From patchwork Thu Dec 7 20:31:56 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aaron Armstrong Skomra X-Patchwork-Id: 10100943 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 2BBC160325 for ; Thu, 7 Dec 2017 20:32:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1E69C1FFB2 for ; Thu, 7 Dec 2017 20:32:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1347B2818E; Thu, 7 Dec 2017 20:32:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8ACB91FFB2 for ; Thu, 7 Dec 2017 20:32:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752276AbdLGUcC (ORCPT ); Thu, 7 Dec 2017 15:32:02 -0500 Received: from mail-pf0-f196.google.com ([209.85.192.196]:36419 "EHLO mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750931AbdLGUcB (ORCPT ); Thu, 7 Dec 2017 15:32:01 -0500 Received: by mail-pf0-f196.google.com with SMTP id p84so5545690pfd.3; Thu, 07 Dec 2017 12:32:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=QFzRd4iPSL9q3mcAIm5EyQaN0XxAwy7J0L1otXybaaE=; b=qRzwLE4pLbYrpmLSiR+i9HXar3sGJ0EH1Fau7ECSXm5OtsPkl+9e42NU2PxH0nVqQ9 BahDGj0wMA43lBi8f29hu/TDvHG4CQRL2ONZ6Mej9u83Pi69d7yFMQ9Ax8gOJHcjRjBc JfRbdAegslzmWblXRo3aqKuoW3J1etkQODah5pAW3jRnivB/sxJc+uyXuAPY2rOyK8/C Szt8a4wC/9iRPnE6IJcGkebAwldeHj/sYBTUbQf8MUh8XKG6RvrSxrKZmhysbtzsY4Ol DYPfPvLPWF9ImPQMQBCysLfuuZhfqDQmEGDEnO80g84SvYVANODnpuZlRHEG3jpMu47r yNlA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=QFzRd4iPSL9q3mcAIm5EyQaN0XxAwy7J0L1otXybaaE=; b=BpBh317bzrCqYVl0rx3PqpYQESwEVEH5RvlQd0TOjQ+w9SLlwheU+Aqi+GFioH587Y 94lQX5qZeRvOtjVjwlFVITdxbI/g/haT/DBNh/cciRl/765Yw4zqbgUruJJyGBHsDEhE ZZLd1NaV/dPgdu6hPitPb8v/RXdnoGKgQ/yc6L0iXHVLP5deqoZGvIz6AEdqRawxEj2v eA7oTWpjBm46SpdKyz4HmH1qI5RCgx2i+Gg+uuzy19cpTUp3OIA9OFU04vYhTY0zURdu lUpQhMG1fuJ2PTeJEnIQDv2LUB2xHgpXAaiSf8tHwKHsm8u+WTCL9TlTY8F2oLXLADL3 7u5w== X-Gm-Message-State: AJaThX505h9+jNR7JU5Jau5fTPu6amJ3bTD3eN6QsgUlb99OqAXYzDXR LLIEmI7QyVyV8kLIaWLN06eqJxpR X-Google-Smtp-Source: AGs4zMYairFBvsuQmsiuP0qPRBsfc+AFLTE7LxoysJnVSNDNetqeyvLeQHGG54dqOM1bqjWunt/uDQ== X-Received: by 10.99.140.85 with SMTP id q21mr26772311pgn.57.1512678720106; Thu, 07 Dec 2017 12:32:00 -0800 (PST) Received: from juhua.Home (184-100-226-242.ptld.qwest.net. [184.100.226.242]) by smtp.googlemail.com with ESMTPSA id u13sm8781052pgb.68.2017.12.07.12.31.58 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 07 Dec 2017 12:31:59 -0800 (PST) From: Aaron Armstrong Skomra To: linux-input@vger.kernel.org, jkosina@suse.cz, pinglinux@gmail.com, killertofu@gmail.com, benjamin.tissoires@redhat.com Cc: Aaron Armstrong Skomra , "stable #4 . 9" , Aaron Armstrong Skomra Subject: [PATCH] HID: wacom: EKR: ensure devres groups at higher indexes are released Date: Thu, 7 Dec 2017 12:31:56 -0800 Message-Id: <1512678716-31779-1-git-send-email-skomra@gmail.com> X-Mailer: git-send-email 2.7.4 Sender: linux-input-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-input@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Background: ExpressKey Remotes communicate their events via usb dongle. Each dongle can hold up to 5 pairings at one time and one EKR (identified by its serial number) can unfortunately be paired with its dongle more than once. The pairing takes place in a round-robin fashion. Input devices are only created once per EKR, when a new serial number is seen in the list of pairings. However, if a device is created for a "higher" paring