* [PATCH v2 1/6] dt-bindings: olpc,ap-sp: add clock
From: Lubomir Rintel @ 2018-11-12 2:30 UTC (permalink / raw)
To: Dmitry Torokhov, Michael Turquette, Stephen Boyd, linux-input
Cc: linux-kernel, linux-clk, devicetree, Rob Herring, Mark Rutland,
Lubomir Rintel
In-Reply-To: <20181112023029.648408-1-lkundrak@v3.sk>
The clock is necessary for the device operation, hence it's required.
Its name, "sp", stands for "Security Processor". It is one of several
names that are used for the processor that serves as the keyboard
controller on an OLPC and is consistent with the node name.
Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Reviewed-by: Rob Herring <robh@kernel.org>
Acked-by: Pavel Machek <pavel@ucw.cz>
---
Documentation/devicetree/bindings/serio/olpc,ap-sp.txt | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt b/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
index 0e72183f52bc..36603419d6f8 100644
--- a/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
+++ b/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
@@ -4,10 +4,14 @@ Required properties:
- compatible : "olpc,ap-sp"
- reg : base address and length of SoC's WTM registers
- interrupts : SP-AP interrupt
+- clocks : phandle + clock-specifier for the clock that drives the WTM
+- clock-names: should be "sp"
Example:
ap-sp@d4290000 {
compatible = "olpc,ap-sp";
reg = <0xd4290000 0x1000>;
interrupts = <40>;
+ clocks = <&soc_clocks MMP2_CLK_SP>;
+ clock-names = "sp";
}
--
2.19.1
^ permalink raw reply related
* [PATCH v2 2/6] dt-bindings: marvell,mmp2: Add clock id for the SP clock
From: Lubomir Rintel @ 2018-11-12 2:30 UTC (permalink / raw)
To: Dmitry Torokhov, Michael Turquette, Stephen Boyd, linux-input
Cc: linux-kernel, linux-clk, devicetree, Rob Herring, Mark Rutland,
Lubomir Rintel
In-Reply-To: <20181112023029.648408-1-lkundrak@v3.sk>
This is the clock for the "security processor" core.
Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Reviewed-by: Rob Herring <robh@kernel.org>
Acked-by: Stephen Boyd <sboyd@kernel.org>
Acked-by: Pavel Machek <pavel@ucw.cz>
---
include/dt-bindings/clock/marvell,mmp2.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/dt-bindings/clock/marvell,mmp2.h b/include/dt-bindings/clock/marvell,mmp2.h
index 228a5e234af0..7b24fc791146 100644
--- a/include/dt-bindings/clock/marvell,mmp2.h
+++ b/include/dt-bindings/clock/marvell,mmp2.h
@@ -71,6 +71,7 @@
#define MMP2_CLK_CCIC1_MIX 117
#define MMP2_CLK_CCIC1_PHY 118
#define MMP2_CLK_CCIC1_SPHY 119
+#define MMP2_CLK_SP 120
#define MMP2_NR_CLKS 200
#endif
--
2.19.1
^ permalink raw reply related
* [PATCH v2 3/6] clk: mmp2: add SP clock
From: Lubomir Rintel @ 2018-11-12 2:30 UTC (permalink / raw)
To: Dmitry Torokhov, Michael Turquette, Stephen Boyd, linux-input
Cc: linux-kernel, linux-clk, devicetree, Rob Herring, Mark Rutland,
Lubomir Rintel
In-Reply-To: <20181112023029.648408-1-lkundrak@v3.sk>
The "security processor", sometimes referred to as "wireless trusted
module" or "generic encrypt unit" is a low-power core present on MMP2,
that has nothing to do with security, wireless, trust or encryption.
On an OLPC machine it runs CForth and serves as a keyboard controller:
http://dev.laptop.org/git/users/wmb/cforth/tree/src/app/arm-xo-1.75/ps2.fth
The register address was obtained from the OLPC kernel, since the
datasheet seems to be the Marvell's most important business secret.
Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Acked-by: Stephen Boyd <sboyd@kernel.org>
Acked-by: Pavel Machek <pavel@ucw.cz>
---
drivers/clk/mmp/clk-of-mmp2.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
index d083b860f083..61fefc046ec5 100644
--- a/drivers/clk/mmp/clk-of-mmp2.c
+++ b/drivers/clk/mmp/clk-of-mmp2.c
@@ -53,6 +53,7 @@
#define APMU_DISP1 0x110
#define APMU_CCIC0 0x50
#define APMU_CCIC1 0xf4
+#define APMU_SP 0x68
#define MPMU_UART_PLL 0x14
struct mmp2_clk_unit {
@@ -209,6 +210,8 @@ static struct mmp_clk_mix_config ccic1_mix_config = {
.reg_info = DEFINE_MIX_REG_INFO(4, 16, 2, 6, 32),
};
+static DEFINE_SPINLOCK(sp_lock);
+
static struct mmp_param_mux_clk apmu_mux_clks[] = {
{MMP2_CLK_DISP0_MUX, "disp0_mux", disp_parent_names, ARRAY_SIZE(disp_parent_names), CLK_SET_RATE_PARENT, APMU_DISP0, 6, 2, 0, &disp0_lock},
{MMP2_CLK_DISP1_MUX, "disp1_mux", disp_parent_names, ARRAY_SIZE(disp_parent_names), CLK_SET_RATE_PARENT, APMU_DISP1, 6, 2, 0, &disp1_lock},
@@ -239,6 +242,7 @@ static struct mmp_param_gate_clk apmu_gate_clks[] = {
{MMP2_CLK_CCIC1, "ccic1_clk", "ccic1_mix_clk", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x1b, 0x1b, 0x0, 0, &ccic1_lock},
{MMP2_CLK_CCIC1_PHY, "ccic1_phy_clk", "ccic1_mix_clk", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x24, 0x24, 0x0, 0, &ccic1_lock},
{MMP2_CLK_CCIC1_SPHY, "ccic1_sphy_clk", "ccic1_sphy_div", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x300, 0x300, 0x0, 0, &ccic1_lock},
+ {MMP2_CLK_SP, "sp_clk", NULL, CLK_SET_RATE_PARENT, APMU_SP, 0x1b, 0x1b, 0x0, 0, &sp_lock},
};
static void mmp2_axi_periph_clk_init(struct mmp2_clk_unit *pxa_unit)
--
2.19.1
^ permalink raw reply related
* [PATCH v2 4/6] Input: olpc_apsp: drop CONFIG_OLPC dependency
From: Lubomir Rintel @ 2018-11-12 2:30 UTC (permalink / raw)
To: Dmitry Torokhov, Michael Turquette, Stephen Boyd, linux-input
Cc: linux-kernel, linux-clk, devicetree, Rob Herring, Mark Rutland,
Lubomir Rintel
In-Reply-To: <20181112023029.648408-1-lkundrak@v3.sk>
CONFIG_OLPC is specific to the x86 platform code, while the driver is for
an ARM-based laptop.
Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Acked-by: Pavel Machek <pavel@ucw.cz>
---
drivers/input/serio/Kconfig | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/input/serio/Kconfig b/drivers/input/serio/Kconfig
index d90d9f1098ff..c9c7224d5ae0 100644
--- a/drivers/input/serio/Kconfig
+++ b/drivers/input/serio/Kconfig
@@ -254,7 +254,6 @@ config SERIO_APBPS2
config SERIO_OLPC_APSP
tristate "OLPC AP-SP input support"
- depends on OLPC || COMPILE_TEST
help
Say Y here if you want support for the keyboard and touchpad included
in the OLPC XO-1.75 and XO-4 laptops.
--
2.19.1
^ permalink raw reply related
* [PATCH v2 5/6] Input: olpc_apsp: check FIFO status on open(), not probe()
From: Lubomir Rintel @ 2018-11-12 2:30 UTC (permalink / raw)
To: Dmitry Torokhov, Michael Turquette, Stephen Boyd, linux-input
Cc: linux-kernel, linux-clk, devicetree, Rob Herring, Mark Rutland,
Lubomir Rintel
In-Reply-To: <20181112023029.648408-1-lkundrak@v3.sk>
Let's defer the FIFO status checking until open().
When we'll get a clk handle, this will allow us to defer clock enablement
until the device is actually used.
Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
---
drivers/input/serio/olpc_apsp.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/input/serio/olpc_apsp.c b/drivers/input/serio/olpc_apsp.c
index 8e9a4209fcad..8b19a47dfa46 100644
--- a/drivers/input/serio/olpc_apsp.c
+++ b/drivers/input/serio/olpc_apsp.c
@@ -145,8 +145,15 @@ static int olpc_apsp_open(struct serio *port)
{
struct olpc_apsp *priv = port->port_data;
unsigned int tmp;
+ unsigned long l;
if (priv->open_count++ == 0) {
+ l = readl(priv->base + COMMAND_FIFO_STATUS);
+ if (!(l & CMD_STS_MASK)) {
+ dev_err(priv->dev, "SP cannot accept commands.\n");
+ return -EIO;
+ }
+
/* Enable interrupt 0 by clearing its bit */
tmp = readl(priv->base + PJ_INTERRUPT_MASK);
writel(tmp & ~INT_0, priv->base + PJ_INTERRUPT_MASK);
@@ -173,7 +180,6 @@ static int olpc_apsp_probe(struct platform_device *pdev)
struct olpc_apsp *priv;
struct resource *res;
struct device_node *np;
- unsigned long l;
int error;
priv = devm_kzalloc(&pdev->dev, sizeof(struct olpc_apsp), GFP_KERNEL);
@@ -192,12 +198,6 @@ static int olpc_apsp_probe(struct platform_device *pdev)
if (priv->irq < 0)
return priv->irq;
- l = readl(priv->base + COMMAND_FIFO_STATUS);
- if (!(l & CMD_STS_MASK)) {
- dev_err(&pdev->dev, "SP cannot accept commands.\n");
- return -EIO;
- }
-
/* KEYBOARD */
kb_serio = kzalloc(sizeof(struct serio), GFP_KERNEL);
if (!kb_serio)
--
2.19.1
^ permalink raw reply related
* [PATCH v2 6/6] Input: olpc_apsp: enable the SP clock
From: Lubomir Rintel @ 2018-11-12 2:30 UTC (permalink / raw)
To: Dmitry Torokhov, Michael Turquette, Stephen Boyd, linux-input
Cc: linux-kernel, linux-clk, devicetree, Rob Herring, Mark Rutland,
Lubomir Rintel
In-Reply-To: <20181112023029.648408-1-lkundrak@v3.sk>
Without the clock, the keyboard controller won't operate.
Tested on an OLPC XO 1.75.
Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Acked-by: Pavel Machek <pavel@ucw.cz>
---
Changes since v1:
- Disable the clock in error handling path
drivers/input/serio/olpc_apsp.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/input/serio/olpc_apsp.c b/drivers/input/serio/olpc_apsp.c
index 8b19a47dfa46..91d6fb8d7d8d 100644
--- a/drivers/input/serio/olpc_apsp.c
+++ b/drivers/input/serio/olpc_apsp.c
@@ -23,6 +23,7 @@
#include <linux/of.h>
#include <linux/slab.h>
#include <linux/delay.h>
+#include <linux/clk.h>
/*
* The OLPC XO-1.75 and XO-4 laptops do not have a hardware PS/2 controller.
@@ -74,6 +75,7 @@ struct olpc_apsp {
struct serio *kbio;
struct serio *padio;
void __iomem *base;
+ struct clk *clk;
int open_count;
int irq;
};
@@ -146,11 +148,17 @@ static int olpc_apsp_open(struct serio *port)
struct olpc_apsp *priv = port->port_data;
unsigned int tmp;
unsigned long l;
+ int error;
if (priv->open_count++ == 0) {
+ error = clk_prepare_enable(priv->clk);
+ if (error)
+ return error;
+
l = readl(priv->base + COMMAND_FIFO_STATUS);
if (!(l & CMD_STS_MASK)) {
dev_err(priv->dev, "SP cannot accept commands.\n");
+ clk_disable_unprepare(priv->clk);
return -EIO;
}
@@ -171,6 +179,8 @@ static void olpc_apsp_close(struct serio *port)
/* Disable interrupt 0 */
tmp = readl(priv->base + PJ_INTERRUPT_MASK);
writel(tmp | INT_0, priv->base + PJ_INTERRUPT_MASK);
+
+ clk_disable_unprepare(priv->clk);
}
}
@@ -198,6 +208,10 @@ static int olpc_apsp_probe(struct platform_device *pdev)
if (priv->irq < 0)
return priv->irq;
+ priv->clk = devm_clk_get(&pdev->dev, "sp");
+ if (IS_ERR(priv->clk))
+ return PTR_ERR(priv->clk);
+
/* KEYBOARD */
kb_serio = kzalloc(sizeof(struct serio), GFP_KERNEL);
if (!kb_serio)
--
2.19.1
^ permalink raw reply related
* Re: [PATCH] HID: input: Ignore battery reported by Symbol DS4308
From: Benjamin Tissoires @ 2018-11-12 11:12 UTC (permalink / raw)
To: bleung
Cc: Jiri Kosina, open list:HID CORE LAYER, lkml, Dmitry Torokhov,
Dmitry Torokhov
In-Reply-To: <CAO-hwJ+FpX6evn-6J1TU6RmXq-3OhGGB21Qb4LdfNNcRuYkQEQ@mail.gmail.com>
On Fri, Nov 9, 2018 at 9:50 AM Benjamin Tissoires
<benjamin.tissoires@redhat.com> wrote:
>
> On Fri, Nov 9, 2018 at 12:59 AM Benson Leung <bleung@chromium.org> wrote:
> >
> > The Motorola/Zebra Symbol DS4308-HD is a handheld USB barcode scanner
> > which does not have a battery, but reports one anyway that always has
> > capacity 2.
> >
> > Let's apply the IGNORE quirk to prevent it from being treated like a
> > power supply so that userspaces don't get confused that this
> > accessory is almost out of power and warn the user that they need to charge
> > their wired barcode scanner.
> >
> > Reported here: https://bugs.chromium.org/p/chromium/issues/detail?id=804720
> >
> > Signed-off-by: Benson Leung <bleung@chromium.org>
> > ---
>
> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
And applied, thanks
>
> > drivers/hid/hid-ids.h | 1 +
> > drivers/hid/hid-input.c | 3 +++
> > 2 files changed, 4 insertions(+)
> >
> > diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
> > index c0d668944dbe..07f6348b9f86 100644
> > --- a/drivers/hid/hid-ids.h
> > +++ b/drivers/hid/hid-ids.h
> > @@ -1043,6 +1043,7 @@
> > #define USB_VENDOR_ID_SYMBOL 0x05e0
> > #define USB_DEVICE_ID_SYMBOL_SCANNER_1 0x0800
> > #define USB_DEVICE_ID_SYMBOL_SCANNER_2 0x1300
> > +#define USB_DEVICE_ID_SYMBOL_SCANNER_3 0x1200
> >
> > #define USB_VENDOR_ID_SYNAPTICS 0x06cb
> > #define USB_DEVICE_ID_SYNAPTICS_TP 0x0001
> > diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
> > index a2f74e6adc70..44ea8e7c71a9 100644
> > --- a/drivers/hid/hid-input.c
> > +++ b/drivers/hid/hid-input.c
> > @@ -325,6 +325,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
> > { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM,
> > USB_DEVICE_ID_ELECOM_BM084),
> > HID_BATTERY_QUIRK_IGNORE },
> > + { HID_USB_DEVICE(USB_VENDOR_ID_SYMBOL,
> > + USB_DEVICE_ID_SYMBOL_SCANNER_3),
> > + HID_BATTERY_QUIRK_IGNORE },
> > {}
> > };
> >
> > --
> > 2.19.1.930.g4563a0d9d0-goog
> >
^ permalink raw reply
* Re: [PATCH] HID: hidraw: enforce minors_lock locking via lockdep
From: Jiri Kosina @ 2018-11-12 11:45 UTC (permalink / raw)
To: Benjamin Tissoires; +Cc: open list:HID CORE LAYER, lkml
In-Reply-To: <CAO-hwJJehHLJfgrQvbrW0_bOTTeH-v1qhZK0p0WZCuVDR1wsKw@mail.gmail.com>
On Fri, 9 Nov 2018, Benjamin Tissoires wrote:
> On Thu, Nov 8, 2018 at 10:38 PM Jiri Kosina <jikos@kernel.org> wrote:
> >
> > From: Jiri Kosina <jkosina@suse.cz>
> >
> > lockdep is much more powerful enforcing the locking rules than code comments,
> > so let's switch to it.
> >
> > Signed-off-by: Jiri Kosina <jkosina@suse.cz>
> > ---
>
> Looks good to me.
>
> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
I actually missed the comment removal for hidraw_get_report(). I've
ammeded the patch and comitted, keeping your tag, please shout if you
disagree :)
Thanks.
--
Jiri Kosina
SUSE Labs
^ permalink raw reply
* Re: [PATCH] input: cros_ec_keyb: fix button/switch capability reports
From: Dmitry Torokhov @ 2018-11-12 19:24 UTC (permalink / raw)
To: Brian Norris
Cc: Enric Balletbo i Serra, linux-kernel, linux-input, Doug Anderson
In-Reply-To: <20181107223813.178462-1-briannorris@chromium.org>
On Wed, Nov 07, 2018 at 02:38:13PM -0800, Brian Norris wrote:
> The cros_ec_keyb_bs array lists buttons and switches together, expecting
> that its users will match the appropriate type and bit fields. But
> cros_ec_keyb_register_bs() only checks the 'bit' field, which causes
> misreported input capabilities in some cases. For example, tablets
> (e.g., Scarlet -- a.k.a. Acer Chromebook Tab 10) were reporting a SW_LID
> capability, because EC_MKBP_POWER_BUTTON and EC_MKBP_LID_OPEN happen to
> share the same bit.
