New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 706899 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Apr 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug



Sign in to add a comment

veyron: crash in suspend with special 04b3:3016 IBM Corp. UltraNav Keyboard Hub

Project Member Reported by diand...@chromium.org, Mar 30 2017

Issue description

Forked from bug #706452

Someone with a mickey is apparently getting a crash on every suspend.  Since his mickey is always on, he crashes every 30 minutes.

Example:

80d8c2c4e0000000:

<6>[ 1804.466624] PM: suspend entry 2017-03-28 11:36:30.868680189 UTC
<6>[ 1804.466641] PM: Syncing filesystems ... done.
<7>[ 1804.489853] PM: Preparing system for mem sleep
<5>[ 1804.490923] Freezing user space processes ... (elapsed 0.001 seconds) done.
<5>[ 1804.492452] Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done.
<7>[ 1804.493664] PM: Entering mem sleep
<6>[ 1804.494004] calling  rfkill1+ @ 3841, parent: hci0, cb: rfkill_suspend
<6>[ 1804.494016] call rfkill1+ returned 0 after 1 usecs
<6>[ 1804.494072] calling  input6+ @ 3841, parent: 0003:06CB:0009.0005, cb: input_dev_suspend
<6>[ 1804.494109] call input6+ returned 0 after 13 usecs
<6>[ 1804.494154] calling  input5+ @ 3841, parent: 0003:06CB:0009.0004, cb: input_dev_suspend
<6>[ 1804.494173] call input5+ returned 0 after 8 usecs
<6>[ 1804.494207] calling  1-1.3.4+ @ 3742, parent: 1-1.3, cb: usb_dev_suspend
<0>[ 1804.506092] BUG: spinlock bad magic on CPU#2, kworker/u8:0/3742
<0>[ 1804.506115]  lock: 0xeb996a1c, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
<6>[ 1804.506122] calling  rfkill0+ @ 3841, parent: phy0, cb: rfkill_suspend
<6>[ 1804.506126] call rfkill0+ returned 0 after 0 usecs
<6>[ 1804.506154] calling  phy0+ @ 1383, parent: mmc2:0001:1, cb: wiphy_suspend [cfg80211]
<5>[ 1804.506170] CPU: 2 PID: 3742 Comm: kworker/u8:0 Not tainted 3.14.0 #1
<5>[ 1804.506187] Workqueue: events_unbound async_run_entry_fn
<5>[ 1804.506214] [<c020e550>] (unwind_backtrace) from [<c020a910>] (show_stack+0x20/0x24)
<5>[ 1804.506235] [<c020a910>] (show_stack) from [<c07f8534>] (dump_stack+0x7c/0xc0)
<5>[ 1804.506255] [<c07f8534>] (dump_stack) from [<c026cd98>] (spin_dump+0x88/0x9c)
<5>[ 1804.506269] [<c026cd98>] (spin_dump) from [<c026cde0>] (spin_bug+0x34/0x38)
<6>[ 1804.506275] calling  input4+ @ 3841, parent: 0003:04B3:3018.0003, cb: input_dev_suspend
<5>[ 1804.506297] [<c026cde0>] (spin_bug) from [<c026ce7c>] (do_raw_spin_lock+0x30/0x18c)
<5>[ 1804.506312] [<c026ce7c>] (do_raw_spin_lock) from [<c07fd1c8>] (_raw_spin_lock+0x30/0x34)
<6>[ 1804.506316] call input4+ returned 0 after 10 usecs
<6>[ 1804.506336] calling  input3+ @ 3841, parent: 0003:04B3:3018.0002, cb: input_dev_suspend
<5>[ 1804.506343] [<c07fd1c8>] (_raw_spin_lock) from [<c07fc058>] (__mutex_lock_slowpath+0x138/0x25c)
<5>[ 1804.506351] [<c07fc058>] (__mutex_lock_slowpath) from [<c07fc1bc>] (mutex_lock+0x40/0x58)
<5>[ 1804.506359] [<c07fc1bc>] (mutex_lock) from [<c06842b0>] (rmi_set_sleep_mode+0x54/0x100)
<5>[ 1804.506367] [<c06842b0>] (rmi_set_sleep_mode) from [<c0684420>] (rmi_suspend+0x74/0x8c)
<5>[ 1804.506374] [<c0684420>] (rmi_suspend) from [<c0687490>] (hid_suspend+0x130/0x1e8)
<5>[ 1804.506381] [<c0687490>] (hid_suspend) from [<c05ae3b0>] (usb_suspend_both+0x90/0x1a8)
<5>[ 1804.506387] [<c05ae3b0>] (usb_suspend_both) from [<c05aee08>] (usb_suspend+0xf8/0xfc)
<5>[ 1804.506392] [<c05aee08>] (usb_suspend) from [<c05a0c88>] (usb_dev_suspend+0x1c/0x20)
<5>[ 1804.506401] [<c05a0c88>] (usb_dev_suspend) from [<c055612c>] (dpm_run_callback+0x48/0x84)
<5>[ 1804.506407] [<c055612c>] (dpm_run_callback) from [<c05571bc>] (__device_suspend+0x21c/0x2e0)
<5>[ 1804.506414] [<c05571bc>] (__device_suspend) from [<c05572a8>] (async_suspend+0x28/0xa0)
<5>[ 1804.506420] [<c05572a8>] (async_suspend) from [<c024c9b4>] (async_run_entry_fn+0x8c/0x188)
<5>[ 1804.506429] [<c024c9b4>] (async_run_entry_fn) from [<c023f478>] (process_one_work+0x2cc/0x460)
<5>[ 1804.506436] [<c023f478>] (process_one_work) from [<c023fb00>] (worker_thread+0x234/0x38c)
<5>[ 1804.506442] [<c023fb00>] (worker_thread) from [<c02457d0>] (kthread+0xe4/0xfc)
<5>[ 1804.506448] [<c02457d0>] (kthread) from [<c02064f8>] (ret_from_fork+0x14/0x20)
<1>[ 1804.506456] Unable to handle kernel NULL pointer dereference at virtual address 00000000

