Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  Revert "HID: magicmouse: ignore 'ivalid report id' while switching modes"
  HID: hid-multitouch: fix broken eGalax
  HID: MAINTAINERS: Update USB HID/HIDBP DRIVERS pattern
  HID: hid-multitouch: add support for Chunghwa multi-touch panel
  HID: hiddev: fix use after free in hiddev_release
  HID: add quirk for HyperPen 10000U
  HID: hiddev: fix potential use-after-free

8 files changed, 59 insertions, 30 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 6c59eb90fdf4..502f2dd761eb 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -6463,7 +6463,7 @@ M:	Jiri Kosina <jkosina@suse.cz>
 L:      linux-usb@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid.git
 S:      Maintained
-F:      Documentation/usb/hiddev.txt
+F:      Documentation/hid/hiddev.txt
 F:      drivers/hid/usbhid/
 
 USB ISP116X DRIVER
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 67d2a7585934..36ca465c00ce 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -305,6 +305,7 @@ config HID_MULTITOUCH
           - 3M PCT touch screens
           - ActionStar dual touch panels
           - Cando dual touch panels
+          - Chunghwa panels
           - CVTouch panels
           - Cypress TrueTouch panels
           - Elo TouchSystems IntelliTouch Plus panels
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index c957c4b4fe70..f7440e8ce3e7 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1359,6 +1359,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHUNGHWAT, USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_PRODIKEYS_PCMIDI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CVTOUCH, USB_DEVICE_ID_CVTOUCH_SCREEN) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 0b374a6d6db0..aecb5a4b8d6d 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -173,6 +173,9 @@
 #define USB_DEVICE_ID_CHICONY_MULTI_TOUCH       0xb19d
 #define USB_DEVICE_ID_CHICONY_WIRELESS  0x0618
 
+#define USB_VENDOR_ID_CHUNGHWAT         0x2247
+#define USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH      0x0001
+
 #define USB_VENDOR_ID_CIDC              0x1677
 
 #define USB_VENDOR_ID_CMEDIA            0x0d8c
@@ -622,6 +625,7 @@
 #define USB_VENDOR_ID_UCLOGIC           0x5543
 #define USB_DEVICE_ID_UCLOGIC_TABLET_PF1209     0x0042
 #define USB_DEVICE_ID_UCLOGIC_TABLET_KNA5       0x6001
+#define USB_DEVICE_ID_UCLOGIC_TABLET_TWA60      0x0064
 #define USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U    0x0003
 #define USB_DEVICE_ID_UCLOGIC_TABLET_WP5540U    0x0004
 #define USB_DEVICE_ID_UCLOGIC_TABLET_WP8060U    0x0005
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index a5eda4c8127a..0ec91c18a421 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -501,17 +501,9 @@ static int magicmouse_probe(struct hid_device *hdev,
         }
         report->size = 6;
 