>
> (This has comedic effect on a tablet, in which a power-management daemon
> then thinks this "lid" is closed, and so puts the system to sleep as
> soon as it boots!)
>
> To fix this, check both the 'ev_type' and 'bit' fields before reporting
> the capability.
>
> Tested with a lid (Kevin / Samsung Chromebook Plus) and without a lid
> (Scarlet / Acer Chromebook Tab 10).
>
> This error got introduced when porting the feature from the downstream
> Chromium OS kernel to be upstreamed.
>
> Fixes: cdd7950e7aa4 ("input: cros_ec_keyb: Add non-matrix buttons and switches")
> Cc: <stable@vger.kernel.org>
> Cc: Douglas Anderson <dianders@chromium.org>
> Cc: Enric Balletbo i Serra <enric.balletbo@collabora.com>
> Signed-off-by: Brian Norris <briannorris@chromium.org>
Applied, thank you.
> ---
> drivers/input/keyboard/cros_ec_keyb.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
> index 81be6f781f0b..d56001181598 100644
> --- a/drivers/input/keyboard/cros_ec_keyb.c
> +++ b/drivers/input/keyboard/cros_ec_keyb.c
> @@ -493,7 +493,8 @@ static int cros_ec_keyb_register_bs(struct cros_ec_keyb *ckdev)
> for (i = 0; i < ARRAY_SIZE(cros_ec_keyb_bs); i++) {
> const struct cros_ec_bs_map *map = &cros_ec_keyb_bs[i];
>
> - if (buttons & BIT(map->bit))
> + if ((map->ev_type == EV_KEY && (buttons & BIT(map->bit))) ||
> + (map->ev_type == EV_SW && (switches & BIT(map->bit))))
> input_set_capability(idev, map->ev_type, map->code);
> }
>
> --
> 2.19.1.930.g4563a0d9d0-goog
>
--
Dmitry
^ permalink raw reply
* Re: [PATCH] dt-bindings: input: Fix a typo in file input-reset.txt
From: Dmitry Torokhov @ 2018-11-12 19:27 UTC (permalink / raw)
To: Ding Tao; +Cc: robh+dt, mark.rutland, linux-input, devicetree, linux-kernel
In-Reply-To: <20181107055819.7527-1-miyatsu@qq.com>
On Wed, Nov 07, 2018 at 05:58:19AM +0000, Ding Tao wrote:
> Replace sysrq-reset-seq with keyset.
>
> Signed-off-by: Ding Tao <miyatsu@qq.com>
Applied, thank you.
> ---
> Documentation/devicetree/bindings/input/input-reset.txt | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/Documentation/devicetree/bindings/input/input-reset.txt b/Documentation/devicetree/bindings/input/input-reset.txt
> index 2bb2626fdb78..1ca6cc5ebf8e 100644
> --- a/Documentation/devicetree/bindings/input/input-reset.txt
> +++ b/Documentation/devicetree/bindings/input/input-reset.txt
> @@ -12,7 +12,7 @@ The /chosen node should contain a 'linux,sysrq-reset-seq' child node to define
> a set of keys.
>
> Required property:
> -sysrq-reset-seq: array of Linux keycodes, one keycode per cell.
> +keyset: array of Linux keycodes, one keycode per cell.
>
> Optional property:
> timeout-ms: duration keys must be pressed together in milliseconds before
> --
> 2.17.1
>
--
Dmitry
^ permalink raw reply
* Re: [PATCH] input: atkbd: clean up indentation issue, add missing tab in an if statement
From: Dmitry Torokhov @ 2018-11-12 19:41 UTC (permalink / raw)
To: Colin King; +Cc: linux-input, kernel-janitors, linux-kernel
In-Reply-To: <20181101151224.14840-1-colin.king@canonical.com>
On Thu, Nov 01, 2018 at 03:12:24PM +0000, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> Trivial fix to clean up indentation issues, add missing tab
>
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Applied, thank you.
> ---
> drivers/input/keyboard/atkbd.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
> index 7e75835e220f..850bb259c20e 100644
> --- a/drivers/input/keyboard/atkbd.c
> +++ b/drivers/input/keyboard/atkbd.c
> @@ -841,7 +841,7 @@ static int atkbd_select_set(struct atkbd *atkbd, int target_set, int allow_extra
> if (param[0] != 3) {
> param[0] = 2;
> if (ps2_command(ps2dev, param, ATKBD_CMD_SSCANSET))
> - return 2;
> + return 2;
> }
>
> ps2_command(ps2dev, param, ATKBD_CMD_SETALL_MBR);
> --
> 2.19.1
>
--
Dmitry
^ permalink raw reply
* Re: [PATCH] driver: input: fix UBSAN warning in input_defuzz_abs_event
From: Dmitry Torokhov @ 2018-11-12 19:48 UTC (permalink / raw)
To: liujian; +Cc: linux-input, linux-kernel
In-Reply-To: <1541166531-248528-1-git-send-email-liujian56@huawei.com>
Hi,
On Fri, Nov 02, 2018 at 09:48:51PM +0800, liujian wrote:
> syzkaller triggered a UBCAN warning:
>
> [ 196.188950] UBSAN: Undefined behaviour in drivers/input/input.c:62:23
> [ 196.188958] signed integer overflow:
> [ 196.188964] -2147483647 - 104 cannot be represented in type 'int [2]'
> [ 196.188973] CPU: 7 PID: 4763 Comm: syz-executor Not tainted
> 4.19.0-514.55.6.9.x86_64+ #7
> [ 196.188977] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
> [ 196.188979] Call Trace:
> [ 196.189001] dump_stack+0x91/0xeb
> [ 196.189014] ubsan_epilogue+0x9/0x7c
> [ 196.189020] handle_overflow+0x1d7/0x22c
> [ 196.189028] ? __ubsan_handle_negate_overflow+0x18f/0x18f
> [ 196.189038] ? __mutex_lock+0x213/0x13f0
> [ 196.189053] ? drop_futex_key_refs+0xa0/0xa0
> [ 196.189070] ? __might_fault+0xef/0x1b0
> [ 196.189096] input_handle_event+0xe1b/0x1290
> [ 196.189108] input_inject_event+0x1d7/0x27e
> [ 196.189119] evdev_write+0x2cf/0x3f0
> [ 196.189129] ? evdev_pass_values+0xd40/0xd40
> [ 196.189157] ? mark_held_locks+0x160/0x160
> [ 196.189171] ? __vfs_write+0xe0/0x6c0
> [ 196.189175] ? evdev_pass_values+0xd40/0xd40
> [ 196.189179] __vfs_write+0xe0/0x6c0
> [ 196.189186] ? kernel_read+0x130/0x130
> [ 196.189204] ? _cond_resched+0x15/0x30
> [ 196.189214] ? __inode_security_revalidate+0xb8/0xe0
> [ 196.189222] ? selinux_file_permission+0x354/0x430
> [ 196.189233] vfs_write+0x160/0x440
> [ 196.189242] ksys_write+0xc1/0x190
> [ 196.189248] ? __ia32_sys_read+0xb0/0xb0
> [ 196.189259] ? trace_hardirqs_on_thunk+0x1a/0x1c
> [ 196.189267] ? do_syscall_64+0x22/0x4a0
> [ 196.189276] do_syscall_64+0xa5/0x4a0
> [ 196.189287] entry_SYSCALL_64_after_hwframe+0x49/0xbe
> [ 196.189293] RIP: 0033:0x44e7c9
> [ 196.189299] Code: fc ff 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00
>
> the syzkaller reproduce script(but can't reproduce it every time):
>
> r0 = syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x2,
> 0x1)
> write$binfmt_elf64(r0, &(0x7f0000000240)={{0x7f, 0x45, 0x4c, 0x46, 0x40,
> 0x2, 0x2, 0xffffffff, 0xffffffffffff374c, 0x3, 0x0, 0x80000001, 0x103,
> 0x40, 0x22e, 0x26, 0x1, 0x38, 0x2, 0xa23, 0x1, 0x2}, [{0x6474e557, 0x5,
> 0x6, 0x2, 0x9, 0x9, 0x6c3, 0x1ff}], "", [[], [], [], []]}, 0x478)
> ioctl$EVIOCGSW(0xffffffffffffffff, 0x8040451b, &(0x7f0000000040)=""/7)
> syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x2, 0x1)
> r1 = syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x2,
> 0x1)
> openat$smack_task_current(0xffffffffffffff9c,
> &(0x7f0000000040)='/proc/self/attr/current\x00', 0x2, 0x0)
> ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000000)={0x4, 0x10000, 0x4,
> 0xd1, 0x81, 0x3})
> eventfd(0x1ff)
> syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x2,
> 0x200)
> syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x2, 0x1)
> syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x2, 0x1)
> syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x2, 0x1)
> syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x2, 0x1)
>
> Typecast int to long to fix the issue.
