With CONFIG_DEBUG_SLAB=y:
# Subtest: input_core
1..3
input: Test input device as /devices/virtual/input/input1
8<--- cut here ---
Unable to handle kernel paging request at virtual address 6b6b6dd7 when read
...
__lock_acquire from lock_acquire+0x26c/0x300
lock_acquire from _raw_spin_lock_irqsave+0x50/0x64
_raw_spin_lock_irqsave from devres_remove+0x20/0x7c
devres_remove from devres_destroy+0x8/0x24
devres_destroy from input_free_device+0x2c/0x60
input_free_device from kunit_try_run_case+0x70/0x94 [kunit]
Without CONFIG_DEBUG_SLAB=y:
KTAP version 1
# Subtest: input_core
1..3
input: Test input device as /devices/virtual/input/input1
------------[ cut here ]------------
WARNING: CPU: 0 PID: 694 at lib/refcount.c:28 refcount_warn_saturate+0x54/0x100
refcount_t: underflow; use-after-free.
...
Call Trace: [<0037cad4>] dump_stack+0xc/0x10
[<00377614>] __warn+0x7e/0xb4
[<0037768c>] warn_slowpath_fmt+0x42/0x62
[<001eee1c>] refcount_warn_saturate+0x54/0x100
[<000b1d34>] kfree_const+0x0/0x20
[<0036290a>] __kobject_del+0x0/0x6e
[<001eee1c>] refcount_warn_saturate+0x54/0x100
[<00362a1a>] kobject_put+0xa2/0xb6
[<11965770>] kunit_generic_run_threadfn_adapter+0x0/0x1c [kunit]
As per the comments for input_allocate_device() and
input_register_device(), input_free_device() must be called only to free
devices that have not been registered. input_unregister_device()
already calls input_put_device(), thus leading to a use-after-free.
Moreover, the kunit_suite.exit() method is called after every test case,
even on failures. As the test itself already does cleanups in its
failure paths, this may lead to a second use-after-free.
Fix the first issue by dropping the call to input_allocate_device() from
input_test_exit().
Fix the second issue by making the cleanup code conditional on a
successful test.
Fixes: fdefcbdd6f ("Input: Add KUnit tests for some of the input core helper functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://lore.kernel.org/r/957b3b309a44d39fb6e38b2a526b250f69ea3d2c.1683022164.git.geert+renesas@glider.be
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Currently, uinput doesn't use the input_set_timestamp API, so any
event injected using uinput is not accurately timestamped in terms of
measuring when the actual event happened. Hence, call the
input_set_timestamp API from uinput in order to provide a more
accurate sense of time for the event. Propagate only the timestamps
which are a) positive, b) within a pre-defined offset (10 secs) from
the current time, and c) not in the future.
Signed-off-by: Biswarup Pal <biswarupp@google.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Siarhei Vishniakou <svv@google.com>
Link: https://lore.kernel.org/r/20230427000152.1407471-1-biswarupp@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The watchdog_timer can schedule tx_timeout_task and watchdog_work
can also arm watchdog_timer. The process is shown below:
----------- timer schedules work ------------
cyttsp4_watchdog_timer() //timer handler
schedule_work(&cd->watchdog_work)
----------- work arms timer ------------
cyttsp4_watchdog_work() //workqueue callback function
cyttsp4_start_wd_timer()
mod_timer(&cd->watchdog_timer, ...)
Although del_timer_sync() and cancel_work_sync() are called in
cyttsp4_remove(), the timer and workqueue could still be rearmed.
As a result, the possible use after free bugs could happen. The
process is shown below:
(cleanup routine) | (timer and workqueue routine)
cyttsp4_remove() | cyttsp4_watchdog_timer() //timer
cyttsp4_stop_wd_timer() | schedule_work()
del_timer_sync() |
| cyttsp4_watchdog_work() //worker
| cyttsp4_start_wd_timer()
| mod_timer()
cancel_work_sync() |
| cyttsp4_watchdog_timer() //timer
| schedule_work()
del_timer_sync() |
kfree(cd) //FREE |
| cyttsp4_watchdog_work() // reschedule!
| cd-> //USE
This patch changes del_timer_sync() to timer_shutdown_sync(),
which could prevent rearming of the timer from the workqueue.
