rmi_check_sanity() strips trailing 0xff bytes from incoming HID reports
to work around bus corruption where attention reports are occasionally
filled with 0xff sentinel values. Running this filter on all raw
reports also truncates register read responses that legitimately end
with 0xff bytes, leaving stale data at the end of the read buffer.
Move the sanity check into rmi_input_event() so that only attention
reports are filtered.
Fixes: 5b65c2a02966 ("HID: rmi: check sanity of the incoming report")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/hid/hid-rmi.c | 37 ++++++++++++++++++++-----------------
1 file changed, 20 insertions(+), 17 deletions(-)
diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
index cacf81ed56a7..41676685ce28 100644
--- a/drivers/hid/hid-rmi.c
+++ b/drivers/hid/hid-rmi.c
@@ -343,6 +343,22 @@ static void rmi_reset_work(struct work_struct *work)
rmi_reset_attn_mode(hdata->hdev);
}
+static int rmi_check_sanity(struct hid_device *hdev, u8 *data, int size)
+{
+ int valid_size = size;
+ /*
+ * On the Dell XPS 13 9333, the bus sometimes get confused and fills
+ * the report with a sentinel value "ff". Synaptics told us that such
+ * behavior does not comes from the touchpad itself, so we filter out
+ * such reports here.
+ */
+
+ while (valid_size > 0 && data[valid_size - 1] == 0xff)
+ valid_size--;
+
+ return valid_size;
+}
+
static int rmi_input_event(struct hid_device *hdev, u8 *data, int size)
{
struct rmi_data *hdata = hid_get_drvdata(hdev);@@ -352,6 +368,10 @@ static int rmi_input_event(struct hid_device *hdev, u8 *data, int size)
if (!(test_bit(RMI_STARTED, &hdata->flags)))
return 0;
+ size = rmi_check_sanity(hdev, data, size);
+ if (size < 2)
+ return 0;
+
pm_wakeup_event(hdev->dev.parent, 0);
local_irq_save(flags);
@@ -381,22 +401,6 @@ static int rmi_read_data_event(struct hid_device *hdev, u8 *data, int size)
return 1;
}
-static int rmi_check_sanity(struct hid_device *hdev, u8 *data, int size)
-{
- int valid_size = size;
- /*
- * On the Dell XPS 13 9333, the bus sometimes get confused and fills
- * the report with a sentinel value "ff". Synaptics told us that such
- * behavior does not comes from the touchpad itself, so we filter out
- * such reports here.
- */
-
- while (valid_size > 0 && data[valid_size - 1] == 0xff)
- valid_size--;
-
- return valid_size;
-}
-
static int rmi_raw_event(struct hid_device *hdev,
struct hid_report *report, u8 *data, int size)
{@@ -405,7 +409,6 @@ static int rmi_raw_event(struct hid_device *hdev,
if (!(hdata->device_flags & RMI_DEVICE))
return 0;
- size = rmi_check_sanity(hdev, data, size);
if (size < 2)
return 0;
--
2.56.0.679.gc527c65306-goog