Does this fix 32-bit platforms where long equals int? BTW, I'd prefer if
we did not have to do 64 bit arithmetic on 32 bit arches here, if
possible.
Thanks.
--
Dmitry
^ permalink raw reply
* Re: [PATCH v5 1/8] dt-bindings: mfd: document stpmic1
From: Lee Jones @ 2018-11-13 7:29 UTC (permalink / raw)
To: Pascal PAILLET-LME
Cc: dmitry.torokhov@gmail.com, robh+dt@kernel.org,
mark.rutland@arm.com, lgirdwood@gmail.com, broonie@kernel.org,
wim@linux-watchdog.org, linux@roeck-us.net,
linux-input@vger.kernel.org, devicetree@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-watchdog@vger.kernel.org,
benjamin.gaignard@linaro.org, eballetbo@gmail.com,
axel.lin@ingics.com
In-Reply-To: <1540830122-2577-2-git-send-email-p.paillet@st.com>
On Mon, 29 Oct 2018, Pascal PAILLET-LME wrote:
> stpmic1 is a pmic from STMicroelectronics. The STPMIC1 integrates 10
Nit: "STPMIC1 is a PMIC".
Once corrected, please apply my:
For my own reference:
Acked-for-MFD-by: Lee Jones <lee.jones@linaro.org>
--
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog
^ permalink raw reply
* Re: [PATCH v5 2/8] mfd: stpmic1: add stpmic1 driver
From: Lee Jones @ 2018-11-13 7:40 UTC (permalink / raw)
To: Pascal PAILLET-LME
Cc: dmitry.torokhov@gmail.com, robh+dt@kernel.org,
mark.rutland@arm.com, lgirdwood@gmail.com, broonie@kernel.org,
wim@linux-watchdog.org, linux@roeck-us.net,
linux-input@vger.kernel.org, devicetree@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-watchdog@vger.kernel.org,
benjamin.gaignard@linaro.org, eballetbo@gmail.com,
axel.lin@ingics.com
In-Reply-To: <1540830122-2577-3-git-send-email-p.paillet@st.com>
On Mon, 29 Oct 2018, Pascal PAILLET-LME wrote:
> stpmic1 is a pmic from STMicroelectronics. The STPMIC1 integrates 10
"STPMIC1 is a PMIC"
> regulators, 3 power switches, a watchdog and an input for a power on key.
>
> Signed-off-by: Pascal Paillet <p.paillet@st.com>
> ---
> changes in v5:
> * use macro to define regmap register ranges
> * use REGMAP_IRQ_REG marco to define interrupts
> * remove st properties
>
> drivers/mfd/Kconfig | 13 +++
> drivers/mfd/Makefile | 1 +
> drivers/mfd/stpmic1.c | 215 ++++++++++++++++++++++++++++++++++++++++++++
> include/linux/mfd/stpmic1.h | 212 +++++++++++++++++++++++++++++++++++++++++++
> 4 files changed, 444 insertions(+)
> create mode 100644 drivers/mfd/stpmic1.c
> create mode 100644 include/linux/mfd/stpmic1.h
>
> diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
> index 11841f4..07e39a6 100644
> --- a/drivers/mfd/Kconfig
> +++ b/drivers/mfd/Kconfig
> @@ -1855,6 +1855,22 @@ config MFD_STM32_TIMERS
> for PWM and IIO Timer. This driver allow to share the
> registers between the others drivers.
>
> +config MFD_STPMIC1
> + tristate "Support for STPMIC1 PMIC"
> + depends on (I2C=y && OF)
> + select REGMAP_I2C
> + select REGMAP_IRQ
> + select MFD_CORE
> + help
> + Support for ST Microelectronics STPMIC1 PMIC. STPMIC1 has power on
> + key, watchdog and regulator functionalities which are supported via
> + the relevant subsystems. This driver provides core support for the
> + STPMIC1, in order to use the actual functionaltiy of the device other
s/,/./
> + drivers must be enabled.
> +
> + To compile this driver as a module, choose M here: the
> + module will be called stpmic1.
> +
> menu "Multimedia Capabilities Port drivers"
> depends on ARCH_SA1100
>
> diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile
> index 5856a94..76fff14 100644
> --- a/drivers/mfd/Makefile
> +++ b/drivers/mfd/Makefile
> @@ -232,6 +232,7 @@ obj-$(CONFIG_INTEL_SOC_PMIC_CHTDC_TI) += intel_soc_pmic_chtdc_ti.o
> obj-$(CONFIG_MFD_MT6397) += mt6397-core.o
>
> obj-$(CONFIG_MFD_ALTERA_A10SR) += altera-a10sr.o
> +obj-$(CONFIG_MFD_STPMIC1) += stpmic1.o
> obj-$(CONFIG_MFD_SUN4I_GPADC) += sun4i-gpadc.o
>
> obj-$(CONFIG_MFD_STM32_LPTIMER) += stm32-lptimer.o
> diff --git a/drivers/mfd/stpmic1.c b/drivers/mfd/stpmic1.c
> new file mode 100644
> index 0000000..2f4fd5e
> --- /dev/null
> +++ b/drivers/mfd/stpmic1.c
> @@ -0,0 +1,215 @@
> +// SPDX-License-Identifier: GPL-2.0
> +// Copyright (C) STMicroelectronics 2018
> +// Author: Pascal Paillet <p.paillet@st.com>
> +
> +#include <linux/i2c.h>
> +#include <linux/interrupt.h>
> +#include <linux/mfd/core.h>
> +#include <linux/mfd/stpmic1.h>
> +#include <linux/module.h>
> +#include <linux/of.h>
> +#include <linux/of_irq.h>
> +#include <linux/of_platform.h>
> +#include <linux/pm_wakeirq.h>
> +#include <linux/regmap.h>
> +
> +#include <dt-bindings/mfd/st,stpmic1.h>
> +
> +#define STPMIC1_MAIN_IRQ 0
> +
> +static const struct regmap_range stpmic1_readable_ranges[] = {
> + regmap_reg_range(TURN_ON_SR, VERSION_SR),
> + regmap_reg_range(SWOFF_PWRCTRL_CR, LDO6_STDBY_CR),
> + regmap_reg_range(BST_SW_CR, BST_SW_CR),
> + regmap_reg_range(INT_PENDING_R1, INT_PENDING_R4),
> + regmap_reg_range(INT_CLEAR_R1, INT_CLEAR_R4),
> + regmap_reg_range(INT_MASK_R1, INT_MASK_R4),
> + regmap_reg_range(INT_SET_MASK_R1, INT_SET_MASK_R4),
> + regmap_reg_range(INT_CLEAR_MASK_R1, INT_CLEAR_MASK_R4),
> + regmap_reg_range(INT_SRC_R1, INT_SRC_R1),
> +};
> +
> +static const struct regmap_range stpmic1_writeable_ranges[] = {
> + regmap_reg_range(SWOFF_PWRCTRL_CR, LDO6_STDBY_CR),
> + regmap_reg_range(BST_SW_CR, BST_SW_CR),
> + regmap_reg_range(INT_CLEAR_R1, INT_CLEAR_R4),
> + regmap_reg_range(INT_SET_MASK_R1, INT_SET_MASK_R4),
> + regmap_reg_range(INT_CLEAR_MASK_R1, INT_CLEAR_MASK_R4),
> +};
> +
> +static const struct regmap_range stpmic1_volatile_ranges[] = {
> + regmap_reg_range(TURN_ON_SR, VERSION_SR),
> + regmap_reg_range(WCHDG_CR, WCHDG_CR),
> + regmap_reg_range(INT_PENDING_R1, INT_PENDING_R4),
> + regmap_reg_range(INT_SRC_R1, INT_SRC_R4),
> +};
Nice!