-        /*
-         * The device reponds with 'invalid report id' when feature
-         * report switching it into multitouch mode is sent to it.
-         *
-         * This results in -EIO from the _raw low-level transport callback,
-         * but there seems to be no other way of switching the mode.
-         * Thus the super-ugly hacky success check below.
-         */
         ret = hdev->hid_output_raw_report(hdev, feature, sizeof(feature),
                         HID_FEATURE_REPORT);
-        if (ret != -EIO) {
+        if (ret != sizeof(feature)) {
                 hid_err(hdev, "unable to request touch data (%d)\n", ret);
                 goto err_stop_hw;
         }
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index ecd4d2db9e80..0b2dcd0ee591 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -64,6 +64,7 @@ struct mt_device {
         struct mt_class *mtclass;       /* our mt device class */
         unsigned last_field_index;      /* last field index of the report */
         unsigned last_slot_field;       /* the last field of a slot */
+        int last_mt_collection; /* last known mt-related collection */
         __s8 inputmode;         /* InputMode HID feature, -1 if non-existent */
         __u8 num_received;      /* how many contacts we received */
         __u8 num_expected;      /* expected last contact index */
@@ -225,8 +226,10 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                                 cls->sn_move);
                         /* touchscreen emulation */
                         set_abs(hi->input, ABS_X, field, cls->sn_move);
-                        td->last_slot_field = usage->hid;
-                        td->last_field_index = field->index;
+                        if (td->last_mt_collection == usage->collection_index) {
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                         return 1;
                 case HID_GD_Y:
                         if (quirks & MT_QUIRK_EGALAX_XYZ_FIXUP)
@@ -237,8 +240,10 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                                 cls->sn_move);
                         /* touchscreen emulation */
                         set_abs(hi->input, ABS_Y, field, cls->sn_move);
-                        td->last_slot_field = usage->hid;
-                        td->last_field_index = field->index;
+                        if (td->last_mt_collection == usage->collection_index) {
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                         return 1;
                 }
                 return 0;
@@ -246,31 +251,40 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
         case HID_UP_DIGITIZER:
                 switch (usage->hid) {
                 case HID_DG_INRANGE:
-                        td->last_slot_field = usage->hid;
-                        td->last_field_index = field->index;
+                        if (td->last_mt_collection == usage->collection_index) {
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                         return 1;
                 case HID_DG_CONFIDENCE:
-                        td->last_slot_field = usage->hid;
-                        td->last_field_index = field->index;
+                        if (td->last_mt_collection == usage->collection_index) {
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                         return 1;
                 case HID_DG_TIPSWITCH:
                         hid_map_usage(hi, usage, bit, max, EV_KEY, BTN_TOUCH);
                         input_set_capability(hi->input, EV_KEY, BTN_TOUCH);
-                        td->last_slot_field = usage->hid;
-                        td->last_field_index = field->index;
+                        if (td->last_mt_collection == usage->collection_index) {
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                         return 1;
                 case HID_DG_CONTACTID:
                         input_mt_init_slots(hi->input, td->maxcontacts);
                         td->last_slot_field = usage->hid;
                         td->last_field_index = field->index;
+                        td->last_mt_collection = usage->collection_index;
                         return 1;
                 case HID_DG_WIDTH:
                         hid_map_usage(hi, usage, bit, max,
                                         EV_ABS, ABS_MT_TOUCH_MAJOR);
                         set_abs(hi->input, ABS_MT_TOUCH_MAJOR, field,
                                 cls->sn_width);
-                        td->last_slot_field = usage->hid;
-                        td->last_field_index = field->index;
+                        if (td->last_mt_collection == usage->collection_index) {
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                         return 1;
                 case HID_DG_HEIGHT:
                         hid_map_usage(hi, usage, bit, max,
@@ -279,8 +293,10 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                                 cls->sn_height);
                         input_set_abs_params(hi->input,
                                         ABS_MT_ORIENTATION, 0, 1, 0, 0);
-                        td->last_slot_field = usage->hid;
-                        td->last_field_index = field->index;
+                        if (td->last_mt_collection == usage->collection_index) {
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                         return 1;
                 case HID_DG_TIPPRESSURE:
                         if (quirks & MT_QUIRK_EGALAX_XYZ_FIXUP)
@@ -292,16 +308,20 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                         /* touchscreen emulation */
                         set_abs(hi->input, ABS_PRESSURE, field,
                                 cls->sn_pressure);
-                        td->last_slot_field = usage->hid;
-                        td->last_field_index = field->index;
+                        if (td->last_mt_collection == usage->collection_index) {
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                         return 1;
                 case HID_DG_CONTACTCOUNT:
-                        td->last_field_index = field->index;
+                        if (td->last_mt_collection == usage->collection_index)
+                                td->last_field_index = field->index;
                         return 1;
                 case HID_DG_CONTACTMAX:
                         /* we don't set td->last_slot_field as contactcount and
                          * contact max are global to the report */
-                        td->last_field_index = field->index;
+                        if (td->last_mt_collection == usage->collection_index)
+                                td->last_field_index = field->index;
                         return -1;
                 }
                 /* let hid-input decide for the others */
@@ -516,6 +536,7 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
         }
         td->mtclass = mtclass;
         td->inputmode = -1;
+        td->last_mt_collection = -1;
         hid_set_drvdata(hdev, td);
 
         ret = hid_parse(hdev);
@@ -593,6 +614,11 @@ static const struct hid_device_id mt_devices[] = {
                 HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
                         USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6) },
 
+        /* Chunghwa Telecom touch panels */
+        {  .driver_data = MT_CLS_DEFAULT,
+                HID_USB_DEVICE(USB_VENDOR_ID_CHUNGHWAT,
+                        USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH) },
+
         /* CVTouch panels */
         { .driver_data = MT_CLS_DEFAULT,
                 HID_USB_DEVICE(USB_VENDOR_ID_CVTOUCH,
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 0e30b140edca..621959d5cc42 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -74,6 +74,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_PF1209, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP5540U, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP8060U, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH, HID_QUIRK_MULTI_INPUT },
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index ff3c644888b1..7c1188b53c3e 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -248,12 +248,15 @@ static int hiddev_release(struct inode * inode, struct file * file)
                         usbhid_close(list->hiddev->hid);
                         usbhid_put_power(list->hiddev->hid);
                 } else {
+                        mutex_unlock(&list->hiddev->existancelock);
                         kfree(list->hiddev);
+                        kfree(list);
+                        return 0;
                 }
         }
 
-        kfree(list);
         mutex_unlock(&list->hiddev->existancelock);
+        kfree(list);
 
         return 0;
 }
@@ -923,10 +926,11 @@ void hiddev_disconnect(struct hid_device *hid)
         usb_deregister_dev(usbhid->intf, &hiddev_class);
 
         if (hiddev->open) {
+                mutex_unlock(&hiddev->existancelock);
                 usbhid_close(hiddev->hid);
                 wake_up_interruptible(&hiddev->wait);
         } else {
+                mutex_unlock(&hiddev->existancelock);
                 kfree(hiddev);
         }
-        mutex_unlock(&hiddev->existancelock);
 }