HID: hid-input: allow array fields out of range

Allow array field values out of range as per HID 1.11 specification,
section 6.2.25:

	Rather than returning a single bit for each button in the group, an
	array returns an index in each field that corresponds to the pressed
	button (like keyboard scan codes). An out-of range value in and array
	field is considered no controls asserted.

Apparently, "and" above is a typo and should be "an".

This fixes at least Waltop tablet pen clicks - otherwise BTN_TOUCH is never
released.

The relevant part of Waltop tablet report descriptors is this:

	0x09, 0x42,         /*          Usage (Tip Switch),         */
	0x09, 0x44,         /*          Usage (Barrel Switch),      */
	0x09, 0x46,         /*          Usage (Tablet Pick),        */
	0x15, 0x01,         /*          Logical Minimum (1),        */
	0x25, 0x03,         /*          Logical Maximum (3),        */
	0x75, 0x04,         /*          Report Size (4),            */
	0x95, 0x01,         /*          Report Count (1),           */
	0x80,               /*          Input,                      */

This is a regression fix for commit b4b583d ("HID: be more strict when
ignoring out-of-range fields").

Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

1 files changed, 7 insertions, 2 deletions

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 9333d692a786..627850a54d34 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -986,8 +986,13 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
                 return;
         }
 
-        /* Ignore out-of-range values as per HID specification, section 5.10 */
-        if (value < field->logical_minimum || value > field->logical_maximum) {
+        /*
+         * Ignore out-of-range values as per HID specification,
+         * section 5.10 and 6.2.25
+         */
+        if ((field->flags & HID_MAIN_ITEM_VARIABLE) &&
+            (value < field->logical_minimum ||
+             value > field->logical_maximum)) {
                 dbg_hid("Ignoring out-of-range value %x\n", value);
                 return;
         }