xserver-xorg-input-synaptics: Changes to 'ubuntu'
debian/changelog | 16 +-
debian/patches/201-Avoid-out-of-bounds-access-by-running-num_active_tou.patch | 37 ++++
debian/patches/202-Ignore-pre-existing-touches.patch | 47 ++++++
debian/patches/203-Fix-coasting-for-negative-ScrollDelta.patch | 44 +++++
debian/patches/204-Reset-open-slots-array-on-device-disable.patch | 34 ++++
debian/patches/205-Reset-hw-x-y-to-INT_MIN-and-skip-HandleState-until-w.patch | 78 ++++++++++
debian/patches/206-Don-t-allow-for-scroll-distances-of-0-49965.patch | 44 +++++
debian/patches/series | 9 +
8 files changed, 307 insertions(+), 2 deletions(-)
New commits:
commit 2e518a6209cdb97fc955558b2877910da67e8996
Author: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Date: Mon May 21 14:21:29 2012 +0200
Add temporary patches, for upstream git commits on synaptics-1.6-branch
* Add temporary patches, for upstream git commits on synaptics-1.6-branch
* Fix memory corruption by driver (LP: #941953) FDo #49439
- 201-Avoid-out-of-bounds-access-by-running-num_active_tou.patch
- 202-Ignore-pre-existing-touches.patch
* Fix FDo #49966
- 203-Fix-coasting-for-negative-ScrollDelta.patch
* Fix jumpy cursor after suspend/resume
- 204-Reset-open-slots-array-on-device-disable.patch
* Fix another resume bug
- 205-Reset-hw-x-y-to-INT_MIN-and-skip-HandleState-until-w.patch
* Fix division by 0 or infinite loop with zero scroll distance FDo #49965
- 206-Don-t-allow-for-scroll-distances-of-0-49965.patch
diff --git a/debian/changelog b/debian/changelog
index 3e27367..a2d032e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -6,8 +6,20 @@ xserver-xorg-input-synaptics (1.6.1-1ubuntu1) UNRELEASED; urgency=low
- 118_quell_error_msg.patch
- 124_syndaemon_events.patch
- 125_option_rec_revert.patch
-
- -- Maarten Lankhorst <maarten.lankhorst@canonical.com> Mon, 21 May 2012 13:50:48 +0200
+ * Add temporary patches, for upstream git commits on synaptics-1.6-branch
+ * Fix memory corruption by driver (LP: #941953) FDo #49439
+ - 201-Avoid-out-of-bounds-access-by-running-num_active_tou.patch
+ - 202-Ignore-pre-existing-touches.patch
+ * Fix FDo #49966
+ - 203-Fix-coasting-for-negative-ScrollDelta.patch
+ * Fix jumpy cursor after suspend/resume
+ - 204-Reset-open-slots-array-on-device-disable.patch
+ * Fix another resume bug
+ - 205-Reset-hw-x-y-to-INT_MIN-and-skip-HandleState-until-w.patch
+ * Fix division by 0 or infinite loop with zero scroll distance FDo #49965
+ - 206-Don-t-allow-for-scroll-distances-of-0-49965.patch
+
+ -- Maarten Lankhorst <maarten.lankhorst@canonical.com> Mon, 21 May 2012 14:14:49 +0200
xserver-xorg-input-synaptics (1.6.1-1) unstable; urgency=low
diff --git a/debian/patches/201-Avoid-out-of-bounds-access-by-running-num_active_tou.patch b/debian/patches/201-Avoid-out-of-bounds-access-by-running-num_active_tou.patch
new file mode 100644
index 0000000..2aac35f
--- /dev/null
+++ b/debian/patches/201-Avoid-out-of-bounds-access-by-running-num_active_tou.patch
@@ -0,0 +1,37 @@
+From 23065a974e5dcdf0d6a436a0547bb7887d306a6f Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Fri, 11 May 2012 12:27:39 +1000
+Subject: [PATCH 1/6] Avoid out-of-bounds access by running num_active_touches
+ < 0 (#49439)
+
+If a touch is active during driver init, the slot will be set to
+SLOTSTATE_CLOSE when it finishes. That could decrease num_active_touches to
+less than 0, causing out-of-bounds access.