> +static const struct regmap_access_table stpmic1_readable_table = {
> + .yes_ranges = stpmic1_readable_ranges,
> + .n_yes_ranges = ARRAY_SIZE(stpmic1_readable_ranges),
> +};
> +
> +static const struct regmap_access_table stpmic1_writeable_table = {
> + .yes_ranges = stpmic1_writeable_ranges,
> + .n_yes_ranges = ARRAY_SIZE(stpmic1_writeable_ranges),
> +};
> +
> +static const struct regmap_access_table stpmic1_volatile_table = {
> + .yes_ranges = stpmic1_volatile_ranges,
> + .n_yes_ranges = ARRAY_SIZE(stpmic1_volatile_ranges),
> +};
> +
> +const struct regmap_config stpmic1_regmap_config = {
> + .reg_bits = 8,
> + .val_bits = 8,
> + .cache_type = REGCACHE_RBTREE,
> + .max_register = PMIC_MAX_REGISTER_ADDRESS,
> + .rd_table = &stpmic1_readable_table,
> + .wr_table = &stpmic1_writeable_table,
> + .volatile_table = &stpmic1_volatile_table,
> +};
> +
> +static const struct regmap_irq stpmic1_irqs[] = {
> + REGMAP_IRQ_REG(IT_PONKEY_F, 0, 0x01),
> + REGMAP_IRQ_REG(IT_PONKEY_R, 0, 0x02),
> + REGMAP_IRQ_REG(IT_WAKEUP_F, 0, 0x04),
> + REGMAP_IRQ_REG(IT_WAKEUP_R, 0, 0x08),
> + REGMAP_IRQ_REG(IT_VBUS_OTG_F, 0, 0x10),
> + REGMAP_IRQ_REG(IT_VBUS_OTG_R, 0, 0x20),
> + REGMAP_IRQ_REG(IT_SWOUT_F, 0, 0x40),
> + REGMAP_IRQ_REG(IT_SWOUT_R, 0, 0x80),
> +
> + REGMAP_IRQ_REG(IT_CURLIM_BUCK1, 1, 0x01),
> + REGMAP_IRQ_REG(IT_CURLIM_BUCK2, 1, 0x02),
> + REGMAP_IRQ_REG(IT_CURLIM_BUCK3, 1, 0x04),
> + REGMAP_IRQ_REG(IT_CURLIM_BUCK4, 1, 0x08),
> + REGMAP_IRQ_REG(IT_OCP_OTG, 1, 0x10),
> + REGMAP_IRQ_REG(IT_OCP_SWOUT, 1, 0x20),
> + REGMAP_IRQ_REG(IT_OCP_BOOST, 1, 0x40),
> + REGMAP_IRQ_REG(IT_OVP_BOOST, 1, 0x80),
> +
> + REGMAP_IRQ_REG(IT_CURLIM_LDO1, 2, 0x01),
> + REGMAP_IRQ_REG(IT_CURLIM_LDO2, 2, 0x02),
> + REGMAP_IRQ_REG(IT_CURLIM_LDO3, 2, 0x04),
> + REGMAP_IRQ_REG(IT_CURLIM_LDO4, 2, 0x08),
> + REGMAP_IRQ_REG(IT_CURLIM_LDO5, 2, 0x10),
> + REGMAP_IRQ_REG(IT_CURLIM_LDO6, 2, 0x20),
> + REGMAP_IRQ_REG(IT_SHORT_SWOTG, 2, 0x40),
> + REGMAP_IRQ_REG(IT_SHORT_SWOUT, 2, 0x80),
> +
> + REGMAP_IRQ_REG(IT_TWARN_F, 3, 0x01),
> + REGMAP_IRQ_REG(IT_TWARN_R, 3, 0x02),
> + REGMAP_IRQ_REG(IT_VINLOW_F, 3, 0x04),
> + REGMAP_IRQ_REG(IT_VINLOW_R, 3, 0x08),
> + REGMAP_IRQ_REG(IT_SWIN_F, 3, 0x40),
> + REGMAP_IRQ_REG(IT_SWIN_R, 3, 0x80),
> +};
> +
> +static const struct regmap_irq_chip stpmic1_regmap_irq_chip = {
> + .name = "pmic_irq",
> + .status_base = INT_PENDING_R1,
> + .mask_base = INT_CLEAR_MASK_R1,
> + .unmask_base = INT_SET_MASK_R1,
> + .ack_base = INT_CLEAR_R1,
> + .num_regs = STPMIC1_PMIC_NUM_IRQ_REGS,
> + .irqs = stpmic1_irqs,
> + .num_irqs = ARRAY_SIZE(stpmic1_irqs),
> +};
> +
> +static int stpmic1_probe(struct i2c_client *i2c,
> + const struct i2c_device_id *id)
> +{
> + struct stpmic1 *ddata;
> + struct device *dev = &i2c->dev;
> + int ret;
> + struct device_node *np = dev->of_node;
> + u32 reg;
> +
> + ddata = devm_kzalloc(dev, sizeof(struct stpmic1), GFP_KERNEL);
> + if (!ddata)
> + return -ENOMEM;
> +
> + i2c_set_clientdata(i2c, ddata);
> + ddata->dev = dev;
> +
> + ddata->regmap = devm_regmap_init_i2c(i2c, &stpmic1_regmap_config);
> + if (IS_ERR(ddata->regmap))
> + return PTR_ERR(ddata->regmap);
> +
> + ddata->irq = of_irq_get(np, STPMIC1_MAIN_IRQ);
> + if (ddata->irq < 0) {
> + dev_err(dev, "Failed to get main IRQ: %d\n", ddata->irq);
> + return ddata->irq;
> + }
> +
> + /* Read Version ID */
I think the MACRO name and error message make this comment
superfluous.
> + ret = regmap_read(ddata->regmap, VERSION_SR, ®);
> + if (ret) {
> + dev_err(dev, "Unable to read pmic version\n");
"PMIC"
> + return ret;
> + }
> + dev_info(dev, "PMIC Chip Version: 0x%x\n", reg);
> +
> + /* Initialize PMIC IRQ Chip & IRQ domains associated */
"associated IRQ domains"
> + ret = devm_regmap_add_irq_chip(dev, ddata->regmap, ddata->irq,
> + IRQF_ONESHOT | IRQF_SHARED,
> + 0, &stpmic1_regmap_irq_chip,
> + &ddata->irq_data);
> + if (ret) {
> + dev_err(dev, "IRQ Chip registration failed: %d\n", ret);
> + return ret;
> + }
> +
> + return devm_of_platform_populate(dev);
> +}
> +
> +static const struct i2c_device_id stpmic1_id[] = {
> + { "stpmic1"},
> + {}
> +};
I don't think this is required any more.
> +MODULE_DEVICE_TABLE(i2c, stpmic1_id);
--
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog
^ permalink raw reply
* Re: BUG: GPF in non-whitelisted uaccess (non-canonical address?)
From: syzbot @ 2018-11-14 0:25 UTC (permalink / raw)
To: benjamin.tissoires, dh.herrmann, jikos, linux-input, linux-kernel,
syzkaller-bugs
In-Reply-To: <00000000000080f8fa057a67b75c@google.com>
syzbot has found a reproducer for the following crash on:
HEAD commit: ccda4af0f4b9 Linux 4.20-rc2
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13b4e77b400000
kernel config: https://syzkaller.appspot.com/x/.config?x=4a0a89f12ca9b0f5
dashboard link: https://syzkaller.appspot.com/bug?extid=72473edc9bf4eb1c6556
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1646a225400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=108a6533400000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+72473edc9bf4eb1c6556@syzkaller.appspotmail.com
audit: type=1400 audit(1542154838.102:35): avc: denied { map } for
pid=6149 comm="bash" path="/bin/bash" dev="sda1" ino=1457
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
audit: type=1400 audit(1542154844.872:36): avc: denied { map } for
pid=6163 comm="syz-executor697" path="/root/syz-executor697315096"
dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
BUG: GPF in non-whitelisted uaccess (non-canonical address?)
