From: Greg Kroah-Hartman Date: Thu, 2 Jul 2026 14:17:26 +0000 (+0200) Subject: drop some rmi4 patches X-Git-Tag: v5.10.260~23 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=33f959ddb8b1461aea24f610274e5ce9fb2a27ba;p=thirdparty%2Fkernel%2Fstable-queue.git drop some rmi4 patches --- diff --git a/queue-6.12/input-include-export.h-in-modules-using-export_symbol.patch b/queue-6.12/input-include-export.h-in-modules-using-export_symbol.patch deleted file mode 100644 index 53921141c9..0000000000 --- a/queue-6.12/input-include-export.h-in-modules-using-export_symbol.patch +++ /dev/null @@ -1,339 +0,0 @@ -From stable+bounces-268622-greg=kroah.com@vger.kernel.org Thu Jun 25 18:26:27 2026 -From: Sasha Levin -Date: Thu, 25 Jun 2026 12:25:07 -0400 -Subject: Input: include export.h in modules using EXPORT_SYMBOL*() -To: stable@vger.kernel.org -Cc: Dmitry Torokhov , Sasha Levin -Message-ID: <20260625162508.2501015-1-sashal@kernel.org> - -From: Dmitry Torokhov - -[ Upstream commit df595059d54383c42607b59f1f9ea74dade280fe ] - -A number of modules in the input subsystem use EXPORT_SYMBOL() and -friends without explicitly including the corresponding header -. While the build currently succeeds due to this header -being pulled in transitively, this is not guaranteed to be the case in -the future. - -Let's add the explicit include to make the dependencies clear and -prevent future build breakage. - -Signed-off-by: Dmitry Torokhov -Stable-dep-of: 0adb483fbf2d ("Input: rmi4 - refactor register descriptor parsing") -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman ---- - drivers/input/ff-core.c | 2 +- - drivers/input/ff-memless.c | 1 + - drivers/input/gameport/gameport.c | 1 + - drivers/input/input-poller.c | 1 + - drivers/input/input.c | 1 + - drivers/input/joystick/iforce/iforce-main.c | 1 + - drivers/input/joystick/iforce/iforce-packets.c | 1 + - drivers/input/misc/ad714x.c | 1 + - drivers/input/misc/adxl34x.c | 1 + - drivers/input/misc/cma3000_d0x.c | 1 + - drivers/input/rmi4/rmi_2d_sensor.c | 1 + - drivers/input/rmi4/rmi_bus.c | 1 + - drivers/input/rmi4/rmi_driver.c | 1 + - drivers/input/serio/hil_mlc.c | 1 + - drivers/input/serio/hp_sdc.c | 1 + - drivers/input/serio/i8042.c | 1 + - drivers/input/serio/libps2.c | 1 + - drivers/input/serio/serio.c | 1 + - drivers/input/sparse-keymap.c | 1 + - drivers/input/touchscreen.c | 1 + - drivers/input/touchscreen/ad7879.c | 1 + - drivers/input/touchscreen/cyttsp_core.c | 1 + - drivers/input/touchscreen/goodix_berlin_core.c | 1 + - drivers/input/touchscreen/tsc200x-core.c | 1 + - drivers/input/touchscreen/wm9705.c | 1 + - drivers/input/touchscreen/wm9712.c | 1 + - drivers/input/touchscreen/wm9713.c | 1 + - drivers/input/touchscreen/wm97xx-core.c | 1 + - 28 files changed, 28 insertions(+), 1 deletion(-) - ---- a/drivers/input/ff-core.c -+++ b/drivers/input/ff-core.c -@@ -8,9 +8,9 @@ - - /* #define DEBUG */ - -+#include - #include - #include --#include - #include - #include - #include ---- a/drivers/input/ff-memless.c -+++ b/drivers/input/ff-memless.c -@@ -10,6 +10,7 @@ - - #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt - -+#include - #include - #include - #include ---- a/drivers/input/gameport/gameport.c -+++ b/drivers/input/gameport/gameport.c -@@ -9,6 +9,7 @@ - - #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt - -+#include - #include - #include - #include ---- a/drivers/input/input-poller.c -+++ b/drivers/input/input-poller.c -@@ -4,6 +4,7 @@ - */ - - #include -+#include - #include - #include - #include ---- a/drivers/input/input.c -+++ b/drivers/input/input.c -@@ -8,6 +8,7 @@ - - #define pr_fmt(fmt) KBUILD_BASENAME ": " fmt - -+#include - #include - #include - #include ---- a/drivers/input/joystick/iforce/iforce-main.c -+++ b/drivers/input/joystick/iforce/iforce-main.c -@@ -6,6 +6,7 @@ - * USB/RS232 I-Force joysticks and wheels. - */ - -+#include - #include - #include "iforce.h" - ---- a/drivers/input/joystick/iforce/iforce-packets.c -+++ b/drivers/input/joystick/iforce/iforce-packets.c -@@ -6,6 +6,7 @@ - * USB/RS232 I-Force joysticks and wheels. - */ - -+#include - #include - #include "iforce.h" - ---- a/drivers/input/misc/ad714x.c -+++ b/drivers/input/misc/ad714x.c -@@ -6,6 +6,7 @@ - */ - - #include -+#include - #include - #include - #include ---- a/drivers/input/misc/adxl34x.c -+++ b/drivers/input/misc/adxl34x.c -@@ -9,6 +9,7 @@ - - #include - #include -+#include - #include - #include - #include ---- a/drivers/input/misc/cma3000_d0x.c -+++ b/drivers/input/misc/cma3000_d0x.c -@@ -6,6 +6,7 @@ - * Author: Hemanth V - */ - -+#include - #include - #include - #include ---- a/drivers/input/rmi4/rmi_2d_sensor.c -+++ b/drivers/input/rmi4/rmi_2d_sensor.c -@@ -4,6 +4,7 @@ - * Copyright (c) 2011 Unixphere - */ - -+#include - #include - #include - #include ---- a/drivers/input/rmi4/rmi_bus.c -+++ b/drivers/input/rmi4/rmi_bus.c -@@ -4,6 +4,7 @@ - * Copyright (c) 2011 Unixphere - */ - -+#include - #include - #include - #include ---- a/drivers/input/rmi4/rmi_driver.c -+++ b/drivers/input/rmi4/rmi_driver.c -@@ -21,6 +21,7 @@ - #include - #include - #include -+#include - #include "rmi_bus.h" - #include "rmi_driver.h" - ---- a/drivers/input/serio/hil_mlc.c -+++ b/drivers/input/serio/hil_mlc.c -@@ -54,6 +54,7 @@ - - #include - #include -+#include - #include - #include - #include ---- a/drivers/input/serio/hp_sdc.c -+++ b/drivers/input/serio/hp_sdc.c -@@ -63,6 +63,7 @@ - - #include - #include -+#include - #include - #include - #include ---- a/drivers/input/serio/i8042.c -+++ b/drivers/input/serio/i8042.c -@@ -10,6 +10,7 @@ - - #include - #include -+#include - #include - #include - #include ---- a/drivers/input/serio/libps2.c -+++ b/drivers/input/serio/libps2.c -@@ -8,6 +8,7 @@ - - - #include -+#include - #include - #include - #include ---- a/drivers/input/serio/serio.c -+++ b/drivers/input/serio/serio.c -@@ -9,6 +9,7 @@ - - #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt - -+#include - #include - #include - #include ---- a/drivers/input/sparse-keymap.c -+++ b/drivers/input/sparse-keymap.c -@@ -10,6 +10,7 @@ - * Copyright (C) 2005 Dmitry Torokhov - */ - -+#include - #include - #include - #include ---- a/drivers/input/touchscreen.c -+++ b/drivers/input/touchscreen.c -@@ -6,6 +6,7 @@ - * Copyright (c) 2014 Sebastian Reichel - */ - -+#include - #include - #include - #include ---- a/drivers/input/touchscreen/ad7879.c -+++ b/drivers/input/touchscreen/ad7879.c -@@ -22,6 +22,7 @@ - - #include - #include -+#include - #include - #include - #include ---- a/drivers/input/touchscreen/cyttsp_core.c -+++ b/drivers/input/touchscreen/cyttsp_core.c -@@ -14,6 +14,7 @@ - */ - - #include -+#include - #include - #include - #include ---- a/drivers/input/touchscreen/goodix_berlin_core.c -+++ b/drivers/input/touchscreen/goodix_berlin_core.c -@@ -24,6 +24,7 @@ - */ - - #include -+#include - #include - #include - #include ---- a/drivers/input/touchscreen/tsc200x-core.c -+++ b/drivers/input/touchscreen/tsc200x-core.c -@@ -10,6 +10,7 @@ - * based on TSC2301 driver by Klaus K. Pedersen - */ - -+#include - #include - #include - #include ---- a/drivers/input/touchscreen/wm9705.c -+++ b/drivers/input/touchscreen/wm9705.c -@@ -9,6 +9,7 @@ - * Russell King - */ - -+#include - #include - #include - #include ---- a/drivers/input/touchscreen/wm9712.c -+++ b/drivers/input/touchscreen/wm9712.c -@@ -9,6 +9,7 @@ - * Russell King - */ - -+#include - #include - #include - #include ---- a/drivers/input/touchscreen/wm9713.c -+++ b/drivers/input/touchscreen/wm9713.c -@@ -9,6 +9,7 @@ - * Russell King - */ - -+#include - #include - #include - #include ---- a/drivers/input/touchscreen/wm97xx-core.c -+++ b/drivers/input/touchscreen/wm97xx-core.c -@@ -29,6 +29,7 @@ - * - Support for async sampling control for noisy LCDs. - */ - -+#include - #include - #include - #include diff --git a/queue-6.12/input-rmi4-refactor-register-descriptor-parsing.patch b/queue-6.12/input-rmi4-refactor-register-descriptor-parsing.patch deleted file mode 100644 index c64e9b6af9..0000000000 --- a/queue-6.12/input-rmi4-refactor-register-descriptor-parsing.patch +++ /dev/null @@ -1,228 +0,0 @@ -From sashal@kernel.org Thu Jun 25 18:25:12 2026 -From: Sasha Levin -Date: Thu, 25 Jun 2026 12:25:08 -0400 -Subject: Input: rmi4 - refactor register descriptor parsing -To: stable@vger.kernel.org -Cc: Dmitry Torokhov , Greg Kroah-Hartman , Sasha Levin -Message-ID: <20260625162508.2501015-2-sashal@kernel.org> - -From: Dmitry Torokhov - -[ Upstream commit 0adb483fbf2dc43c875cd7550a58b41e92efc52d ] - -Factor out parsing a register descriptor item from -rmi_read_register_desc() and ensure there are no out-of-bounds accesses. - -Use get_unaligned_le16() and get_unaligned_le32() for reading multi-byte -values. - -Reported-by: Greg Kroah-Hartman -Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices") -Cc: stable@vger.kernel.org -Assisted-by: Gemini:gemini-3.1-pro -Link: https://patch.msgid.link/20260505045952.1570713-2-dmitry.torokhov@gmail.com -Signed-off-by: Dmitry Torokhov -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman ---- - drivers/input/rmi4/rmi_driver.c | 124 ++++++++++++++++++++++++---------------- - 1 file changed, 76 insertions(+), 48 deletions(-) - ---- a/drivers/input/rmi4/rmi_driver.c -+++ b/drivers/input/rmi4/rmi_driver.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - #include "rmi_bus.h" - #include "rmi_driver.h" - -@@ -558,30 +559,74 @@ int rmi_scan_pdt(struct rmi_device *rmi_ - return retval < 0 ? retval : 0; - } - -+static int rmi_parse_register_desc_item(struct rmi_register_desc_item *item, -+ const u8 *buf, size_t size) -+{ -+ unsigned int offset = 0; -+ unsigned int map_offset = 0; -+ int b; -+ -+ if (offset >= size) -+ return -EIO; -+ -+ item->reg_size = buf[offset++]; -+ if (item->reg_size == 0) { -+ if (size - offset < 2) -+ return -EIO; -+ item->reg_size = get_unaligned_le16(&buf[offset]); -+ offset += 2; -+ } -+ -+ if (item->reg_size == 0) { -+ if (size - offset < 4) -+ return -EIO; -+ item->reg_size = get_unaligned_le32(&buf[offset]); -+ offset += 4; -+ } -+ -+ do { -+ if (offset >= size) -+ return -EIO; -+ -+ for (b = 0; b < 7; b++) { -+ if (buf[offset] & BIT(b)) { -+ if (map_offset >= RMI_REG_DESC_SUBPACKET_BITS) -+ return -EIO; -+ __set_bit(map_offset, item->subpacket_map); -+ } -+ ++map_offset; -+ } -+ } while (buf[offset++] & BIT(7)); -+ -+ item->num_subpackets = bitmap_weight(item->subpacket_map, -+ RMI_REG_DESC_SUBPACKET_BITS); -+ -+ return offset; -+} -+ - int rmi_read_register_desc(struct rmi_device *d, u16 addr, -- struct rmi_register_descriptor *rdesc) -+ struct rmi_register_descriptor *rdesc) - { - int ret; - u8 size_presence_reg; - u8 buf[35]; -- int presense_offset = 1; -- u8 *struct_buf; -- int reg; -- int offset = 0; -- int map_offset = 0; -+ unsigned int presence_offset; -+ unsigned int map_offset; -+ unsigned int offset; -+ unsigned int reg; - int i; - int b; - - /* - * The first