From f4eecca4202283b808d0bd48798bf47a4e5af931 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 16 Feb 2016 12:28:49 -0500 Subject: [PATCH] Backport fix for elantech touchpads (rhbz 1306987) --- ...-mark-protocols-v2-and-v3-as-semi-mt.patch | 41 +++++++++++++++++++ kernel.spec | 6 +++ 2 files changed, 47 insertions(+) create mode 100644 Input-elantech-mark-protocols-v2-and-v3-as-semi-mt.patch diff --git a/Input-elantech-mark-protocols-v2-and-v3-as-semi-mt.patch b/Input-elantech-mark-protocols-v2-and-v3-as-semi-mt.patch new file mode 100644 index 000000000..c02a0f53b --- /dev/null +++ b/Input-elantech-mark-protocols-v2-and-v3-as-semi-mt.patch @@ -0,0 +1,41 @@ +From 6544a1df11c48c8413071aac3316792e4678fbfb Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Mon, 11 Jan 2016 17:35:38 -0800 +Subject: [PATCH] Input: elantech - mark protocols v2 and v3 as semi-mt + +When using a protocol v2 or v3 hardware, elantech uses the function +elantech_report_semi_mt_data() to report data. This devices are rather +creepy because if num_finger is 3, (x2,y2) is (0,0). Yes, only one valid +touch is reported. + +Anyway, userspace (libinput) is now confused by these (0,0) touches, +and detect them as palm, and rejects them. + +Commit 3c0213d17a09 ("Input: elantech - fix semi-mt protocol for v3 HW") +was sufficient enough for xf86-input-synaptics and libinput before it has +palm rejection. Now we need to actually tell libinput that this device is +a semi-mt one and it should not rely on the actual values of the 2 touches. + +Cc: stable@vger.kernel.org +Signed-off-by: Benjamin Tissoires +Signed-off-by: Dmitry Torokhov +--- + drivers/input/mouse/elantech.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 537ebb0e193a..78f93cf68840 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1222,7 +1222,7 @@ static int elantech_set_input_params(struct psmouse *psmouse) + input_set_abs_params(dev, ABS_TOOL_WIDTH, ETP_WMIN_V2, + ETP_WMAX_V2, 0, 0); + } +- input_mt_init_slots(dev, 2, 0); ++ input_mt_init_slots(dev, 2, INPUT_MT_SEMI_MT); + input_set_abs_params(dev, ABS_MT_POSITION_X, x_min, x_max, 0, 0); + input_set_abs_params(dev, ABS_MT_POSITION_Y, y_min, y_max, 0, 0); + break; +-- +2.5.0 + diff --git a/kernel.spec b/kernel.spec index 8bf85b3a2..954195596 100644 --- a/kernel.spec +++ b/kernel.spec @@ -637,6 +637,9 @@ Patch649: ALSA-usb-audio-avoid-freeing-umidi-object-twice.patch #CVE-2016-2383 rhbz 1308452 1308453 Patch650: bpf-fix-branch-offset-adjustment-on-backjumps-after-.patch +#rhbz 1306987 +Patch651: Input-elantech-mark-protocols-v2-and-v3-as-semi-mt.patch + # END OF PATCH DEFINITIONS %endif @@ -2080,6 +2083,9 @@ fi # # %changelog +* Tue Feb 16 2016 Josh Boyer +- Backport fix for elantech touchpads (rhbz 1306987) + * Mon Feb 15 2016 Josh Boyer - CVE-2016-2383 incorrect branch fixups for eBPG allow arbitrary reads (rhbz 1308452 1308453) - CVE-2016-2384 double free in usb-audio from invalid USB descriptor (rhbz 1308444 1308445)