index and subsequently a second pairing occurs at a lower pairing index, unpairing the remote with that serial number from any pairing index will currently cause a driver crash. This occurs infrequently, as two remotes are necessary to trigger this bug and most users have only one remote. As an illustration, to trigger the bug you need to have two remotes, and pair them in this order: 1. slot 0 -> remote 1 (input device created for remote 1) 2. slot 1 -> remote 1 (duplicate pairing - no device created) 3. slot 2 -> remote 1 (duplicate pairing - no device created) 4. slot 3 -> remote 1 (duplicate pairing - no device created) 5. slot 4 -> remote 2 (input device created for remote 2) 6. slot 0 -> remote 2 (1 destroyed and recreated at slot 1) 7. slot 1 -> remote 2 (1 destroyed and recreated at slot 2) 8. slot 2 -> remote 2 (1 destroyed and recreated at slot 3) 9. slot 3 -> remote 2 (1 destroyed and not recreated) 10. slot 4 -> remote 2 (2 was already in this slot so no changes) 11. slot 0 -> remote 1 (The current code sees remote 2 was paired over in one of the dongle slots it occupied and attempts to remove all information about remote 2 [1]. It calls wacom_remote_destroy_one for remote 2, but the destroy function assumes the lowest index is where the remote's input device was created. The code "cleans up" the other remote 2 pairings including the one which the input device was based on, assuming they were were just duplicate pairings. However, the cleanup doesn't call the devres release function for the input device that was created in slot 4). This issue is fixed by this commit. [1] Remote 2 should subsequently be re-created on the next packet from the EKR at the lowest numbered slot that it occupies (here slot 1). Fixes: f9036bd43602 ("HID: wacom: EKR: use devres groups to manage resources") Cc: stable #4.9 Signed-off-by: Aaron Armstrong Skomra --- drivers/hid/wacom_sys.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c index ee71ad9b6cc1..76531796bd3c 100644 --- a/drivers/hid/wacom_sys.c +++ b/drivers/hid/wacom_sys.c @@ -2347,23 +2347,23 @@ static void wacom_remote_destroy_one(struct wacom *wacom, unsigned int index) int i; unsigned long flags; - spin_lock_irqsave(&remote->remote_lock, flags); - remote->remotes[index].registered = false; - spin_unlock_irqrestore(&remote->remote_lock, flags); + for (i = 0; i < WACOM_MAX_REMOTES; i++) { + if (remote->remotes[i].serial == serial) { - if (remote->remotes[index].battery.battery) - devres_release_group(&wacom->hdev->dev, - &remote->remotes[index].battery.bat_desc); + spin_lock_irqsave(&remote->remote_lock, flags); + remote->remotes[i].registered = false; + spin_unlock_irqrestore(&remote->remote_lock, flags); - if (remote->remotes[index].group.name) - devres_release_group(&wacom->hdev->dev, - &remote->remotes[index]); + if (remote->remotes[i].battery.battery) + devres_release_group(&wacom->hdev->dev, + &remote->remotes[i].battery.bat_desc); + + if (remote->remotes[i].group.name) + devres_release_group(&wacom->hdev->dev, + &remote->remotes[i]); - for (i = 0; i < WACOM_MAX_REMOTES; i++) { - if (remote->remotes[i].serial == serial) { remote->remotes[i].serial = 0; remote->remotes[i].group.name = NULL; - remote->remotes[i].registered = false; remote->remotes[i].battery.battery = NULL; wacom->led.groups[i].select = WACOM_STATUS_UNKNOWN; }