Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  USB HID: Add ID for eGalax Multitouch used in JooJoo tablet
  HID: hiddev: fix memory corruption due to invalid intfdata
  HID: hiddev: protect against disconnect/NULL-dereference race
  HID: picolcd: correct ordering of framebuffer freeing
  HID: picolcd: testing the wrong variable

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index e635199a0cd258298d0f50fd658fbcaec647f569..0c52899be9643d85af5c7ac6be8c87bc67d6e6ce 100644 (file)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1299,6 +1299,7 @@ static const struct hid_device_id hid_blacklist[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE) },
        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0006) },
        { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH) },
+       { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH1) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
        { HID_USB_DEVICE(USB_VENDOR_ID_EZKEY, USB_DEVICE_ID_BTC_8193) },
        { HID_USB_DEVICE(USB_VENDOR_ID_GAMERON, USB_DEVICE_ID_GAMERON_DUAL_PSX_ADAPTOR) },

diff --git a/drivers/hid/hid-egalax.c b/drivers/hid/hid-egalax.c
index f44bdc084cb297eed86ea504c711eec6f91ebaf0..8ca7f65cf2f804d32120fadfa81cc9b900dfd94a 100644 (file)
--- a/drivers/hid/hid-egalax.c
+++ b/drivers/hid/hid-egalax.c
@@ -159,6 +159,13 @@ static int egalax_event(struct hid_device *hid, struct hid_field *field,
 {
        struct egalax_data *td = hid_get_drvdata(hid);
 
+       /* Note, eGalax has two product lines: the first is resistive and
+        * uses a standard parallel multitouch protocol (product ID ==
+        * 48xx).  The second is capacitive and uses an unusual "serial"
+        * protocol with a different message for each multitouch finger
+        * (product ID == 72xx).  We do not yet generate a correct event
+        * sequence for the capacitive/serial protocol.
+        */
        if (hid->claimed & HID_CLAIMED_INPUT) {
                struct input_dev *input = field->hidinput->input;
 
@@ -246,6 +253,8 @@ static void egalax_remove(struct hid_device *hdev)
 static const struct hid_device_id egalax_devices[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
                        USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH) },
+       { HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+                       USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH1) },
        { }
 };
 MODULE_DEVICE_TABLE(hid, egalax_devices);

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index d3fc13ae094da4fcd5ef93671fbfab73332ff606..85c6d13c9ffa9369fca613eda828133b2b69a3e2 100644 (file)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -188,6 +188,7 @@
 #define USB_VENDOR_ID_DWAV             0x0eef
 #define USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER   0x0001
 #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH   0x480d
+#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH1  0x720c
 
 #define USB_VENDOR_ID_ELECOM           0x056e
 #define USB_DEVICE_ID_ELECOM_BM084     0x0061

diff --git a/drivers/hid/hid-picolcd.c b/drivers/hid/hid-picolcd.c
index 346f0e34987e68454dddd3393c2b24cc1f640729..bc2e0774062864667ca92c52e3b4e7a23d923f53 100644 (file)
--- a/drivers/hid/hid-picolcd.c
+++ b/drivers/hid/hid-picolcd.c
@@ -547,11 +547,11 @@ static void picolcd_fb_destroy(struct fb_info *info)
        ref_cnt--;
        mutex_lock(&info->lock);
        (*ref_cnt)--;
-       may_release = !ref_cnt;
+       may_release = !*ref_cnt;
        mutex_unlock(&info->lock);
        if (may_release) {
-               framebuffer_release(info);
                vfree((u8 *)info->fix.smem_start);
+               framebuffer_release(info);
        }
 }
 

diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 254a003af048dd7a909e68f4a96ffcaae391bc96..0a29c51114aaf0d36c64f6c8c25195db5e2f3747 100644 (file)
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -266,13 +266,15 @@ static int hiddev_open(struct inode *inode, struct file *file)
 {
        struct hiddev_list *list;
        struct usb_interface *intf;
+       struct hid_device *hid;
        struct hiddev *hiddev;
        int res;
 
        intf = usb_find_interface(&hiddev_driver, iminor(inode));
        if (!intf)
                return -ENODEV;
-       hiddev = usb_get_intfdata(intf);
+       hid = usb_get_intfdata(intf);
+       hiddev = hid->hiddev;
 
        if (!(list = kzalloc(sizeof(struct hiddev_list), GFP_KERNEL)))
                return -ENOMEM;
@@ -587,7 +589,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        struct hiddev_list *list = file->private_data;
        struct hiddev *hiddev = list->hiddev;
        struct hid_device *hid = hiddev->hid;
-       struct usb_device *dev = hid_to_usb_dev(hid);
+       struct usb_device *dev;
        struct hiddev_collection_info cinfo;
        struct hiddev_report_info rinfo;
        struct hiddev_field_info finfo;
@@ -601,9 +603,11 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        /* Called without BKL by compat methods so no BKL taken */
 
        /* FIXME: Who or what stop this racing with a disconnect ?? */
-       if (!hiddev->exist)
+       if (!hiddev->exist || !hid)
                return -EIO;
 
+       dev = hid_to_usb_dev(hid);
+
        switch (cmd) {
 
        case HIDIOCGVERSION:
@@ -888,7 +892,6 @@ int hiddev_connect(struct hid_device *hid, unsigned int force)
        hid->hiddev = hiddev;
        hiddev->hid = hid;
        hiddev->exist = 1;
-       usb_set_intfdata(usbhid->intf, usbhid);
        retval = usb_register_dev(usbhid->intf, &hiddev_class);
        if (retval) {
                err_hid("Not able to get a minor for this device.");