Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

Pull HID fixes from Jiri Kosina:

 - fix for bounds limit calculation in uclogic driver, by Dan Carpenter

 - fix for use-after-free during device removal, by Krzysztof Kozlowski

 - fix for userspace regression (that became apparent only with shiny
   new libinput, so it's not that bad, but I still consider it 4.2
   material), in wacom driver, by Jason Gerecke

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: wacom: Report correct device resolution when using the wireless adapater
  HID: hid-input: Fix accessing freed memory during device disconnect
  HID: uclogic: fix limit in uclogic_tablet_enable()

3 files changed, 43 insertions, 36 deletions

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 3511bbaba505..e3c63640df73 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -462,12 +462,15 @@ out:
 
 static void hidinput_cleanup_battery(struct hid_device *dev)
 {
+        const struct power_supply_desc *psy_desc;
+
         if (!dev->battery)
                 return;
 
+        psy_desc = dev->battery->desc;
         power_supply_unregister(dev->battery);
-        kfree(dev->battery->desc->name);
-        kfree(dev->battery->desc);
+        kfree(psy_desc->name);
+        kfree(psy_desc);
         dev->battery = NULL;
 }
 #else  /* !CONFIG_HID_BATTERY_STRENGTH */
diff --git a/drivers/hid/hid-uclogic.c b/drivers/hid/hid-uclogic.c
index 94167310e15a..b905d501e752 100644
--- a/drivers/hid/hid-uclogic.c
+++ b/drivers/hid/hid-uclogic.c
@@ -858,7 +858,7 @@ static int uclogic_tablet_enable(struct hid_device *hdev)
         for (p = drvdata->rdesc;
              p <= drvdata->rdesc + drvdata->rsize - 4;) {
                 if (p[0] == 0xFE && p[1] == 0xED && p[2] == 0x1D &&
-                    p[3] < sizeof(params)) {
+                    p[3] < ARRAY_SIZE(params)) {
                         v = params[p[3]];
                         put_unaligned(cpu_to_le32(v), (s32 *)p);
                         p += 4;
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 44958d79d598..01b937e63cf3 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -1284,6 +1284,39 @@ fail_register_pen_input:
         return error;
 }
 
+/*
+ * Not all devices report physical dimensions from HID.
+ * Compute the default from hardcoded logical dimension
+ * and resolution before driver overwrites them.
+ */
+static void wacom_set_default_phy(struct wacom_features *features)
+{
+        if (features->x_resolution) {
+                features->x_phy = (features->x_max * 100) /
+                                        features->x_resolution;
+                features->y_phy = (features->y_max * 100) /
+                                        features->y_resolution;
+        }
+}
+
+static void wacom_calculate_res(struct wacom_features *features)
+{
+        /* set unit to "100th of a mm" for devices not reported by HID */
+        if (!features->unit) {
+                features->unit = 0x11;
+                features->unitExpo = -3;
+        }
+
+        features->x_resolution = wacom_calc_hid_res(features->x_max,
+                                                    features->x_phy,
+                                                    features->unit,
+                                                    features->unitExpo);
+        features->y_resolution = wacom_calc_hid_res(features->y_max,
+                                                    features->y_phy,
+                                                    features->unit,
+                                                    features->unitExpo);
+}
+
 static void wacom_wireless_work(struct work_struct *work)
 {
         struct wacom *wacom = container_of(work, struct wacom, work);
@@ -1341,6 +1374,8 @@ static void wacom_wireless_work(struct work_struct *work)
                 if (wacom_wac1->features.type != INTUOSHT &&
                     wacom_wac1->features.type != BAMBOO_PT)
                         wacom_wac1->features.device_type |= WACOM_DEVICETYPE_PAD;
+                wacom_set_default_phy(&wacom_wac1->features);
+                wacom_calculate_res(&wacom_wac1->features);
                 snprintf(wacom_wac1->pen_name, WACOM_NAME_MAX, "%s (WL) Pen",
                          wacom_wac1->features.name);
                 snprintf(wacom_wac1->pad_name, WACOM_NAME_MAX, "%s (WL) Pad",
@@ -1359,7 +1394,9 @@ static void wacom_wireless_work(struct work_struct *work)
                         wacom_wac2->features =
                                 *((struct wacom_features *)id->driver_data);
                         wacom_wac2->features.pktlen = WACOM_PKGLEN_BBTOUCH3;
+                        wacom_set_default_phy(&wacom_wac2->features);
                         wacom_wac2->features.x_max = wacom_wac2->features.y_max = 4096;
+                        wacom_calculate_res(&wacom_wac2->features);
                         snprintf(wacom_wac2->touch_name, WACOM_NAME_MAX,
                                  "%s (WL) Finger",wacom_wac2->features.name);
                         snprintf(wacom_wac2->pad_name, WACOM_NAME_MAX,
@@ -1407,39 +1444,6 @@ void wacom_battery_work(struct work_struct *work)
         }
 }
 
-/*
- * Not all devices report physical dimensions from HID.
- * Compute the default from hardcoded logical dimension
- * and resolution before driver overwrites them.
- */
-static void wacom_set_default_phy(struct wacom_features *features)
-{
-        if (features->x_resolution) {
-                features->x_phy = (features->x_max * 100) /
-                                        features->x_resolution;
-                features->y_phy = (features->y_max * 100) /
-                                        features->y_resolution;
-        }
-}
-
-static void wacom_calculate_res(struct wacom_features *features)
-{
-        /* set unit to "100th of a mm" for devices not reported by HID */
-        if (!features->unit) {
-                features->unit = 0x11;
-                features->unitExpo = -3;
-        }
-
-        features->x_resolution = wacom_calc_hid_res(features->x_max,
-                                                    features->x_phy,
-                                                    features->unit,
-                                                    features->unitExpo);
-        features->y_resolution = wacom_calc_hid_res(features->y_max,
-                                                    features->y_phy,
-                                                    features->unit,
-                                                    features->unitExpo);
-}
-
 static size_t wacom_compute_pktlen(struct hid_device *hdev)
 {
         struct hid_report_enum *report_enum;