linux/drivers/input/misc, branch v6.7

Input: soc_button_array - add mapping for airplane mode button

2023-12-23T07:34:06Z

This add a mapping for the airplane mode button on the TUXEDO Pulse Gen3. While it is physically a key it behaves more like a switch, sending a key down on first press and a key up on 2nd press. Therefor the switch event is used here. Besides this behaviour it uses the HID usage-id 0xc6 (Wireless Radio Button) and not 0xc8 (Wireless Radio Slider Switch), but since neither 0xc6 nor 0xc8 are currently implemented at all in soc_button_array this not to standard behaviour is not put behind a quirk for the moment. Signed-off-by: Christoffer Sandberg Signed-off-by: Werner Sembach Link: https://lore.kernel.org/r/20231215171718.80229-1-wse@tuxedocomputers.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov

Merge branch 'next' into for-linus

2023-11-06T23:42:08Z

Prepare input updates for 6.7 merge window.

Input: powermate - fix use-after-free in powermate_config_complete

2023-10-14T03:17:02Z

syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug. Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection. [1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e Signed-off-by: Javier Carrasco Reported-by: syzbot+0434ac83f907a1dbdd1e@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20230916-topic-powermate_use_after_free-v3-1-64412b81a7a2@gmail.com Signed-off-by: Dmitry Torokhov

Input: axp20x-pek - avoid needless newline removal

2023-09-30T16:35:31Z

This code is doing more work than it needs to. Before handing off `val_str` to `kstrtouint()` we are eagerly removing any trailing newline which requires copying `buf`, validating it's length and checking/replacing any potential newlines. kstrtouint() handles this implicitly: kstrtouint -> kstrotoull -> (documentation) | /** | * kstrtoull - convert a string to an unsigned long long | * @s: The start of the string. The string must be null-terminated, and may also | * include a single newline before its terminating null. The first character | ... Let's remove the redundant functionality and let kstrtouint handle it. Suggested-by: Kees Cook Signed-off-by: Justin Stitt Reviewed-by: Chen-Yu Tsai Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20230925-strncpy-drivers-input-misc-axp20x-pek-c-v2-1-ff7abe8498d6@google.com Signed-off-by: Dmitry Torokhov

Input: wm831x-on - convert to platform remove callback returning void

2023-09-24T02:16:44Z

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20230920125829.1478827-28-u.kleine-koenig@pengutronix.de Signed-off-by: Dmitry Torokhov

Input: wistron_btns - convert to platform remove callback returning void

2023-09-24T02:16:44Z

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230920125829.1478827-27-u.kleine-koenig@pengutronix.de Signed-off-by: Dmitry Torokhov

Input: sparcspkr - convert to platform remove callback returning void

2023-09-24T02:16:44Z

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230920125829.1478827-26-u.kleine-koenig@pengutronix.de Signed-off-by: Dmitry Torokhov

Input: soc_button_array - convert to platform remove callback returning void

2023-09-24T02:16:44Z

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230920125829.1478827-25-u.kleine-koenig@pengutronix.de Signed-off-by: Dmitry Torokhov

Input: pm8941-pwrkey - convert to platform remove callback returning void

2023-09-24T02:16:44Z

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230920125829.1478827-24-u.kleine-koenig@pengutronix.de Signed-off-by: Dmitry Torokhov

Input: pcspkr - convert to platform remove callback returning void

2023-09-24T02:16:44Z

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230920125829.1478827-23-u.kleine-koenig@pengutronix.de Signed-off-by: Dmitry Torokhov