HID: multitouch: validate indexes details
[pandora-kernel.git] / drivers / hid / hid-multitouch.c
index cb0e361..5e5fe1b 100644 (file)
@@ -101,9 +101,9 @@ struct mt_device {
        unsigned last_slot_field;       /* the last field of a slot */
        unsigned mt_report_id;  /* the report ID of the multitouch device */
        unsigned pen_report_id; /* the report ID of the pen device */
-       __s8 inputmode;         /* InputMode HID feature, -1 if non-existent */
-       __s8 inputmode_index;   /* InputMode HID feature index in the report */
-       __s8 maxcontact_report_id;      /* Maximum Contact Number HID feature,
+       __s16 inputmode;        /* InputMode HID feature, -1 if non-existent */
+       __s16 inputmode_index;  /* InputMode HID feature index in the report */
+       __s16 maxcontact_report_id;     /* Maximum Contact Number HID feature,
                                   -1 if non-existent */
        __u8 num_received;      /* how many contacts we received */
        __u8 num_expected;      /* expected last contact index */
@@ -133,6 +133,7 @@ static void mt_post_parse(struct mt_device *td);
 #define MT_CLS_NSMU                            0x000a
 #define MT_CLS_DUAL_CONTACT_NUMBER             0x0010
 #define MT_CLS_DUAL_CONTACT_ID                 0x0011
+#define MT_CLS_WIN_8                           0x0012
 
 /* vendor specific classes */
 #define MT_CLS_3M                              0x0101
@@ -205,6 +206,11 @@ static struct mt_class mt_classes[] = {
                        MT_QUIRK_CONTACT_CNT_ACCURATE |
                        MT_QUIRK_SLOT_IS_CONTACTID,
                .maxcontacts = 2 },
+       { .name = MT_CLS_WIN_8,
+               .quirks = MT_QUIRK_ALWAYS_VALID |
+                       MT_QUIRK_IGNORE_DUPLICATES |
+                       MT_QUIRK_HOVERING |
+                       MT_QUIRK_CONTACT_CNT_ACCURATE },
 
        /*
         * vendor specific classes
@@ -261,17 +267,6 @@ static struct mt_class mt_classes[] = {
        { }
 };
 
-static void mt_free_input_name(struct hid_input *hi)
-{
-       struct hid_device *hdev = hi->report->device;
-       const char *name = hi->input->name;
-
-       if (name != hdev->name) {
-               hi->input->name = hdev->name;
-               kfree(name);
-       }
-}
-
 static ssize_t mt_show_quirks(struct device *dev,
                           struct device_attribute *attr,
                           char *buf)
@@ -317,20 +312,18 @@ static void mt_feature_mapping(struct hid_device *hdev,
                struct hid_field *field, struct hid_usage *usage)
 {
        struct mt_device *td = hid_get_drvdata(hdev);
-       int i;
 
        switch (usage->hid) {
        case HID_DG_INPUTMODE:
-               td->inputmode = field->report->id;
-               td->inputmode_index = 0; /* has to be updated below */
-
-               for (i=0; i < field->maxusage; i++) {
-                       if (field->usage[i].hid == usage->hid) {
-                               td->inputmode_index = i;
-                               break;
-                       }
+               /* Ignore if value index is out of bounds. */
+               if (usage->usage_index >= field->report_count) {
+                       dev_err(&hdev->dev, "HID_DG_INPUTMODE out of range\n");
+                       break;
                }
 
+               td->inputmode = field->report->id;
+               td->inputmode_index = usage->usage_index;
+
                break;
        case HID_DG_CONTACTMAX:
                td->maxcontact_report_id = field->report->id;
@@ -343,19 +336,6 @@ static void mt_feature_mapping(struct hid_device *hdev,
                        td->maxcontacts = td->mtclass.maxcontacts;
 
                break;
-       case 0xff0000c5:
-               if (field->report_count == 256 && field->report_size == 8) {
-                       /* Win 8 devices need special quirks */
-                       __s32 *quirks = &td->mtclass.quirks;
-                       *quirks |= MT_QUIRK_ALWAYS_VALID;
-                       *quirks |= MT_QUIRK_IGNORE_DUPLICATES;
-                       *quirks |= MT_QUIRK_HOVERING;
-                       *quirks |= MT_QUIRK_CONTACT_CNT_ACCURATE;
-                       *quirks &= ~MT_QUIRK_NOT_SEEN_MEANS_UP;
-                       *quirks &= ~MT_QUIRK_VALID_IS_INRANGE;
-                       *quirks &= ~MT_QUIRK_VALID_IS_CONFIDENCE;
-               }
-               break;
        }
 }
 