---

Looking through logs:

<6>[    1.696471] usb 1-1.3: new full-speed USB device number 5 using dwc2
<6>[    1.733979] EXT4-fs (mmcblk0p1): recovery complete
<6>[    1.734686] EXT4-fs (mmcblk0p1): mounted filesystem with ordered data mode. Opts: commit=30
<6>[    1.742372] EXT4-fs (mmcblk0p8): mounted filesystem with ordered data mode. Opts: (null)
<6>[    1.799108] usb 1-1.3: New USB device found, idVendor=04b3, idProduct=3016
<6>[    1.799128] usb 1-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
<6>[    1.799143] usb 1-1.3: Product: USB 1.1 2 port downstream low-power hub
<6>[    1.799155] usb 1-1.3: Manufacturer: Lite-On Tech
<6>[    1.800003] hub 1-1.3:1.0: USB hub found
<6>[    1.800541] hub 1-1.3:1.0: 4 ports detected
...
<6>[    2.076365] usb 1-1.3.3: new low-speed USB device number 7 using dwc2
<6>[    2.172660] cfg80211: Calling CRDA to update world regulatory domain
<6>[    2.187051] usb 1-1.3.3: New USB device found, idVendor=04b3, idProduct=3018
<6>[    2.187077] usb 1-1.3.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
<6>[    2.187091] usb 1-1.3.3: Product: IBM USB Keyboard with UltraNav
<6>[    2.187105] usb 1-1.3.3: Manufacturer: Lite-On Tech
<3>[    2.189127] brcmfmac: brcmf_sdio_drivestrengthinit: No SDIO Drive strength init done for chip 4354 rev 1 pmurev 24
<6>[    2.192976] input: Lite-On Tech IBM USB Keyboard with UltraNav as /devices/ff580000.usb/usb1/1-1/1-1.3/1-1.3.3/1-1.3.3:1.0/0003:04B3:3018.0002/input/input3
<6>[    2.193951] hid-generic 0003:04B3:3018.0002: input,hidraw1: USB HID v1.10 Keyboard [Lite-On Tech IBM USB Keyboard with UltraNav] on usb-ff580000.usb-1.3.3/input0
<6>[    2.200479] input: Lite-On Tech IBM USB Keyboard with UltraNav as /devices/ff580000.usb/usb1/1-1/1-1.3/1-1.3.3/1-1.3.3:1.1/0003:04B3:3018.0003/input/input4
<6>[    2.200752] hid-generic 0003:04B3:3018.0003: input,hidraw2: USB HID v1.10 Device [Lite-On Tech IBM USB Keyboard with UltraNav] on usb-ff580000.usb-1.3.3/input1