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 6163 Comm: syz-executor697 Not tainted 4.20.0-rc2+ #112
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20
arch/x86/lib/copy_user_64.S:180
Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f
80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 <f3> a4 31 c0 0f
1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 83
RSP: 0018:ffff8881d188f398 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 0000000000000109 RCX: 0000000000000109
RDX: 0000000000000109 RSI: 241037f828e5769d RDI: ffff8881ce130738
RBP: ffff8881d188f3d0 R08: ffffed1039c26109 R09: ffffed1039c26109
R10: ffffed1039c26108 R11: ffff8881ce130840 R12: 241037f828e577a6
R13: 241037f828e5769d R14: ffff8881ce130738 R15: ffffffffffffffff
FS: 0000000001dab880(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020d83ff8 CR3: 00000001b6a5c000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
copy_from_user include/linux/uaccess.h:147 [inline]
uhid_dev_create+0x20c/0xb40 drivers/hid/uhid.c:542
uhid_char_write+0xc74/0xef0 drivers/hid/uhid.c:725
__vfs_write+0x119/0x9f0 fs/read_write.c:485
__kernel_write+0x10c/0x370 fs/read_write.c:506
write_pipe_buf+0x180/0x240 fs/splice.c:797
splice_from_pipe_feed fs/splice.c:503 [inline]
__splice_from_pipe+0x38b/0x7c0 fs/splice.c:627
splice_from_pipe+0x1ec/0x340 fs/splice.c:662
default_file_splice_write+0x3c/0x90 fs/splice.c:809
do_splice_from fs/splice.c:851 [inline]
direct_splice_actor+0x128/0x190 fs/splice.c:1018
splice_direct_to_actor+0x318/0x8f0 fs/splice.c:973
do_splice_direct+0x2d4/0x420 fs/splice.c:1061
do_sendfile+0x62a/0xe20 fs/read_write.c:1439
__do_sys_sendfile64 fs/read_write.c:1494 [inline]
__se_sys_sendfile64 fs/read_write.c:1486 [inline]
__x64_sys_sendfile64+0x15d/0x250 fs/read_write.c:1486
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x440309
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffcd9cfe2e8 EFLAGS: 00000203 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440309
RDX: 0000000020d83ff8 RSI: 0000000000000004 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8
R10: 00008000fffffffe R11: 0000000000000203 R12: 0000000000401b90
R13: 0000000000401c20 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace d77e684529ebafbc ]---
RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20
arch/x86/lib/copy_user_64.S:180
Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f
80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 <f3> a4 31 c0 0f
1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 83
RSP: 0018:ffff8881d188f398 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 0000000000000109 RCX: 0000000000000109
RDX: 0000000000000109 RSI: 241037f828e5769d RDI: ffff8881ce130738
RBP: ffff8881d188f3d0 R08: ffffed1039c26109 R09: ffffed1039c26109
R10: ffffed1039c26108 R11: ffff8881ce130840 R12: 241037f828e577a6
R13: 241037f828e5769d R14: ffff8881ce130738 R15: ffffffffffffffff
FS: 0000000001dab880(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020d83ff8 CR3: 00000001b6a5c000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
^ permalink raw reply
* [PATCH] HID: multitouch: Add pointstick support for Cirque Touchpad
From: Kai-Heng Feng @ 2018-11-14 5:35 UTC (permalink / raw)
To: jikos, benjamin.tissoires; +Cc: linux-input, linux-kernel, Kai-Heng Feng
Cirque Touchpad/Pointstick combo is similar to Alps devices, it requires
MT_CLS_WIN_8_DUAL to expose its pointstick as a mouse.
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
---
drivers/hid/hid-ids.h | 3 +++
drivers/hid/hid-multitouch.c | 6 ++++++
2 files changed, 9 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index c0d668944dbe..9f59a0a1500b 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -275,6 +275,9 @@
#define USB_VENDOR_ID_CIDC 0x1677
+#define I2C_VENDOR_ID_CIRQUE 0x0488
+#define I2C_PRODUCT_ID_CIRQUE_121F 0x121F
+
#define USB_VENDOR_ID_CJTOUCH 0x24b8
#define USB_DEVICE_ID_CJTOUCH_MULTI_TOUCH_0020 0x0020
#define USB_DEVICE_ID_CJTOUCH_MULTI_TOUCH_0040 0x0040
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index f7c6de2b6730..dca0a3a90fb8 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1814,6 +1814,12 @@ static const struct hid_device_id mt_devices[] = {
MT_USB_DEVICE(USB_VENDOR_ID_CHUNGHWAT,
USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH) },
+ /* Cirque devices */
+ { .driver_data = MT_CLS_WIN_8_DUAL,
+ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+ I2C_VENDOR_ID_CIRQUE,
+ I2C_PRODUCT_ID_CIRQUE_121F) },
+
/* CJTouch panels */
{ .driver_data = MT_CLS_NSMU,
MT_USB_DEVICE(USB_VENDOR_ID_CJTOUCH,
--
2.17.1
^ permalink raw reply related
* [PATCH] HID: i2c-hid: Disable runtime PM for LG touchscreen
From: Kai-Heng Feng @ 2018-11-14 7:24 UTC (permalink / raw)
To: jikos, benjamin.tissoires; +Cc: linux-input, linux-kernel, Kai-Heng Feng
LG touchscreen (1fd2:8001) stops working after reboot:
[ 4.859153] i2c_hid i2c-SAPS2101:00: i2c_hid_get_input: incomplete report (64/66)
[ 4.936070] i2c_hid i2c-SAPS2101:00: i2c_hid_get_input: incomplete report (64/66)
[ 9.948224] i2c_hid i2c-SAPS2101:00: failed to reset device.
The device in question stops working after receives SLEEP, ON, SLEEP
commands in a short period. The scenario is like this:
- Once the desktop session closes, it also closed the hid device, so the
device gets runtime suspended and receives a SLEEP command.
- Before calling shutdown callback, it gets runtime resumed and received
an ON command.
- In the shutdown callback, it receives another SLEEP command.
I failed to find a reliable interval between ON/SLEEP commands that can
make it work, so let's simply disable runtime PM for the device.
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/i2c-hid/i2c-hid-core.c | 2 ++
2 files changed, 3 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index c0d668944dbe..bd636f529fad 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -707,6 +707,7 @@
#define USB_VENDOR_ID_LG 0x1fd2
#define USB_DEVICE_ID_LG_MULTITOUCH 0x0064
#define USB_DEVICE_ID_LG_MELFAS_MT 0x6007
+#define I2C_DEVICE_ID_LG_8001 0x8001
#define USB_VENDOR_ID_LOGITECH 0x046d
#define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 3cde7c1b9c33..8555ce7e737b 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -177,6 +177,8 @@ static const struct i2c_hid_quirks {
I2C_HID_QUIRK_NO_RUNTIME_PM },
{ I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_4B33,
I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
+ { USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_8001,
+ I2C_HID_QUIRK_NO_RUNTIME_PM },
{ 0, 0 }
};
--
2.17.1
^ permalink raw reply related
* [PATCH] Input: iforce - Add the Saitek R440 Force Wheel
From: Tim Schumacher @ 2018-11-14 9:52 UTC (permalink / raw)
To: linux-input; +Cc: linux-kernel, vojtech, dmitry.torokhov, timschumi
Signed-off-by: Tim Schumacher <timschumi@gmx.de>
---
Please note that I do NOT own this device.
I'm adding this based on the fact that this is an iforce-based
device and that the Windows driver for the R440 works for the
Logitech WingMan Formula Force after replacing the device/vendor
IDs (I got the vendor/device IDs from there as well).
Please don't add this patch if adding devices based on that is
not ok.
Also (not related to this patch specifically), does anyone know
what the question marks at the end of some device definitions
are supposed to mean?
---
drivers/input/joystick/iforce/iforce-main.c | 1 +
drivers/input/joystick/iforce/iforce-usb.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
index 58d5cfe46526..432deecaeff9 100644
--- a/drivers/input/joystick/iforce/iforce-main.c
+++ b/drivers/input/joystick/iforce/iforce-main.c
@@ -67,6 +67,7 @@ static struct iforce_device iforce_device[] = {
{ 0x05ef, 0x8888, "AVB Top Shot Force Feedback Racing Wheel", btn_wheel, abs_wheel, ff_iforce }, //?
{ 0x061c, 0xc0a4, "ACT LABS Force RS", btn_wheel, abs_wheel, ff_iforce }, //?
{ 0x061c, 0xc084, "ACT LABS Force RS", btn_wheel, abs_wheel, ff_iforce },
+ { 0x06a3, 0xff04, "Saitek R440 Force Wheel", btn_wheel, abs_wheel, ff_iforce }, //?
{ 0x06f8, 0x0001, "Guillemot Race Leader Force Feedback", btn_wheel, abs_wheel, ff_iforce }, //?
{ 0x06f8, 0x0001, "Guillemot Jet Leader Force Feedback", btn_joystick, abs_joystick_rudder, ff_iforce },
{ 0x06f8, 0x0004, "Guillemot Force Feedback Racing Wheel", btn_wheel, abs_wheel, ff_iforce }, //?
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index 78073259c9a1..cdea61ae838d 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -214,6 +214,7 @@ static const struct usb_device_id iforce_usb_ids[] = {
{ USB_DEVICE(0x05ef, 0x8888) }, /* AVB Top Shot FFB Racing Wheel */
{ USB_DEVICE(0x061c, 0xc0a4) }, /* ACT LABS Force RS */
{ USB_DEVICE(0x061c, 0xc084) }, /* ACT LABS Force RS */
+ { USB_DEVICE(0x06a3, 0xff04) }, /* Saitek R440 Force Wheel */
{ USB_DEVICE(0x06f8, 0x0001) }, /* Guillemot Race Leader Force Feedback */
{ USB_DEVICE(0x06f8, 0x0003) }, /* Guillemot Jet Leader Force Feedback */
{ USB_DEVICE(0x06f8, 0x0004) }, /* Guillemot Force Feedback Racing Wheel */
--
2.19.1.450.ga4b8ab536
^ permalink raw reply related
* Re: BUG: GPF in non-whitelisted uaccess (non-canonical address?)