@@ -415,13 +395,6 @@ static void mt_pen_report(struct hid_device *hid, struct hid_report *report)
 static void mt_pen_input_configured(struct hid_device *hdev,
                                        struct hid_input *hi)
 {
-       char *name = kzalloc(strlen(hi->input->name) + 5, GFP_KERNEL);
-       if (name) {
-               sprintf(name, "%s Pen", hi->input->name);
-               mt_free_input_name(hi);
-               hi->input->name = name;
-       }
-
        /* force BTN_STYLUS to allow tablet matching in udev */
        __set_bit(BTN_STYLUS, hi->input->keybit);
 }
@@ -536,6 +509,10 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                        mt_store_field(usage, td, hi);
                        return 1;
                case HID_DG_CONTACTCOUNT:
+                       /* Ignore if indexes are out of bounds. */
+                       if (field->index >= field->report->maxfield ||
+                           usage->usage_index >= field->report_count)
+                               return 1;
                        td->cc_index = field->index;
                        td->cc_value_index = usage->usage_index;
                        return 1;
@@ -928,16 +905,26 @@ static void mt_post_parse(struct mt_device *td)
 static void mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
 {
        struct mt_device *td = hid_get_drvdata(hdev);
-       char *name = kstrdup(hdev->name, GFP_KERNEL);
-
-       if (name)
-               hi->input->name = name;
+       char *name;
+       const char *suffix = NULL;
 
        if (hi->report->id == td->mt_report_id)
                mt_touch_input_configured(hdev, hi);
 
-       if (hi->report->id == td->pen_report_id)
+       if (hi->report->field[0]->physical == HID_DG_STYLUS) {
+               suffix = "Pen";
                mt_pen_input_configured(hdev, hi);
+       }
+
+       if (suffix) {
+               name = devm_kzalloc(&hi->input->dev,
+                                   strlen(hdev->name) + strlen(suffix) + 2,
+                                   GFP_KERNEL);
+               if (name) {
+                       sprintf(name, "%s %s", hdev->name, suffix);
+                       hi->input->name = name;
+               }
+       }
 }
 
 static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
@@ -945,7 +932,6 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
        int ret, i;
        struct mt_device *td;
        struct mt_class *mtclass = mt_classes; /* MT_CLS_DEFAULT */
-       struct hid_input *hi;
 
        for (i = 0; mt_classes[i].name ; i++) {
                if (id->driver_data == mt_classes[i].name) {
@@ -967,7 +953,19 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
        hdev->quirks |= HID_QUIRK_MULTI_INPUT;
        hdev->quirks |= HID_QUIRK_NO_EMPTY_INPUT;
 
-       td = kzalloc(sizeof(struct mt_device), GFP_KERNEL);
+       /*
+        * Handle special quirks for Windows 8 certified devices.
+        */
+       if (id->group == HID_GROUP_MULTITOUCH_WIN_8)
+               /*
+                * Some multitouch screens do not like to be polled for input
+                * reports. Fortunately, the Win8 spec says that all touches
+                * should be sent during each report, making the initialization
+                * of input reports unnecessary.
+                */
+               hdev->quirks |= HID_QUIRK_NO_INIT_INPUT_REPORTS;
+
+       td = devm_kzalloc(&hdev->dev, sizeof(struct mt_device), GFP_KERNEL);
        if (!td) {
                dev_err(&hdev->dev, "cannot allocate multitouch data\n");
                return -ENOMEM;
@@ -980,11 +978,11 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
        td->pen_report_id = -1;
        hid_set_drvdata(hdev, td);
 
-       td->fields = kzalloc(sizeof(struct mt_fields), GFP_KERNEL);
+       td->fields = devm_kzalloc(&hdev->dev, sizeof(struct mt_fields),
+                                 GFP_KERNEL);
        if (!td->fields) {
                dev_err(&hdev->dev, "cannot allocate multitouch fields data\n");
-               ret = -ENOMEM;
-               goto fail;
+               return -ENOMEM;
        }
 
        if (id->vendor == HID_ANY_ID && id->product == HID_ANY_ID)
@@ -992,29 +990,22 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
 
        ret = hid_parse(hdev);
        if (ret != 0)
-               goto fail;
+               return ret;
 
        ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
        if (ret)
-               goto hid_fail;
+               return ret;
 
        ret = sysfs_create_group(&hdev->dev.kobj, &mt_attribute_group);
 
        mt_set_maxcontacts(hdev);
        mt_set_input_mode(hdev);
 
-       kfree(td->fields);
+       /* release .fields memory as it is not used anymore */
+       devm_kfree(&hdev->dev, td->fields);
        td->fields = NULL;
 
        return 0;
-
-hid_fail:
-       list_for_each_entry(hi, &hdev->inputs, list)
-               mt_free_input_name(hi);
-fail:
-       kfree(td->fields);
-       kfree(td);
-       return ret;
 }
 
 #ifdef CONFIG_PM
@@ -1039,17 +1030,8 @@ static int mt_resume(struct hid_device *hdev)
 
 static void mt_remove(struct hid_device *hdev)
 {
-       struct mt_device *td = hid_get_drvdata(hdev);
-       struct hid_input *hi;
-
        sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group);
-       list_for_each_entry(hi, &hdev->inputs, list)
-               mt_free_input_name(hi);
-
        hid_hw_stop(hdev);
-
-       kfree(td);
-       hid_set_drvdata(hdev, NULL);
 }
 
 static const struct hid_device_id mt_devices[] = {
@@ -1371,6 +1353,11 @@ static const struct hid_device_id mt_devices[] = {
 
        /* Generic MT device */
        { HID_DEVICE(HID_BUS_ANY, HID_GROUP_MULTITOUCH, HID_ANY_ID, HID_ANY_ID) },
+
+       /* Generic Win 8 certified MT device */
+       {  .driver_data = MT_CLS_WIN_8,
+               HID_DEVICE(HID_BUS_ANY, HID_GROUP_MULTITOUCH_WIN_8,
+                       HID_ANY_ID, HID_ANY_ID) },
        { }
 };
 MODULE_DEVICE_TABLE(hid, mt_devices);