Fixes: 17fb1563d6 ("Input: cyttsp4 - add core driver for Cypress TMA4XX touchscreen devices")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://lore.kernel.org/r/20230421082919.8471-1-duoming@zju.edu.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Pull input updates from Dmitry Torokhov:
- a new driver for Novatek touch controllers
- a new driver for power button for NXP BBNSM
- a skeleton KUnit tests for the input core
- improvements to Xpad game controller driver to support more devices
- improvements to edt-ft5x06, hideep and other drivers
* tag 'input-for-v6.4-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (42 commits)
Revert "Input: xpad - fix support for some third-party controllers"
dt-bindings: input: pwm-beeper: convert to dt schema
Input: xpad - fix PowerA EnWired Controller guide button
Input: xpad - add constants for GIP interface numbers
Input: synaptics-rmi4 - fix function name in kerneldoc
Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe
Input: edt-ft5x06 - select REGMAP_I2C
Input: melfas_mip4 - report palm touches
Input: cma3000_d0x - remove unneeded code
Input: edt-ft5x06 - calculate points data length only once
Input: edt-ft5x06 - unify the crc check
Input: edt-ft5x06 - convert to use regmap API
Input: edt-ft5x06 - don't print error messages with dev_dbg()
Input: edt-ft5x06 - remove code duplication
Input: edt-ft5x06 - don't recalculate the CRC
Input: edt-ft5x06 - add spaces to ensure format specification
Input: edt-ft5x06 - remove unnecessary blank lines
Input: edt-ft5x06 - fix indentation
Input: tsc2007 - enable cansleep pendown GPIO
Input: Add KUnit tests for some of the input core helper functions
...
First of all, previously the 16-bit magnitude was written as-is to the
device which actually discarded the upper 8 bits since the device has
8-bit registers only. This meant that a strong_magnitude of 0xFF00 would
result in 0. To correct this shift the strong_magnitude / weak_magnitude
input values so we discard the lower 8 bits and keep the upper bits
instead.
Secondly the RTP mode that is used by default interprets the values as
signed (2s complement), so 0x81 = 0%, 0x00 = 50%, 0x7F = 100%. This
doesn't match the FF_RUMBLE interface at all, so let's tell the device
to interpret the data as unsigned instead which gets us 0x00 = 0% and
0xFF = 100%.
As last change switch ERM to using "Closed-Loop Mode, Unidirectional"
instead of "Open-Loop Mode" since it's recommended by the datasheet
compared to open loop and better matches our use case of 0% - 100%
vibration.
Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
Link: https://lore.kernel.org/r/20230430-drv260x-improvements-v1-4-1fb28b4cc698@z3ntu.xyz
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Pull thermal control updates from Rafael Wysocki:
"These mostly continue to prepare the thermal control subsystem for
using unified representation of trip points, which includes cleanups,
code refactoring and similar and update several drivers (for other
reasons), which includes new hardware support.
Specifics:
- Add a thermal zone 'devdata' accessor and modify several drivers to
use it (Daniel Lezcano)
- Prevent drivers from using the 'device' internal thermal zone
structure field directly (Daniel Lezcano)
- Clean up the hwmon thermal driver (Daniel Lezcano)
- Add thermal zone id accessor and thermal zone type accessor and
prevent drivers from using thermal zone fields directly (Daniel
Lezcano)
- Clean up the acerhdf and tegra thermal drivers (Daniel Lezcano)
- Add lower bound check for sysfs input to the x86_pkg_temp_thermal
Intel thermal driver (Zhang Rui)
- Add more thermal zone device encapsulation: prevent setting
structure field directly, access the sensor device instead the
thermal zone's device for trace, relocate the traces in
drivers/thermal (Daniel Lezcano)
- Use the generic trip point for the i.MX and remove the
get_trip_temp ops (Daniel Lezcano)
- Use the devm_platform_ioremap_resource() in the Hisilicon driver
(Yang Li)
- Remove R-Car H3 ES1.* handling as public has only access to the ES2
version and the upstream support for the ES1 has been shutdown
(Wolfram Sang)
- Add a delay after initializing the bank in order to let the time to
the hardware to initialze itself before reading the temperature
(Amjad Ouled-Ameur)
- Add MT8365 support (Amjad Ouled-Ameur)
- Preparational cleanup and DT bindings for RK3588 support (Sebastian
Reichel)
- Add driver support for RK3588 (Finley Xiao)
- Use devm_reset_control_array_get_exclusive() for the Rockchip
driver (Ye Xingchen)
- Detect power gated thermal zones and return -EAGAIN when reading
the temperature (Mikko Perttunen)
- Remove thermal_bind_params structure as it is unused (Zhang Rui)
- Drop unneeded quotes in DT bindings allowing to run yamllint (Rob
Herring)
- Update the power allocator documentation according to the thermal
trace relocation (Lukas Bulwahn)
- Fix sensor 1 interrupt status bitmask for the Mediatek LVTS sensor
(Chen-Yu Tsai)
- Use the dev_err_probe() helper in the Amlogic driver (Ye Xingchen)
- Add AP domain support to LVTS thermal controllers for mt8195
(Balsam CHIHI)
- Remove buggy call to thermal_of_zone_unregister() (Daniel Lezcano)
- Make thermal_of_zone_[un]register() private to the thermal OF code
(Daniel Lezcano)
- Create a private copy of the thermal zone device parameters
structure when registering a thermal zone (Daniel Lezcano)
- Fix a kernel NULL pointer dereference in thermal_hwmon (Zhang Rui)
- Revert recent message adjustment in thermal_hwmon (Rafael Wysocki)
- Use of_property_present() for testing DT property presence in
thermal control code (Rob Herring)
- Clean up thermal_list_lock locking in the thermal core (Rafael
Wysocki)
- Add DLVR support for RFIM control in the int340x Intel thermal
driver (Srinivas Pandruvada)"
* tag 'thermal-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (55 commits)
thermal: intel: int340x: Add DLVR support for RFIM control
thermal/core: Alloc-copy-free the thermal zone parameters structure
thermal/of: Unexport unused OF functions
thermal/drivers/bcm2835: Remove buggy call to thermal_of_zone_unregister
thermal/drivers/mediatek/lvts_thermal: Add AP domain for mt8195
dt-bindings: thermal: mediatek: Add AP domain to LVTS thermal controllers for mt8195
thermal: amlogic: Use dev_err_probe()
thermal/drivers/mediatek/lvts_thermal: Fix sensor 1 interrupt status bitmask
MAINTAINERS: adjust entry in THERMAL/POWER_ALLOCATOR after header movement
dt-bindings: thermal: Drop unneeded quotes
thermal/core: Remove thermal_bind_params structure
thermal/drivers/tegra-bpmp: Handle offline zones
thermal/drivers/rockchip: use devm_reset_control_array_get_exclusive()
dt-bindings: rockchip-thermal: Support the RK3588 SoC compatible
thermal/drivers/rockchip: Support RK3588 SoC in the thermal driver
thermal/drivers/rockchip: Support dynamic sized sensor array
thermal/drivers/rockchip: Simplify channel id logic
thermal/drivers/rockchip: Use dev_err_probe
thermal/drivers/rockchip: Simplify clock logic
thermal/drivers/rockchip: Simplify getting match data
...
Pull gpio updates from Bartosz Golaszewski:
"We have some new drivers, significant refactoring of existing intel
platforms, lots of improvements all around, mass conversion to using
immutable irqchips by drivers that had not been converted individually
yet and some changes in the core library code.