This is likely the device causing the problems.
 

Comment 1 by dtor@chromium.org, Apr 4 2017

Status: Started (was: Untriaged)
Project Member

Comment 2 by bugdroid1@chromium.org, Apr 5 2017

Labels: merge-merged-chromeos-3.18
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/588fa7ea340c6183f41225bed9758b3171d90088

commit 588fa7ea340c6183f41225bed9758b3171d90088
Author: Andrew Duggan <aduggan@synaptics.com>
Date: Wed Apr 05 01:12:53 2017

BACKPORT: HID: rmi: Check that the device is a RMI device in suspend and resume callbacks

Commit 092563604217 ("HID: rmi: Disable scanning if the device is not a wake
source") introduced a regression for devices which use hid-rmi to handle
composite USB devices. The suspend or resume callbacks are not checking
that the device is a RMI device before calling rmi_read or rmi_write.
This results in dereferencing uninitialized variables on non RMI devices. This
patch checks that the RMI_DEVICE flag is set before sending RMI commands to the
device.

Reported-by: Rodrigo Gomes <rodrigo.toste.gomes@gmail.com>
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

[dtor@chromium.org: adjusted to set up inhibit/uninhibit methods to be
only set up after we committed to using RMI mode; context conflicts]

BUG= chromium:706899 
TEST=Built and booted caroline, suspended with the device in question

(cherry picked from commit b786ae8e269b5b30fea5efaab8cba32ba9aece61)
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Change-Id: I85991f6480c9c5e6c99763f6c51312812b37d5d0
Reviewed-on: https://chromium-review.googlesource.com/468011
Reviewed-by: Benson Leung <bleung@chromium.org>

[modify] https://crrev.com/588fa7ea340c6183f41225bed9758b3171d90088/drivers/hid/hid-rmi.c

Project Member

Comment 3 by bugdroid1@chromium.org, Apr 5 2017

Labels: merge-merged-chromeos-3.14
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/9679dda8b8e0f414800662c9b4d741295f0b09be

commit 9679dda8b8e0f414800662c9b4d741295f0b09be
Author: Andrew Duggan <aduggan@synaptics.com>
Date: Wed Apr 05 23:30:09 2017

BACKPORT: HID: rmi: Check that the device is a RMI device in suspend and resume callbacks

Commit 092563604217 ("HID: rmi: Disable scanning if the device is not a wake
source") introduced a regression for devices which use hid-rmi to handle
composite USB devices. The suspend or resume callbacks are not checking
that the device is a RMI device before calling rmi_read or rmi_write.
This results in dereferencing uninitialized variables on non RMI devices. This
patch checks that the RMI_DEVICE flag is set before sending RMI commands to the
device.