From: David Herrmann @ 2018-11-14 12:20 UTC (permalink / raw)
To: syzbot+72473edc9bf4eb1c6556
Cc: Benjamin Tissoires, Jiri Kosina, open list:HID CORE LAYER,
linux-kernel, syzkaller-bugs
In-Reply-To: <0000000000002d2a5b057a94f7ff@google.com>
Hey
On Wed, Nov 14, 2018 at 1:25 AM syzbot
<syzbot+72473edc9bf4eb1c6556@syzkaller.appspotmail.com> wrote:
> syzbot has found a reproducer for the following crash on:
>
> HEAD commit: ccda4af0f4b9 Linux 4.20-rc2
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=13b4e77b400000
> kernel config: https://syzkaller.appspot.com/x/.config?x=4a0a89f12ca9b0f5
> dashboard link: https://syzkaller.appspot.com/bug?extid=72473edc9bf4eb1c6556
> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1646a225400000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=108a6533400000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+72473edc9bf4eb1c6556@syzkaller.appspotmail.com
>
[...]
> BUG: GPF in non-whitelisted uaccess (non-canonical address?)
This uses sendpage(2) to feed data from a file into a uhid chardev.
The default behavior of the kernel is to create a temporary pipe, then
splice from the file into the pipe, and then splice again from the
pipe into uhid.
The kernel provides default implementations for splicing between files
and any other file. The default implementation of `.splice_write()`
uses kmap() to map the page from the pipe and then uses the
__kernel_write() (which uses .f_op->write()) to push the data into the
target file. The problem is, __kernel_write() sets the address-space
to KERNEL_DS `set_fs(get_ds())`, thus granting the UHID request access
to kernel memory.
I see several ways to fix that, the most simple solution is to simply
prevent splice/sendpage on uhid (by setting f_op.splice_write to a
dummy). Alternatively, we can implement a proper splice helper that
takes the page directly, rather than through the __kernel_write()
default implementation.
Thanks
David
^ permalink raw reply
* [PATCH] HID: uhid: prevent splice(2)
From: David Herrmann @ 2018-11-14 13:07 UTC (permalink / raw)
To: linux-input; +Cc: linux-kernel, jikos, benjamin.tissoires, David Herrmann
The kernel has a default implementation of splice(2) for writing from a
pipe into an arbitrary file. This behavior can be overriden by
providing an f_op.splice_write() callback.
Unfortunately, the default implementation of splice_write() takes page
by page from the source pipe, calls kmap() and passes the mapped page
as kernel-address to f_op.write(). Thus, it uses standard write(2) to
implement splice(2). However, since the page is kernel-mapped, they
have to `set_fs(get_ds())`. This is mostly fine, but UHID takes
command-streams through write(2), and thus it might interpret the data
taken as pointers. If called with KERNEL_DS, you can trick UHID to
allow kernel-space pointers as well.
As a simple fix, prevent splice(2) on UHID. It is unsecure, but it is
also non-functional. We need a linear mapping of the input in UHID, so
chunked input from splice(2) makes no sense, anyway.
Reported-by: syzbot+72473edc9bf4eb1c6556@syzkaller.appspotmail.com
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
---
drivers/hid/uhid.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 3c5507313606..fefedc0b4dc6 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -753,6 +753,15 @@ static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
return ret ? ret : count;
}
+static ssize_t uhid_char_splice_write(struct pipe_inode_info *pipe,
+ struct file *out,
+ loff_t *ppos,
+ size_t len,
+ unsigned int flags)
+{
+ return -EOPNOTSUPP;
+}
+
static __poll_t uhid_char_poll(struct file *file, poll_table *wait)
{
struct uhid_device *uhid = file->private_data;
@@ -771,6 +780,7 @@ static const struct file_operations uhid_fops = {
.release = uhid_char_release,
.read = uhid_char_read,
.write = uhid_char_write,
+ .splice_write = uhid_char_splice_write,
.poll = uhid_char_poll,
.llseek = no_llseek,
};
--
2.19.1
^ permalink raw reply related
* [PATCH] Revert "HID: uhid: use strlcpy() instead of strncpy()"
From: David Herrmann @ 2018-11-14 13:16 UTC (permalink / raw)
To: linux-input; +Cc: linux-kernel, jikos, benjamin.tissoires, David Herrmann
This reverts commit 336fd4f5f25157e9e8bd50e898a1bbcd99eaea46.
Please note that `strlcpy()` does *NOT* do what you think it does.
strlcpy() *ALWAYS* reads the full input string, regardless of the
'length' parameter. That is, if the input is not zero-terminated,
strlcpy() will *READ* beyond input boundaries. It does this, because it
always returns the size it *would* copy if the target was big enough,
not the truncated size it actually copied.
The original code was perfectly fine. The hid device is
zero-initialized and the strncpy() functions copied up to n-1
characters. The result is always zero-terminated this way.
This is the third time someone tried to replace strncpy with strlcpy in
this function, and gets it wrong. I now added a comment that should at
least make people reconsider.
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
---
drivers/hid/uhid.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index fefedc0b4dc6..0dfdd0ac7120 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -496,12 +496,13 @@ static int uhid_dev_create2(struct uhid_device *uhid,
goto err_free;
}
- len = min(sizeof(hid->name), sizeof(ev->u.create2.name));
- strlcpy(hid->name, ev->u.create2.name, len);
- len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys));
- strlcpy(hid->phys, ev->u.create2.phys, len);
- len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq));
- strlcpy(hid->uniq, ev->u.create2.uniq, len);
+ /* @hid is zero-initialized, strncpy() is correct, strlcpy() not */
+ len = min(sizeof(hid->name), sizeof(ev->u.create2.name)) - 1;
+ strncpy(hid->name, ev->u.create2.name, len);
+ len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys)) - 1;
+ strncpy(hid->phys, ev->u.create2.phys, len);
+ len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq)) - 1;
+ strncpy(hid->uniq, ev->u.create2.uniq, len);
hid->ll_driver = &uhid_hid_driver;
hid->bus = ev->u.create2.bus;
--
2.19.1
^ permalink raw reply related
* Re: [PATCH] Input: iforce - Add the Saitek R440 Force Wheel
From: Vojtech Pavlik @ 2018-11-14 14:58 UTC (permalink / raw)
To: Tim Schumacher; +Cc: linux-input, linux-kernel, dmitry.torokhov
In-Reply-To: <20181114095240.25967-1-timschumi@gmx.de>
On Wed, Nov 14, 2018 at 10:52:40AM +0100, Tim Schumacher wrote:
> Signed-off-by: Tim Schumacher <timschumi@gmx.de>
> ---
> Please note that I do NOT own this device.
>
> I'm adding this based on the fact that this is an iforce-based
> device and that the Windows driver for the R440 works for the
> Logitech WingMan Formula Force after replacing the device/vendor
> IDs (I got the vendor/device IDs from there as well).
>
> Please don't add this patch if adding devices based on that is
> not ok.
>
> Also (not related to this patch specifically), does anyone know
> what the question marks at the end of some device definitions
> are supposed to mean?
I believe those are unconfirmed devices based on similar reasoning to yours.
> ---
> drivers/input/joystick/iforce/iforce-main.c | 1 +
> drivers/input/joystick/iforce/iforce-usb.c | 1 +
> 2 files changed, 2 insertions(+)
>
> diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
> index 58d5cfe46526..432deecaeff9 100644
> --- a/drivers/input/joystick/iforce/iforce-main.c
> +++ b/drivers/input/joystick/iforce/iforce-main.c
> @@ -67,6 +67,7 @@ static struct iforce_device iforce_device[] = {
> { 0x05ef, 0x8888, "AVB Top Shot Force Feedback Racing Wheel", btn_wheel, abs_wheel, ff_iforce }, //?
> { 0x061c, 0xc0a4, "ACT LABS Force RS", btn_wheel, abs_wheel, ff_iforce }, //?
> { 0x061c, 0xc084, "ACT LABS Force RS", btn_wheel, abs_wheel, ff_iforce },
> + { 0x06a3, 0xff04, "Saitek R440 Force Wheel", btn_wheel, abs_wheel, ff_iforce }, //?
> { 0x06f8, 0x0001, "Guillemot Race Leader Force Feedback", btn_wheel, abs_wheel, ff_iforce }, //?
> { 0x06f8, 0x0001, "Guillemot Jet Leader Force Feedback", btn_joystick, abs_joystick_rudder, ff_iforce },
> { 0x06f8, 0x0004, "Guillemot Force Feedback Racing Wheel", btn_wheel, abs_wheel, ff_iforce }, //?
> diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
> index 78073259c9a1..cdea61ae838d 100644
> --- a/drivers/input/joystick/iforce/iforce-usb.c
> +++ b/drivers/input/joystick/iforce/iforce-usb.c
> @@ -214,6 +214,7 @@ static const struct usb_device_id iforce_usb_ids[] = {
> { USB_DEVICE(0x05ef, 0x8888) }, /* AVB Top Shot FFB Racing Wheel */
> { USB_DEVICE(0x061c, 0xc0a4) }, /* ACT LABS Force RS */
> { USB_DEVICE(0x061c, 0xc084) }, /* ACT LABS Force RS */
> + { USB_DEVICE(0x06a3, 0xff04) }, /* Saitek R440 Force Wheel */
> { USB_DEVICE(0x06f8, 0x0001) }, /* Guillemot Race Leader Force Feedback */
> { USB_DEVICE(0x06f8, 0x0003) }, /* Guillemot Jet Leader Force Feedback */
> { USB_DEVICE(0x06f8, 0x0004) }, /* Guillemot Force Feedback Racing Wheel */
> --
> 2.19.1.450.ga4b8ab536
>
--
Vojtech Pavlik
Director SUSE Labs
^ permalink raw reply
* Re: [PATCH] Revert "HID: uhid: use strlcpy() instead of strncpy()"
From: Laura Abbott @ 2018-11-14 15:40 UTC (permalink / raw)
To: David Herrmann, linux-input
Cc: linux-kernel, jikos, benjamin.tissoires, Kees Cook
In-Reply-To: <20181114131642.21425-1-dh.herrmann@gmail.com>
On 11/14/18 5:16 AM, David Herrmann wrote:
> This reverts commit 336fd4f5f25157e9e8bd50e898a1bbcd99eaea46.
>
> Please note that `strlcpy()` does *NOT* do what you think it does.
> strlcpy() *ALWAYS* reads the full input string, regardless of the
> 'length' parameter. That is, if the input is not zero-terminated,
> strlcpy() will *READ* beyond input boundaries. It does this, because it
> always returns the size it *would* copy if the target was big enough,
> not the truncated size it actually copied.
>
> The original code was perfectly fine. The hid device is
> zero-initialized and the strncpy() functions copied up to n-1
> characters. The result is always zero-terminated this way.
>
> This is the third time someone tried to replace strncpy with strlcpy in
> this function, and gets it wrong. I now added a comment that should at
> least make people reconsider.
>
Can we switch to strscpy instead? This will quiet gcc and avoid the
issues with strlcpy.
> Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
> ---
> drivers/hid/uhid.c | 13 +++++++------
> 1 file changed, 7 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
> index fefedc0b4dc6..0dfdd0ac7120 100644
> --- a/drivers/hid/uhid.c
> +++ b/drivers/hid/uhid.c
> @@ -496,12 +496,13 @@ static int uhid_dev_create2(struct uhid_device *uhid,
> goto err_free;
> }
>
> - len = min(sizeof(hid->name), sizeof(ev->u.create2.name));
> - strlcpy(hid->name, ev->u.create2.name, len);
> - len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys));
> - strlcpy(hid->phys, ev->u.create2.phys, len);
> - len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq));
> - strlcpy(hid->uniq, ev->u.create2.uniq, len);
> + /* @hid is zero-initialized, strncpy() is correct, strlcpy() not */
> + len = min(sizeof(hid->name), sizeof(ev->u.create2.name)) - 1;
> + strncpy(hid->name, ev->u.create2.name, len);
> + len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys)) - 1;
> + strncpy(hid->phys, ev->u.create2.phys, len);
> + len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq)) - 1;
> + strncpy(hid->uniq, ev->u.create2.uniq, len);
>
> hid->ll_driver = &uhid_hid_driver;
> hid->bus = ev->u.create2.bus;
>
^ permalink raw reply
* Re: BUG: GPF in non-whitelisted uaccess (non-canonical address?)
From: Dmitry Vyukov @ 2018-11-14 16:52 UTC (permalink / raw)
To: David Herrmann, Dmitry Torokhov
Cc: syzbot+72473edc9bf4eb1c6556, Benjamin Tissoires, Jiri Kosina,
open list:HID CORE LAYER, linux-kernel, syzkaller-bugs
In-Reply-To: <CANq1E4T6+bacZ9iGREtWiyM8eUkAQoxhgFM6rPrzNRkzAcnfJg@mail.gmail.com>
On Wed, Nov 14, 2018 at 4:20 AM, David Herrmann <dh.herrmann@gmail.com> wrote:
> Hey
>
> On Wed, Nov 14, 2018 at 1:25 AM syzbot
> <syzbot+72473edc9bf4eb1c6556@syzkaller.appspotmail.com> wrote:
>> syzbot has found a reproducer for the following crash on:
>>
>> HEAD commit: ccda4af0f4b9 Linux 4.20-rc2
>> git tree: upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=13b4e77b400000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=4a0a89f12ca9b0f5
>> dashboard link: https://syzkaller.appspot.com/bug?extid=72473edc9bf4eb1c6556
>> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1646a225400000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=108a6533400000
>>
>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>> Reported-by: syzbot+72473edc9bf4eb1c6556@syzkaller.appspotmail.com
>>
> [...]
>> BUG: GPF in non-whitelisted uaccess (non-canonical address?)
>
> This uses sendpage(2) to feed data from a file into a uhid chardev.
> The default behavior of the kernel is to create a temporary pipe, then
> splice from the file into the pipe, and then splice again from the
> pipe into uhid.
>
> The kernel provides default implementations for splicing between files
> and any other file. The default implementation of `.splice_write()`
> uses kmap() to map the page from the pipe and then uses the
> __kernel_write() (which uses .f_op->write()) to push the data into the
> target file. The problem is, __kernel_write() sets the address-space
> to KERNEL_DS `set_fs(get_ds())`, thus granting the UHID request access
> to kernel memory.
>
> I see several ways to fix that, the most simple solution is to simply
> prevent splice/sendpage on uhid (by setting f_op.splice_write to a
> dummy). Alternatively, we can implement a proper splice helper that
> takes the page directly, rather than through the __kernel_write()
> default implementation.
also +dtor for uhid
^ permalink raw reply
* Re: BUG: GPF in non-whitelisted uaccess (non-canonical address?)
From: Eric Biggers @ 2018-11-14 17:14 UTC (permalink / raw)
To: David Herrmann
Cc: Dmitry Vyukov, Dmitry Torokhov, syzbot+72473edc9bf4eb1c6556,
Benjamin Tissoires, Jiri Kosina, open list:HID CORE LAYER,
linux-kernel, syzkaller-bugs
In-Reply-To: <CACT4Y+b8801QqLe4axBct-cZ2a-jr2S2=MSRhg7rV20bPvUHxQ@mail.gmail.com>
On Wed, Nov 14, 2018 at 08:52:46AM -0800, 'Dmitry Vyukov' via syzkaller-bugs wrote:
> On Wed, Nov 14, 2018 at 4:20 AM, David Herrmann <dh.herrmann@gmail.com> wrote:
> > Hey
> >
> > On Wed, Nov 14, 2018 at 1:25 AM syzbot
> > <syzbot+72473edc9bf4eb1c6556@syzkaller.appspotmail.com> wrote:
> >> syzbot has found a reproducer for the following crash on:
> >>
> >> HEAD commit: ccda4af0f4b9 Linux 4.20-rc2
> >> git tree: upstream
> >> console output: https://syzkaller.appspot.com/x/log.txt?x=13b4e77b400000
> >> kernel config: https://syzkaller.appspot.com/x/.config?x=4a0a89f12ca9b0f5
> >> dashboard link: https://syzkaller.appspot.com/bug?extid=72473edc9bf4eb1c6556
> >> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
> >> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1646a225400000
> >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=108a6533400000
> >>
> >> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> >> Reported-by: syzbot+72473edc9bf4eb1c6556@syzkaller.appspotmail.com
> >>
> > [...]
> >> BUG: GPF in non-whitelisted uaccess (non-canonical address?)
> >
> > This uses sendpage(2) to feed data from a file into a uhid chardev.
> > The default behavior of the kernel is to create a temporary pipe, then
> > splice from the file into the pipe, and then splice again from the
> > pipe into uhid.
> >
> > The kernel provides default implementations for splicing between files
> > and any other file. The default implementation of `.splice_write()`
> > uses kmap() to map the page from the pipe and then uses the
> > __kernel_write() (which uses .f_op->write()) to push the data into the
> > target file. The problem is, __kernel_write() sets the address-space
> > to KERNEL_DS `set_fs(get_ds())`, thus granting the UHID request access
> > to kernel memory.
> >
> > I see several ways to fix that, the most simple solution is to simply
> > prevent splice/sendpage on uhid (by setting f_op.splice_write to a
> > dummy). Alternatively, we can implement a proper splice helper that
> > takes the page directly, rather than through the __kernel_write()
> > default implementation.
>
> also +dtor for uhid
>
Well, the problem is that uhid_char_write() reads from a user pointer embedded
in the write() payload. (Which really is abusing write(), but I assume it
cannot be changed at this point...) Thus it's unsafe to be called under
KERNEL_DS. So it needs:
if (uaccess_kernel())
return -EACCES;
See sg_check_file_access(), called from sg_read() and sg_write(), for another
example of this in the kernel.
- Eric
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox