linux-kernel - Re: [PATCH 1/3] Input: synaptics-rmi4 - disable the relative position IRQ in the F12 driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 27 Oct 2019 22:39:04 -0700
From:   Dmitry Torokhov <dmitry.torokhov@...il.com>
To:     Andrew Duggan <aduggan@...aptics.com>
Cc:     "linux-input@...r.kernel.org" <linux-input@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        Christopher Heiny <Cheiny@...aptics.com>,
        Simon Wood <simon@...gewell.org>,
        Nick Dyer <nick@...anahar.org>
Subject: Re: [PATCH 1/3] Input: synaptics-rmi4 - disable the relative
 position IRQ in the F12 driver

Hi Andrew,

On Fri, Oct 25, 2019 at 12:25:56AM +0000, Andrew Duggan wrote:
> This patch fixes an issue seen on HID touchpads which report finger
> positions using RMI4 Function 12. The issue manifests itself as
> spurious button presses as described in:
> https://www.spinics.net/lists/linux-input/msg58618.html
> 
> Commit 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution
> to irq_domain") switched the RMI4 driver to using an irq_domain to handle
> RMI4 function interrupts. Functions with more then one interrupt now have
> each interrupt mapped to their own IRQ and IRQ handler. The result of
> this change is that the F12 IRQ handler was now getting called twice. Once
> for the absolute data interrupt and once for the relative data interrupt.
> For HID devices, calling rmi_f12_attention() a second time causes the
> attn_data data pointer and size to be set incorrectly. When the touchpad
> button is pressed, F30 will generate an interrupt and attempt to read the
> F30 data from the invalid attn_data data pointer and report incorrect
> button events.

Maybe we should create only 1 interrupt per function instead of
multiple? It looks like the functions read their entire block of data on
any interrupt received.

> 
> This patch disables the F12 relative interrupt which prevents
> rmi_f12_attention() from being called twice.

Don't we have similar issue with F11, and maybe others?

Also, as far as F12 goes, I see that it may mark sensor as reporting
relative coordinates, but I do not see where it would actually emit
relative events. I must be missing something here...

Thanks.

-- 
Dmitry