Reported-by: Rodrigo Gomes <rodrigo.toste.gomes@gmail.com>
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

[dtor@chromium.org: adjusted to set up inhibit/uninhibit methods to be
only set up after we committed to using RMI mode; context conflicts]

BUG= chromium:706899 
TEST=Built and booted caroline, suspended with the device in question

(cherry picked from commit b786ae8e269b5b30fea5efaab8cba32ba9aece61)
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Change-Id: I85991f6480c9c5e6c99763f6c51312812b37d5d0
(cherry picked from commit 588fa7ea340c6183f41225bed9758b3171d90088)
Reviewed-on: https://chromium-review.googlesource.com/468088
Commit-Ready: Brian Norris <briannorris@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>

[modify] https://crrev.com/9679dda8b8e0f414800662c9b4d741295f0b09be/drivers/hid/hid-rmi.c

Project Member

Comment 4 by bugdroid1@chromium.org, Apr 6 2017

Labels: merge-merged-chromeos-4.4
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/cdaeedbd0814fc89c28fa7e924de27060671e163

commit cdaeedbd0814fc89c28fa7e924de27060671e163
Author: Andrew Duggan <aduggan@synaptics.com>
Date: Thu Apr 06 17:56:31 2017

UPSTREAM: HID: rmi: Check that the device is a RMI device in suspend and resume callbacks

Commit 092563604217 ("HID: rmi: Disable scanning if the device is not a wake
source") introduced a regression for devices which use hid-rmi to handle
composite USB devices. The suspend or resume callbacks are not checking
that the device is a RMI device before calling rmi_read or rmi_write.
This results in dereferencing uninitialized variables on non RMI devices. This
patch checks that the RMI_DEVICE flag is set before sending RMI commands to the
device.

Reported-by: Rodrigo Gomes <rodrigo.toste.gomes@gmail.com>
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

BUG= chromium:706899 
TEST=Built and booted caroline, suspended with the device in question

(cherry picked from commit b786ae8e269b5b30fea5efaab8cba32ba9aece61)
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Change-Id: I85991f6480c9c5e6c99763f6c51312812b37d5d0
Reviewed-on: https://chromium-review.googlesource.com/467991
Commit-Ready: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>

[modify] https://crrev.com/cdaeedbd0814fc89c28fa7e924de27060671e163/drivers/hid/hid-rmi.c

Project Member

Comment 5 by bugdroid1@chromium.org, Apr 6 2017

Labels: merge-merged-chromeos-4.4
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/cdaeedbd0814fc89c28fa7e924de27060671e163

commit cdaeedbd0814fc89c28fa7e924de27060671e163
Author: Andrew Duggan <aduggan@synaptics.com>
Date: Thu Apr 06 17:56:31 2017

UPSTREAM: HID: rmi: Check that the device is a RMI device in suspend and resume callbacks

Commit 092563604217 ("HID: rmi: Disable scanning if the device is not a wake
source") introduced a regression for devices which use hid-rmi to handle
composite USB devices. The suspend or resume callbacks are not checking
that the device is a RMI device before calling rmi_read or rmi_write.
This results in dereferencing uninitialized variables on non RMI devices. This
patch checks that the RMI_DEVICE flag is set before sending RMI commands to the
device.

Reported-by: Rodrigo Gomes <rodrigo.toste.gomes@gmail.com>
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

BUG= chromium:706899 
TEST=Built and booted caroline, suspended with the device in question

(cherry picked from commit b786ae8e269b5b30fea5efaab8cba32ba9aece61)
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Change-Id: I85991f6480c9c5e6c99763f6c51312812b37d5d0
Reviewed-on: https://chromium-review.googlesource.com/467991
Commit-Ready: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>

[modify] https://crrev.com/cdaeedbd0814fc89c28fa7e924de27060671e163/drivers/hid/hid-rmi.c

Labels: M-59
Status: Fixed (was: Started)
3.10 also landed, but no bugsplat.  Marking as Fixed M-59, but if someone things that this should go to M-58 please yell.  This was originally found because it was a huge chunk of mickey crashes, but it was also just one guy's machine that was crashing every time it tried to suspend...  :-/

