kernel.org>
Link: https://lore.kernel.org/r/20240711172719.1248373-4-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
When the driver has been converted to use gpiod API it was requesting
and asserting the reset on probe, but never deasserted it. However
because of incorrect annotations in device tree marking reset line as
active high whereas in reality it is active low, the end result was
that the chip was never reset on probe. With polarity of the reset line
now corrected this became a problem.
Fix this by calling tsc200x_reset() from tsc200x_probe() to properly
complete the reset sequence and move requesting the reset GPIO and VIO
supply closer to the point where we need to start talking to the
hardware.
Fixes: d257f2980f ("Input: tsc2005 - convert to gpiod")
Link: https://lore.kernel.org/r/20240711172719.1248373-3-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The chip needs to be powered up before calling tsc200x_stop_scan() which
communicates with it; move the call to enable the regulator earlier in
tsc200x_probe().
At the same time switch to using devm_regulator_get_enable() to simplify
error handling. This also makes sure that regulator is not shut off too
early when unbinding the driver.
Link: https://lore.kernel.org/r/20240711172719.1248373-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