+
+X.Org Bug 49439 <http://bugs.freedesktop.org/show_bug.cgi?id=49439>
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
+(cherry picked from commit 77d766b1d535dff9a27c7db343ede85d9f44850b)
+---
+ src/synaptics.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/synaptics.c b/src/synaptics.c
+index 30d79c5..1d32093 100644
+--- a/src/synaptics.c
++++ b/src/synaptics.c
+@@ -3128,7 +3128,9 @@ UpdateTouchState(InputInfoPtr pInfo, struct SynapticsHwState *hw)
+ priv->open_slots[j] = priv->open_slots[j + 1];
+ }
+
+- priv->num_active_touches--;
++ BUG_WARN(priv->num_active_touches == 0);
++ if (priv->num_active_touches > 0)
++ priv->num_active_touches--;
+ }
+ }
+
+--
+1.7.9.5
+
diff --git a/debian/patches/202-Ignore-pre-existing-touches.patch b/debian/patches/202-Ignore-pre-existing-touches.patch
new file mode 100644
index 0000000..cd36103
--- /dev/null
+++ b/debian/patches/202-Ignore-pre-existing-touches.patch
@@ -0,0 +1,47 @@
+From 23e87b57bb874326c88a7ad7292bec51959fb876 Mon Sep 17 00:00:00 2001
+From: Chase Douglas <chase.douglas@canonical.com>
+Date: Mon, 14 May 2012 10:20:01 -0700
+Subject: [PATCH 2/6] Ignore pre-existing touches
+
+If a touch is physically active when the device is enabled, then all
+events for that touch must be ignored. In particular, we cannot close
+the touch or we will decrement touch count counters below zero. If these
+counters go below zero memory corruption can occur.
+
+Note that a device is disabled and enabled every time the user types on
+the keyboard if synclient is used to disable the trackpad while typing.
+This is a very common option.
+
+Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit 55fc42e7c9b4948cadd4f98ef7b6a3b12e268e3e)
+---
+ src/eventcomm.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/src/eventcomm.c b/src/eventcomm.c
+index 89a8a3a..280ef9b 100644
+--- a/src/eventcomm.c
++++ b/src/eventcomm.c
+@@ -564,8 +564,7 @@ EventProcessTouchEvent(InputInfoPtr pInfo, struct SynapticsHwState *hw,
+ if (slot_index < 0)
+ return;
+
+- if (hw->slot_state[slot_index] == SLOTSTATE_EMPTY ||
+- hw->slot_state[slot_index] == SLOTSTATE_OPEN_EMPTY)
++ if (hw->slot_state[slot_index] == SLOTSTATE_OPEN_EMPTY)
+ hw->slot_state[slot_index] = SLOTSTATE_UPDATE;
+ if (ev->code == ABS_MT_TRACKING_ID) {
+ if (ev->value >= 0) {
+@@ -580,7 +579,7 @@ EventProcessTouchEvent(InputInfoPtr pInfo, struct SynapticsHwState *hw,
+ "Attempted to copy values from out-of-range "
+ "slot, touch events may be incorrect.\n");
+ }
+- else {
++ else if (hw->slot_state[slot_index] != SLOTSTATE_EMPTY) {
+ hw->slot_state[slot_index] = SLOTSTATE_CLOSE;
+ proto_data->num_touches--;
+ }
+--
+1.7.9.5
+
diff --git a/debian/patches/203-Fix-coasting-for-negative-ScrollDelta.patch b/debian/patches/203-Fix-coasting-for-negative-ScrollDelta.patch
new file mode 100644
index 0000000..b492d8c
--- /dev/null
+++ b/debian/patches/203-Fix-coasting-for-negative-ScrollDelta.patch
@@ -0,0 +1,44 @@
+From 67a02d676c96d5b3d4729290cd96af0201eb76bb Mon Sep 17 00:00:00 2001
+From: Chun Yang <Chuck.Yang@gmail.com>
+Date: Tue, 15 May 2012 14:51:42 -0500
+Subject: [PATCH 3/6] Fix coasting for negative ScrollDelta
+
+Fix the coasting direction for when VertScrollDelta or HorizScrollDelta is
+negative.
