Merge branch 'for-7.2/wacom' into for-linus

- memory corruption and scheduling while atomic and error fixes (Jinmo Yang)
- error handling fix (Myeonghun Pak)
This commit is contained in:
Jiri Kosina
2026-06-16 21:47:55 +02:00

View File

@@ -54,7 +54,7 @@ static void wacom_wac_queue_insert(struct hid_device *hdev,
{
bool warned = false;
while (kfifo_avail(fifo) < size) {
while (kfifo_avail(fifo) < size && !kfifo_is_empty(fifo)) {
if (!warned)
hid_warn(hdev, "%s: kfifo has filled, starting to drop events\n", __func__);
warned = true;
@@ -62,7 +62,9 @@ static void wacom_wac_queue_insert(struct hid_device *hdev,
kfifo_skip(fifo);
}
kfifo_in(fifo, raw_data, size);
if (!kfifo_in(fifo, raw_data, size))
hid_warn_ratelimited(hdev, "%s: report is too large (%d)\n",
__func__, size);
}
static void wacom_wac_queue_flush(struct hid_device *hdev,
@@ -70,11 +72,10 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
{
while (!kfifo_is_empty(fifo)) {
int size = kfifo_peek_len(fifo);
u8 *buf;
u8 *buf __free(kfree) = kzalloc(size, GFP_ATOMIC);
unsigned int count;
int err;
buf = kzalloc(size, GFP_KERNEL);
if (!buf) {
kfifo_skip(fifo);
continue;
@@ -87,7 +88,6 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
// to flush seems reasonable enough, however.
hid_warn(hdev, "%s: removed fifo entry with unexpected size\n",
__func__);
kfree(buf);
continue;
}
err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, size, false);
@@ -95,8 +95,6 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
hid_warn(hdev, "%s: unable to flush event due to error %d\n",
__func__, err);
}
kfree(buf);
}
}
@@ -2462,16 +2460,16 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
error = wacom_register_inputs(wacom);
if (error)
goto fail;
goto fail_hw_stop;
if (wacom->wacom_wac.features.device_type & WACOM_DEVICETYPE_PAD) {
error = wacom_initialize_leds(wacom);
if (error)
goto fail;
goto fail_hw_stop;
error = wacom_initialize_remotes(wacom);
if (error)
goto fail;
goto fail_hw_stop;
}
if (!wireless) {
@@ -2485,14 +2483,14 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
cancel_delayed_work_sync(&wacom->init_work);
_wacom_query_tablet_data(wacom);
error = -ENODEV;
goto fail_quirks;
goto fail_hw_stop;
}
if (features->device_type & WACOM_DEVICETYPE_WL_MONITOR) {
error = hid_hw_open(hdev);
if (error) {
hid_err(hdev, "hw open failed\n");
goto fail_quirks;
goto fail_hw_stop;
}
}
@@ -2501,7 +2499,7 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
return 0;
fail_quirks:
fail_hw_stop:
hid_hw_stop(hdev);
fail:
wacom_release_resources(wacom);