Comment 7 by dtor@chromium.org, Apr 7 2017

Cc: bhthompson@chromium.org
Labels: Merge-Request-58
Cherry picks are cheap and I think it is nice not to crash if somebody plugs external UltraNav keyboard into their devices. Requesting merge to 58.
Labels: -Merge-Request-58 Merge-Approved-58
Project Member

Comment 9 by bugdroid1@chromium.org, Apr 7 2017

Labels: merge-merged-release-R58-9334.B-chromeos-3.14
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/b73a2de228df87e7ead5c43d697c85759ed5e932

commit b73a2de228df87e7ead5c43d697c85759ed5e932
Author: Andrew Duggan <aduggan@synaptics.com>
Date: Fri Apr 07 21:01:27 2017

BACKPORT: HID: rmi: Check that the device is a RMI device in suspend and resume callbacks

Commit 092563604217 ("HID: rmi: Disable scanning if the device is not a wake
source") introduced a regression for devices which use hid-rmi to handle
composite USB devices. The suspend or resume callbacks are not checking
that the device is a RMI device before calling rmi_read or rmi_write.
This results in dereferencing uninitialized variables on non RMI devices. This
patch checks that the RMI_DEVICE flag is set before sending RMI commands to the
device.

Reported-by: Rodrigo Gomes <rodrigo.toste.gomes@gmail.com>
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

[dtor@chromium.org: adjusted to set up inhibit/uninhibit methods to be
only set up after we committed to using RMI mode; context conflicts]

BUG= chromium:706899 
TEST=Built and booted caroline, suspended with the device in question

(cherry picked from commit b786ae8e269b5b30fea5efaab8cba32ba9aece61)
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Change-Id: I85991f6480c9c5e6c99763f6c51312812b37d5d0
(cherry picked from commit 588fa7ea340c6183f41225bed9758b3171d90088)
Reviewed-on: https://chromium-review.googlesource.com/468088
Commit-Ready: Brian Norris <briannorris@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
(cherry picked from commit 9679dda8b8e0f414800662c9b4d741295f0b09be)
Reviewed-on: https://chromium-review.googlesource.com/471911

[modify] https://crrev.com/b73a2de228df87e7ead5c43d697c85759ed5e932/drivers/hid/hid-rmi.c

Project Member

Comment 10 by bugdroid1@chromium.org, Apr 7 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/b73a2de228df87e7ead5c43d697c85759ed5e932

commit b73a2de228df87e7ead5c43d697c85759ed5e932
Author: Andrew Duggan <aduggan@synaptics.com>
Date: Fri Apr 07 21:01:27 2017

BACKPORT: HID: rmi: Check that the device is a RMI device in suspend and resume callbacks

Commit 092563604217 ("HID: rmi: Disable scanning if the device is not a wake
source") introduced a regression for devices which use hid-rmi to handle
composite USB devices. The suspend or resume callbacks are not checking
that the device is a RMI device before calling rmi_read or rmi_write.
This results in dereferencing uninitialized variables on non RMI devices. This
patch checks that the RMI_DEVICE flag is set before sending RMI commands to the
device.

Reported-by: Rodrigo Gomes <rodrigo.toste.gomes@gmail.com>
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

[dtor@chromium.org: adjusted to set up inhibit/uninhibit methods to be
only set up after we committed to using RMI mode; context conflicts]

BUG= chromium:706899 
TEST=Built and booted caroline, suspended with the device in question

(cherry picked from commit b786ae8e269b5b30fea5efaab8cba32ba9aece61)
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Change-Id: I85991f6480c9c5e6c99763f6c51312812b37d5d0
(cherry picked from commit 588fa7ea340c6183f41225bed9758b3171d90088)
Reviewed-on: https://chromium-review.googlesource.com/468088
Commit-Ready: Brian Norris <briannorris@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
(cherry picked from commit 9679dda8b8e0f414800662c9b4d741295f0b09be)
Reviewed-on: https://chromium-review.googlesource.com/471911

[modify] https://crrev.com/b73a2de228df87e7ead5c43d697c85759ed5e932/drivers/hid/hid-rmi.c

Project Member

Comment 11 by bugdroid1@chromium.org, Apr 7 2017

Labels: merge-merged-release-R58-9334.B-chromeos-3.10
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/26b86e1bf74070694967afd7a102c0644968927e

commit 26b86e1bf74070694967afd7a102c0644968927e
Author: Andrew Duggan <aduggan@synaptics.com>
Date: Fri Apr 07 21:01:33 2017

BACKPORT: HID: rmi: Check that the device is a RMI device in suspend and resume callbacks

Commit 092563604217 ("HID: rmi: Disable scanning if the device is not a wake
source") introduced a regression for devices which use hid-rmi to handle
composite USB devices. The suspend or resume callbacks are not checking
that the device is a RMI device before calling rmi_read or rmi_write.
This results in dereferencing uninitialized variables on non RMI devices. This
patch checks that the RMI_DEVICE flag is set before sending RMI commands to the
device.

Reported-by: Rodrigo Gomes <rodrigo.toste.gomes@gmail.com>
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

[dtor@chromium.org: context conflicts]

BUG= chromium:706899 
TEST=Built and booted caroline, suspended with the device in question

(cherry picked from commit b786ae8e269b5b30fea5efaab8cba32ba9aece61)
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Change-Id: I85991f6480c9c5e6c99763f6c51312812b37d5d0
(cherry picked from commit 588fa7ea340c6183f41225bed9758b3171d90088)
Reviewed-on: https://chromium-review.googlesource.com/468028
Reviewed-by: Douglas Anderson <dianders@chromium.org>
(cherry picked from commit ec5f465f94ebe3db092b741248a08a299ba5a576)
Reviewed-on: https://chromium-review.googlesource.com/471912

[modify] https://crrev.com/26b86e1bf74070694967afd7a102c0644968927e/drivers/hid/hid-rmi.c

Project Member

Comment 12 by bugdroid1@chromium.org, Apr 7 2017

Labels: merge-merged-release-R58-9334.B-chromeos-3.18
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/3b12750e0368bbd1f1fafa861051b0ab6388a591

commit 3b12750e0368bbd1f1fafa861051b0ab6388a591
Author: Andrew Duggan <aduggan@synaptics.com>
Date: Fri Apr 07 21:01:38 2017

BACKPORT: HID: rmi: Check that the device is a RMI device in suspend and resume callbacks

Commit 092563604217 ("HID: rmi: Disable scanning if the device is not a wake
source") introduced a regression for devices which use hid-rmi to handle
composite USB devices. The suspend or resume callbacks are not checking
that the device is a RMI device before calling rmi_read or rmi_write.
This results in dereferencing uninitialized variables on non RMI devices. This
patch checks that the RMI_DEVICE flag is set before sending RMI commands to the
device.

Reported-by: Rodrigo Gomes <rodrigo.toste.gomes@gmail.com>
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

[dtor@chromium.org: adjusted to set up inhibit/uninhibit methods to be
only set up after we committed to using RMI mode; context conflicts]

BUG= chromium:706899 
TEST=Built and booted caroline, suspended with the device in question

(cherry picked from commit b786ae8e269b5b30fea5efaab8cba32ba9aece61)
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Change-Id: I85991f6480c9c5e6c99763f6c51312812b37d5d0
Reviewed-on: https://chromium-review.googlesource.com/468011
Reviewed-by: Benson Leung <bleung@chromium.org>
(cherry picked from commit 588fa7ea340c6183f41225bed9758b3171d90088)
Reviewed-on: https://chromium-review.googlesource.com/471910
Reviewed-by: Douglas Anderson <dianders@chromium.org>

[modify] https://crrev.com/3b12750e0368bbd1f1fafa861051b0ab6388a591/drivers/hid/hid-rmi.c

Project Member

Comment 13 by bugdroid1@chromium.org, Apr 7 2017

Labels: merge-merged-release-R58-9334.B-chromeos-4.4
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/e1155a3c0a6854eca1598e5166935a360bae237e

commit e1155a3c0a6854eca1598e5166935a360bae237e
Author: Andrew Duggan <aduggan@synaptics.com>
Date: Fri Apr 07 21:01:43 2017

UPSTREAM: HID: rmi: Check that the device is a RMI device in suspend and resume callbacks

Commit 092563604217 ("HID: rmi: Disable scanning if the device is not a wake
source") introduced a regression for devices which use hid-rmi to handle
composite USB devices. The suspend or resume callbacks are not checking
that the device is a RMI device before calling rmi_read or rmi_write.
This results in dereferencing uninitialized variables on non RMI devices. This
patch checks that the RMI_DEVICE flag is set before sending RMI commands to the
device.

Reported-by: Rodrigo Gomes <rodrigo.toste.gomes@gmail.com>
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

BUG= chromium:706899 
TEST=Built and booted caroline, suspended with the device in question

(cherry picked from commit b786ae8e269b5b30fea5efaab8cba32ba9aece61)
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Change-Id: I85991f6480c9c5e6c99763f6c51312812b37d5d0
Reviewed-on: https://chromium-review.googlesource.com/467991
Commit-Ready: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
(cherry picked from commit cdaeedbd0814fc89c28fa7e924de27060671e163)
Reviewed-on: https://chromium-review.googlesource.com/471908

[modify] https://crrev.com/e1155a3c0a6854eca1598e5166935a360bae237e/drivers/hid/hid-rmi.c

Project Member

Comment 14 by bugdroid1@chromium.org, Apr 7 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/cdc69c8ed73716ad63a488a99b299a11a6f7effa

commit cdc69c8ed73716ad63a488a99b299a11a6f7effa
Author: Andrew Duggan <aduggan@synaptics.com>
Date: Fri Apr 07 21:06:55 2017

CHROMIUM: HID: rmi: only set up inhibit if device is a RMI device

If device is not an RMI device, but a composite device, we should not
try to use RMI protocol to access it when inhibiting/uninhibiting.

BUG= chromium:706899 
TEST=Built and booted caroline, suspended with the device in question

Change-Id: I0a6ff4fa67ed8849b777e7abaf77f82d04fb41d4
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/468647
Commit-Ready: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
(cherry picked from commit 5a4b233ec6c1ca4291b3bcd2372e57b2b932738e)
Reviewed-on: https://chromium-review.googlesource.com/471909

[modify] https://crrev.com/cdc69c8ed73716ad63a488a99b299a11a6f7effa/drivers/hid/hid-rmi.c

Project Member

Comment 15 by bugdroid1@chromium.org, Apr 7 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/cdc69c8ed73716ad63a488a99b299a11a6f7effa

commit cdc69c8ed73716ad63a488a99b299a11a6f7effa
Author: Andrew Duggan <aduggan@synaptics.com>
Date: Fri Apr 07 21:06:55 2017

CHROMIUM: HID: rmi: only set up inhibit if device is a RMI device

If device is not an RMI device, but a composite device, we should not
try to use RMI protocol to access it when inhibiting/uninhibiting.

BUG= chromium:706899 
TEST=Built and booted caroline, suspended with the device in question

Change-Id: I0a6ff4fa67ed8849b777e7abaf77f82d04fb41d4
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/468647
Commit-Ready: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
(cherry picked from commit 5a4b233ec6c1ca4291b3bcd2372e57b2b932738e)
Reviewed-on: https://chromium-review.googlesource.com/471909

[modify] https://crrev.com/cdc69c8ed73716ad63a488a99b299a11a6f7effa/drivers/hid/hid-rmi.c

Comment 16 by dtor@chromium.org, Apr 7 2017

Labels: -Merge-Approved-58
Status: Verified (was: Fixed)
Verified in Chrome OS 9460.20.0, 59.0.3071.33 on Mickey. 

Sign in to add a comment