Summary:
New drivers:
- add a driver for the Loongson GPIO controller
- add a driver for the fxl6408 I2C GPIO expander
- add a GPIO module containing code common for Intel Elkhart Lake and
Merrifield platforms
- add a driver for the Intel Elkhart Lake platform reusing the code
from the intel tangier library
GPIOLIB core:
- GPIO ACPI improvements
- simplify gpiochip_add_data_with_keys() fwnode handling
- cleanup header inclusions (remove unneeded ones, order the rest
alphabetically)
- remove duplicate code (reuse krealloc() instead of open-coding it,
drop a duplicated check in gpiod_find_and_request())
- reshuffle the code to remove unnecessary forward declarations
- coding style cleanups and improvements
- add a helper for accessing device fwnodes
- small updates in docs
Driver improvements:
- convert all remaining GPIO irqchip drivers to using immutable
irqchips
- drop unnecessary of_match_ptr() macro expansions
- shrink the code in gpio-merrifield significantly by reusing the
code from gpio-tangier + minor tweaks to the driver code
- remove MODULE_LICENSE() from drivers that can only be built-in
- add device-tree support to gpio-loongson1
- use new regmap features in gpio-104-dio-48e and gpio-pcie-idio-24
- minor tweaks and fixes to gpio-xra1403, gpio-sim, gpio-tegra194,
gpio-omap, gpio-aspeed, gpio-raspberrypi-exp
- shrink code in gpio-ich and gpio-pxa
- Kconfig tweak for gpio-pmic-eic-sprd"
* tag 'gpio-updates-for-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (99 commits)
gpio: gpiolib: Simplify gpiochip_add_data_with_key() fwnode
gpiolib: Add gpiochip_set_data() helper
gpiolib: Move gpiochip_get_data() higher in the code
gpiolib: Check array_info for NULL only once in gpiod_get_array()
gpiolib: Replace open coded krealloc()
gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xNU
gpiolib: acpi: Move ACPI device NULL check to acpi_get_driver_gpio_data()
gpiolib: acpi: use the fwnode in acpi_gpiochip_find()
gpio: mm-lantiq: Fix typo in the newly added header filename
sh: mach-x3proto: Add missing #include <linux/gpio/driver.h>
powerpc/40x: Add missing select OF_GPIO_MM_GPIOCHIP
gpio: xlp: Convert to immutable irq_chip
gpio: xilinx: Convert to immutable irq_chip
gpio: xgs-iproc: Convert to immutable irq_chip
gpio: visconti: Convert to immutable irq_chip
gpio: tqmx86: Convert to immutable irq_chip
gpio: thunderx: Convert to immutable irq_chip
gpio: stmpe: Convert to immutable irq_chip
gpio: siox: Convert to immutable irq_chip
gpio: rda: Convert to immutable irq_chip
...
Pull input fixes from Dmitry Torokhov:
- a check in pegasus-notetaker driver to validate the type of pipe when
probing a new device
- a fix for Cypress touch controller to correctly parse maximum number
of touches.
* tag 'input-for-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: cyttsp5 - fix sensing configuration data structure
Input: pegasus-notetaker - check pipe type when probing
Prior to this patch, the sensing configuration data was not parsed
correctly, breaking detection of max_tch. The vendor driver includes
this field. This change informs the driver about the correct maximum
number of simultaneous touch inputs.
Tested on a Pine64 PineNote with a modified touch screen controller
firmware.
Signed-off-by: hrdl <git@hrdl.eu>
Reviewed-by: Alistair Francis <alistair@alistair23.me>
Link: https://lore.kernel.org/r/20230411211651.3791304-1-git@hrdl.eu
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
After starting to use regmap API to access registers the edt-ft5x06
driver depends on symbols provided by REGMAP_I2C:
edt-ft5x06.o: in function `edt_ft5x06_ts_probe':
edt-ft5x06.c:1154: undefined reference to `__regmap_init_i2c'
edt-ft5x06.o: in function `edt_ft5x06_ts_identify':
edt-ft5x06.c:897: undefined reference to `__regmap_init_i2c'
Make sure support for I2C regmap is actually selected by adding this
dependency to Kconfig.
Fixes: 9dfd9708ff ("Input: edt-ft5x06 - convert to use regmap API")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Link: https://lore.kernel.org/r/ZDRBExF1xmxalMZc@makrotopia.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The driver had the code to differentiate between finger and palm touches,
but did not use this information when reporting contacts. Change it so that
proper "tool" type is assigned to reported contacts.
Signed-off-by: JungHoon Hyun <hyunjunghoon@melfas.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The input subsystem doesn't currently have any unit tests, let's add a
CONFIG_INPUT_KUNIT_TEST option that builds a test suite to be executed
with the KUnit test infrastructure.
For now, only three tests were added for some of the input core helper
functions that are trivial to test:
* input_test_polling: set/get poll interval and set-up a poll handler.
* input_test_timestamp: set/get input event timestamps.
* input_test_match_device_id: match a device by bus, vendor, product,
version and events capable of handling.