register of the register descriptor is the size of -- * the register descriptor's presense register. -+ * the register descriptor's presence register. - */ - ret = rmi_read(d, addr, &size_presence_reg); - if (ret) - return ret; - ++addr; - -- if (size_presence_reg < 0 || size_presence_reg > 35) -+ if (size_presence_reg < 1 || size_presence_reg > 35) - return -EIO; - - memset(buf, 0, sizeof(buf)); -@@ -597,16 +642,23 @@ int rmi_read_register_desc(struct rmi_de - ++addr; - - if (buf[0] == 0) { -- presense_offset = 3; -- rdesc->struct_size = buf[1] | (buf[2] << 8); -+ if (size_presence_reg < 3) -+ return -EIO; -+ presence_offset = 3; -+ rdesc->struct_size = get_unaligned_le16(&buf[1]); - } else { -+ presence_offset = 1; - rdesc->struct_size = buf[0]; - } - -- for (i = presense_offset; i < size_presence_reg; i++) { -+ map_offset = 0; -+ for (i = presence_offset; i < size_presence_reg; i++) { - for (b = 0; b < 8; b++) { -- if (buf[i] & (0x1 << b)) -+ if (buf[i] & BIT(b)) { -+ if (map_offset >= RMI_REG_DESC_PRESENSE_BITS) -+ return -EIO; - bitmap_set(rdesc->presense_map, map_offset, 1); -+ } - ++map_offset; - } - } -@@ -626,7 +678,7 @@ int rmi_read_register_desc(struct rmi_de - * I'm not using devm_kzalloc here since it will not be retained - * after exiting this function - */ -- struct_buf = kzalloc(rdesc->struct_size, GFP_KERNEL); -+ u8 *struct_buf __free(kfree) = kzalloc(rdesc->struct_size, GFP_KERNEL); - if (!struct_buf) - return -ENOMEM; - -@@ -638,56 +690,32 @@ int rmi_read_register_desc(struct rmi_de - */ - ret = rmi_read_block(d, addr, struct_buf, rdesc->struct_size); - if (ret) -- goto free_struct_buff; -+ return ret; - - reg = find_first_bit(rdesc->presense_map, RMI_REG_DESC_PRESENSE_BITS); -+ offset = 0; - for (i = 0; i < rdesc->num_registers; i++) { - struct rmi_register_desc_item *item = &rdesc->registers[i]; -- int reg_size = struct_buf[offset]; -+ int item_size; - -- ++offset; -- if (reg_size == 0) { -- reg_size = struct_buf[offset] | -- (struct_buf[offset + 1] << 8); -- offset += 2; -- } -- -- if (reg_size == 0) { -- reg_size = struct_buf[offset] | -- (struct_buf[offset + 1] << 8) | -- (struct_buf[offset + 2] << 16) | -- (struct_buf[offset + 3] << 24); -- offset += 4; -- } -+ item_size = rmi_parse_register_desc_item(item, -+ &struct_buf[offset], -+ rdesc->struct_size - offset); -+ if (item_size < 0) -+ return item_size; - - item->reg = reg; -- item->reg_size = reg_size; -- -- map_offset = 0; -- -- do { -- for (b = 0; b < 7; b++) { -- if (struct_buf[offset] & (0x1 << b)) -- bitmap_set(item->subpacket_map, -- map_offset, 1); -- ++map_offset; -- } -- } while (struct_buf[offset++] & 0x80); -- -- item->num_subpackets = bitmap_weight(item->subpacket_map, -- RMI_REG_DESC_SUBPACKET_BITS); -+ offset += item_size; - - rmi_dbg(RMI_DEBUG_CORE, &d->dev, - "%s: reg: %d reg size: %ld subpackets: %d\n", __func__, - item->reg, item->reg_size, item->num_subpackets); - - reg = find_next_bit(rdesc->presense_map, -- RMI_REG_DESC_PRESENSE_BITS, reg + 1); -+ RMI_REG_DESC_PRESENSE_BITS, reg + 1); - } - --free_struct_buff: -- kfree(struct_buf); -- return ret; -+ return 0; - } - - const struct rmi_register_desc_item *rmi_get_register_desc_item( diff --git a/queue-6.12/series b/queue-6.12/series index 583b2458ae..1c63f47983 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -197,5 +197,3 @@ documentation-ioctl-number-extend-include-file-column-width.patch crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch crypto-qat-remove-unused-character-device-and-ioctls.patch -input-include-export.h-in-modules-using-export_symbol.patch -input-rmi4-refactor-register-descriptor-parsing.patch