+
+Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=49966
+
+Regression introduced in 0de4445ff8e75aab208faf6383e76045934c6720
+
+Signed-off-by: Chun Yang <Chuck.Yang@gmail.com>
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit 53557a5cab1e253dc8f4393207954ae0fe76068f)
+---
+ src/synaptics.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/synaptics.c b/src/synaptics.c
+index 1d32093..074bcb8 100644
+--- a/src/synaptics.c
++++ b/src/synaptics.c
+@@ -2740,7 +2740,7 @@ HandleScrolling(SynapticsPrivate * priv, struct SynapticsHwState *hw,
+ double dtime = (hw->millis - priv->scroll.last_millis) / 1000.0;
+ double ddy = para->coasting_friction * dtime;
+
+- priv->scroll.delta_y += priv->scroll.coast_speed_y * dtime * para->scroll_dist_vert;
++ priv->scroll.delta_y += priv->scroll.coast_speed_y * dtime * abs(para->scroll_dist_vert);
+ delay = MIN(delay, POLL_MS);
+ if (abs(priv->scroll.coast_speed_y) < ddy) {
+ priv->scroll.coast_speed_y = 0;
+@@ -2755,7 +2755,7 @@ HandleScrolling(SynapticsPrivate * priv, struct SynapticsHwState *hw,
+ if (priv->scroll.coast_speed_x) {
+ double dtime = (hw->millis - priv->scroll.last_millis) / 1000.0;
+ double ddx = para->coasting_friction * dtime;
+- priv->scroll.delta_x += priv->scroll.coast_speed_x * dtime * para->scroll_dist_vert;
++ priv->scroll.delta_x += priv->scroll.coast_speed_x * dtime * abs(para->scroll_dist_horiz);
+ delay = MIN(delay, POLL_MS);
+ if (abs(priv->scroll.coast_speed_x) < ddx) {
+ priv->scroll.coast_speed_x = 0;
+--
+1.7.9.5
+
diff --git a/debian/patches/204-Reset-open-slots-array-on-device-disable.patch b/debian/patches/204-Reset-open-slots-array-on-device-disable.patch
new file mode 100644
index 0000000..b9baee8
--- /dev/null
+++ b/debian/patches/204-Reset-open-slots-array-on-device-disable.patch
@@ -0,0 +1,34 @@
+From 739175d198372a3226ce061b118d8fe5bbc8f6bf Mon Sep 17 00:00:00 2001
+From: Chase Douglas <chase.douglas@canonical.com>
+Date: Wed, 16 May 2012 07:49:25 -0700
+Subject: [PATCH 4/6] Reset open slots array on device disable
+
+The open slots array is used for clickpad cumulative delta computation.
+If the array is not reset and becomes corrupted during the device
+disable/enable cycle, the cumulative deltas may be wrong. This manifests
+as jumpy cursor behavior on some clickpads after suspend/resume.
+
+Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit 0054b144f3daf00e46a35b2f165befb209df94fc)
+---
+ src/synaptics.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/synaptics.c b/src/synaptics.c
+index 074bcb8..78660f4 100644
+--- a/src/synaptics.c
++++ b/src/synaptics.c
+@@ -1153,6 +1153,9 @@ SynapticsReset(SynapticsPrivate * priv)
+ priv->lastButtons = 0;
+ priv->prev_z = 0;
+ priv->prevFingers = 0;
++#ifdef HAVE_MULTITOUCH
++ memset(priv->open_slots, 0, priv->num_slots * sizeof(int));
++#endif
+ }
+
+ static Bool
+--
+1.7.9.5
+
diff --git a/debian/patches/205-Reset-hw-x-y-to-INT_MIN-and-skip-HandleState-until-w.patch b/debian/patches/205-Reset-hw-x-y-to-INT_MIN-and-skip-HandleState-until-w.patch
new file mode 100644
index 0000000..da104cd
--- /dev/null
+++ b/debian/patches/205-Reset-hw-x-y-to-INT_MIN-and-skip-HandleState-until-w.patch
@@ -0,0 +1,78 @@
+From f8d970e191e6df05a8f2c26afdeea3e27b941a62 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Thu, 17 May 2012 11:02:02 +1000
+Subject: [PATCH 5/6] Reset hw->x/y to INT_MIN and skip HandleState until we
+ have x/y events
+
+The driver assumes x/y is always valid but after coming from a resume we may
+get a few events with either ABS_X or ABS_Y (not both). Thus we process with
+hw->x == 0 and hw->y == somevalue, causing cursor jumps when calculating
+deltas whenver the real hw->x comes in.
+
+Fix this by resetting hw->x/y to INT_MIN and skip state processing until
+both axes are available.
+
+For clickpads, this means handling of data will be delayed until we get
+at least one motion on each axis. Button presses won't be recognised either
+until that happens. It requires some skill to not trigger motion on both
+axes, even more to press a button without doing so.
+
+For non-clickpads, handling of motion events will be delayed likewise. If a
+physical button is pressed immediately after resume we have to assume deltas
+of x/y.
+- If the next event is a new touch, it will have ABS_X/ABS_Y set anyway
+- If the finger was already down, a button event is generated, and the
+ finger has generated ABS_X or ABS_Y only before the event, the next event
+ containing the missing data will cause a jump. The fix for this is more
+ invasive and this is quite a corner-case.