But having the minimal KUnit support allows to add more tests and suites
as follow-up changes. The tests can be run with the following command:
$ ./tools/testing/kunit/kunit.py run --kunitconfig=drivers/input/tests/
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Tested-by: Enric Balletbo i Serra <eballetbo@redhat.com>
config: powerpc-allnoconfig (https://download.01.org/0day-ci/archive/20230330/202303301815.kRKFM3NH-lkp@intel.com/config)
Link: https://lore.kernel.org/r/20230330081831.2291351-1-javierm@redhat.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Some third-party controllers, such as the HORPIAD FPS for Nintendo Switch and
Gamesir-G3w, require a specific packet that the first-party XInput driver sends
before it will start sending reports. It's not currently known what this packet
does, but since the first-party driver always sends it's unlikely that this
could cause issues with existing controllers.
Co-authored-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Vicki Pfau <vi@endrift.com>
Link: https://lore.kernel.org/r/20230324040446.3487725-3-vi@endrift.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Pull input fixes from Dmitry Torokhov:
- fixes to ALPS and Focaltech PS/2 drivers dealing with the breakage of
switching to -funsigned-char
- quirks to i8042 to better handle Lifebook A574/H and TUXEDO devices
- a quirk to Goodix touchscreen driver to handle Yoga Book X90F
- a fix for incorrectly merged patch to xpad game controller driver
* tag 'input-for-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: i8042 - add TUXEDO devices to i8042 quirk tables for partial fix
Input: alps - fix compatibility with -funsigned-char
Input: focaltech - use explicitly signed char type
Input: xpad - fix incorrectly applied patch for MAP_PROFILE_BUTTON
Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table
Input: i8042 - add quirk for Fujitsu Lifebook A574/H
The list of specific VID/PID combinations for various controllers recently
added a new field "xtype". However, this field isn't used, nor filled in
the table itself, and was likely added by mistake and overlooked during
review. Since this field isn't used, it's safe to remove.
Signed-off-by: Vicki Pfau <vi@endrift.com>
Link: https://lore.kernel.org/r/20230225012147.276489-3-vi@endrift.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
A lot of modern Clevo barebones have touchpad and/or keyboard issues after
suspend fixable with nomux + reset + noloop + nopnp. Luckily, none of them
have an external PS/2 port so this can safely be set for all of them.
I'm not entirely sure if every device listed really needs all four quirks,
but after testing and production use, no negative effects could be
observed when setting all four.
Setting SERIO_QUIRK_NOMUX or SERIO_QUIRK_RESET_ALWAYS on the Clevo N150CU
and the Clevo NHxxRZQ makes the keyboard very laggy for ~5 seconds after
boot and sometimes also after resume. However both are required for the
keyboard to not fail completely sometimes after boot or resume.
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230321191619.647911-1-wse@tuxedocomputers.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The AlpsPS/2 code previously relied on the assumption that `char` is a
signed type, which was true on x86 platforms (the only place where this
driver is used) before kernel 6.2. However, on 6.2 and later, this
assumption is broken due to the introduction of -funsigned-char as a new
global compiler flag.
Fix this by explicitly specifying the signedness of `char` when sign
extending the values received from the device.
Fixes: f3f33c6776 ("Input: alps - Rushmore and v7 resolution support")
Signed-off-by: msizanoen <msizanoen@qtmlabs.xyz>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230320045228.182259-1-msizanoen@qtmlabs.xyz
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
If a platform driver's remove callback returns non-zero the driver core
emits an error message. In such a case however iqs62x_keys_remove()
already issued a (better) message. So return zero to suppress the
generic message.
This patch has no other side effects as platform_remove() ignores the
return value of .remove() after the warning.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20230318225110.261439-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The driver can match only via the DT table so the table should be always
used and the of_match_ptr does not have any sense (this also allows ACPI
matching via PRP0001, even though it might not be relevant here). This
also fixes !CONFIG_OF error:
drivers/input/touchscreen/sun4i-ts.c:392:34: error: ‘sun4i_ts_of_match’ defined but not used [-Werror=unused-const-variable=]
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://lore.kernel.org/r/20230312131514.351603-3-krzysztof.kozlowski@linaro.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