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
+(cherry picked from commit cd569377cda9b5a4ee00c0137db14f625c76c40f)
+---
+ src/synaptics.c | 13 +++++++++++++
+ src/synproto.c | 4 ++--
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/src/synaptics.c b/src/synaptics.c
+index 78660f4..cd9f936 100644
+--- a/src/synaptics.c
++++ b/src/synaptics.c
+@@ -3278,6 +3278,19 @@ HandleState(InputInfoPtr pInfo, struct SynapticsHwState *hw, CARD32 now,
+ return delay;
+ }
+
++ /* We need both and x/y, the driver can't handle just one of the two
++ * yet. But since it's possible to hit a phys button on non-clickpads
++ * without ever getting motion data first, we must continue with 0/0 for
++ * that case. */
++ if (hw->x == INT_MIN || hw->y == INT_MAX) {
++ if (para->clickpad)
++ return delay;
++ else if (hw->left || hw->right || hw->middle) {
++ hw->x = (hw->x == INT_MIN) ? 0 : hw->x;
++ hw->y = (hw->y == INT_MIN) ? 0 : hw->y;
++ }
++ }
++
+ /* If a physical button is pressed on a clickpad, use cumulative relative
+ * touch movements for motion */
+ if (para->clickpad && (hw->left || hw->right || hw->middle)) {
+diff --git a/src/synproto.c b/src/synproto.c
+index d6e8c65..0c8a066 100644
+--- a/src/synproto.c
++++ b/src/synproto.c
+@@ -134,8 +134,8 @@ void
+ SynapticsResetHwState(struct SynapticsHwState *hw)
+ {
+ hw->millis = 0;
+- hw->x = 0;
+- hw->y = 0;
++ hw->x = INT_MIN;
++ hw->y = INT_MIN;
+ hw->z = 0;
+ hw->cumulative_dx = 0;
+ hw->cumulative_dy = 0;
+--
+1.7.9.5
+
diff --git a/debian/patches/206-Don-t-allow-for-scroll-distances-of-0-49965.patch b/debian/patches/206-Don-t-allow-for-scroll-distances-of-0-49965.patch
new file mode 100644
index 0000000..ba24320
--- /dev/null
+++ b/debian/patches/206-Don-t-allow-for-scroll-distances-of-0-49965.patch
@@ -0,0 +1,44 @@
+From 7ccca8e7d8fbf2ccb5a2dbbfbf06ff4dbd6b7149 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Thu, 17 May 2012 12:10:04 +1000
+Subject: [PATCH 6/6] Don't allow for scroll distances of 0 (#49965)
+
+It'll either hang the server or blow up with divisions by 0, whichever one
+comes first.
+
+X.Org Bug 49965 <http://bugs.freedesktop.org/show_bug.cgi?id=49965>
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
+(cherry picked from commit 6d47d334d8a876e7e094306c313246b87016b78a)
+---
+ src/properties.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/properties.c b/src/properties.c
+index 44ac306..3b3f1c5 100644
+--- a/src/properties.c
++++ b/src/properties.c
+@@ -519,6 +519,9 @@ SetProperty(DeviceIntPtr dev, Atom property, XIPropertyValuePtr prop,
+ return BadMatch;
+
+ dist = (INT32 *) prop->data;
++ if (dist[0] == 0 || dist[1] == 0)
++ return BadValue;
++
+ if (para->scroll_dist_vert != dist[0]) {
+ para->scroll_dist_vert = dist[0];
+ #ifdef HAVE_SMOOTH_SCROLL
+@@ -715,6 +718,9 @@ SetProperty(DeviceIntPtr dev, Atom property, XIPropertyValuePtr prop,
+ return BadMatch;
+
+ circdist = *(float *) prop->data;
++ if (circdist == 0)
++ return BadValue;
++
+ para->scroll_dist_circ = circdist;
+ }
+ else if (property == prop_circscroll_trigger) {
+--
+1.7.9.5
+
diff --git a/debian/patches/series b/debian/patches/series
index 1684843..e6446d1 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -20,3 +20,12 @@
128_disable_three_click_action.patch
129_disable_three_touch_tap.patch
130_dont_enable_rightbutton_area.patch
+
+# in synaptics-1.6-branch, scheduled for 1.6.2 release
+201-Avoid-out-of-bounds-access-by-running-num_active_tou.patch
+202-Ignore-pre-existing-touches.patch
+203-Fix-coasting-for-negative-ScrollDelta.patch
+204-Reset-open-slots-array-on-device-disable.patch
+205-Reset-hw-x-y-to-INT_MIN-and-skip-HandleState-until-w.patch
+206-Don-t-allow-for-scroll-distances-of-0-49965.patch
+
Reply to: