This fixes a format string vulnerabilty.
evdev_log_message() composes a format string consisting of a fixed
prefix (including the rendered device name) and the passed-in format
buffer. This format string is then passed with the arguments to the
actual log handler, which usually and eventually ends up being printf.
If the device name contains a printf-style format directive, these ended
up in the format string and thus get interpreted correctly, e.g. for a
device "Foo%sBar" the log message vs printf invocation ends up being:
evdev_log_message(device, "some message %s", "some argument");
printf("event9 - Foo%sBar: some message %s", "some argument");
This can enable an attacker to execute malicious code with the
privileges of the process using libinput.
To exploit this, an attacker needs to be able to create a kernel device
with a malicious name, e.g. through /dev/uinput or a Bluetooth device.
To fix this, convert any potential format directives in the device name
by duplicating percentages.
Pre-rendering the device to avoid the issue altogether would be nicer
but the current log level hooks do not easily allow for this. The device
name is the only user-controlled part of the format string.
A second potential issue is the sysname of the device which is also
sanitized.
This issue was found by Albin Eldstål-Ahrens and Benjamin Svensson from
Assured AB, and independently by Lukas Lamster.
Fixes#752
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit a423d7d326)
Since cd4f2f32b5 ("fallback: disable mouse scroll wheel while middle
button is pressed") the mouse wheel is inhibited while the mouse wheel
is pressed.
The original intention of this feature was to avoid unintended scroll
while pressing the scroll wheel. However, now that high-resolution
scroll is fully integrated in libinput we can improve this feature and
filter unintended scroll (below half a detent) and allow it when it is
intended (over half a detent).
Remove the "WHEEL_STATE_PRESSED" state from the wheel state machine and
let the general heuristics handle this case.
Also, remove the specific tests for this feature as now it is covered
by the general test cases.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
This device triggers a kernel bug in the InRange and Invert handling,
every time BTN_TOUCH is set the device also sets BTN_TOOL_PEN even when
we currently have the eraser in proximity.
Recording from https://github.com/linuxwacom/xf86-input-wacom/issues/186
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Depending on how quick the test suite runs we may get a hold end event
here. Let's silently ignore that one since we aren't interested in it.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The most common trigger for this is the debouncing timer which is a mere
12ms and is effectively unavoidable, virtually every caller will
trigger those messages at some point.
Let's add a grace period of 20ms below which we don't log this message
to avoid logspam. And in the process, bump the equivalent warning
message up to 20ms as well.
Related #711
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Add two helper functions that set/unset BTN_TOUCH together with the
specified axes and switch all tests over.
Devices can override the tip down/up sequence.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Most mice with high-resolution support have a mechanism in place to
adjust the wheel to a detent. When scrolling, it is possible to stop
between two detents and this mechanism could generate a small amount of
scroll in the oposite direction.
Track the scroll direction in the wheel state machine and reset it when
the direction changes to avoid this issue.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Mice with high-resolution support can generate deltas when the finger is
put on the wheel or when the user tries to click the wheel.
To avoid sending involuntary scroll events, add an extra state the the
wheel state machine to accumulate scroll deltas.
While the accumulated scroll is lower than a certain threshold, ignore
them until the threshold is reached.
Since no finish event is sent by the mouse, reset the state machine
after a period of scroll inactivity.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Don't use the litest wrapper context here, it changes log priority if
the test suite is run with --verbose, causing the test to fail.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Some devices might announce support for high-resolution scroll wheel
by enabling REL_WHEEL_HI_RES and/or REL_HWHEEL_HI_RES but never send
a high-resolution scroll event.
When the first low-resolution scroll event is received without any
previous high-resolution event, print a kernel bug warning and start
emulating high-resolution scroll events.
Fix#668
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
LIBINPUT_EVENT_GESTURE_HOLD_BEGIN and LIBINPUT_EVENT_GESTURE_HOLD_END
were missing from libinput_event_gesture_get_base_event.
Add them to avoid triggering an erroneous client bug warning.
Fix#671
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
It's been a while since we really could do something about those jumps,
so let's assume most of these are informative and not a bug in libinput.
For that let's not spam the user's journal and ratelimit it to a handful
a day.
Per day because that increases the chance of an error being present in
the recent logs if the user does search for it.
Related #663
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
If a touchpad is removed before its dwt-paired keyboard, we're leaking
the keyboard struct. Fix this by cleaning up properly when our device is
removed.
This is the cause of many failed tests in the udev backend tests during
the CI valgrind run. Because we're testing the udev backend it will add
any devices created by tests run in parallel, some of which are keyboard
devices. Depening on the test completions, the keyboards may or may not
get removed before this device.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Move the logic used to parse boolean quirks and udev flags to a common
function in utils.
Refactor, no functional changes.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Starting with kernel v5.0 two new axes are available for high-resolution wheel
scrolling: REL_WHEEL_HI_RES and REL_HWHEEL_HI_RES. Both axes send data in
fractions of 120 where each multiple of 120 amounts to one logical scroll
event. Fractions of 120 indicate a wheel movement less than one detent.
This commit adds a new API for scroll events. Three new event types that encode
the axis source in the event type name and a new API to get a normalized-to-120
value that also used by Windows and the kernel (each multiple of 120 represents
a logical scroll click).
This addresses a main shortcoming with the existing API - it was unreliable to
calculate the click angle based on the axis value+discrete events and thus any
caller using the axis value alone would be left with some ambiguity. With the
v120 API it's now possible to (usually) calculate the click angle, but more
importantly it provides the simplest hw-independent way of scrolling by a
click or a fraction of a click.
A new event type is required, the only way to integrate the v120 value
otherwise was to start sending events with a discrete value of 0. This
would break existing xf86-input-libinput (divide by zero, fixed in 0.28.2) and
weston (general confusion). mutter, kwin are unaffected.
With the new API, the old POINTER_AXIS event are deprecated - callers should use
the new API where available and discard any POINTER_AXIS events.
Notable: REL_WHEEL/REL_HWHEEL are emulated by the kernel but there's no
guarantee that they'll come every accumulated 120 values, e.g. Logitech mice
often send events that don't add up to 120 per detent.
We use the kernel's wheel click emulation instead of doing our own.
libinput guarantees high-resolution events even on pre-5.0 kernels.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Extract the logic in litest_assert_event_type to a generic function,
litest_assert_event_type_is_one_of, that takes a variable number of
expected event types.
Refactor, no functional changes.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
This way we can ensure that at least one device is available, and that
it is the device we want.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
meson uses MESON_TESTTHREADS to determine the number of parallel test
jobs. Since our main test suite cannot be run in parallel anyway, use
that same variable in litest to determine how many jobs we should fork
off.
In the CI pipeline, we can use FDO_CI_CONCURRENT to pass that down so we
don't end up running a billion jobs on a test runner.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
3d3d9b7f69 got rid of the need for a tmp
argument for list_for_each_safe() but switched the loop to be a
multiline statement. This could potentially cause bugs where the loop is
used inside a block without curly braces, e.g.
if (condition)
list_for_each_safe()
func()
The assignment preceding the actual loop would result in the code
reading as:
if (condition)
pos = ....
list_for_each_safe()
The actual list loop would be unconditional.
Fix this by moving the initial assignment into an expression statement.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This was observed when running in device mode with:
`libinput debug-events $EVENT_NODE`
When removing the monitored device, the no "device removed" message was
not shown.
Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
When one finger is used to hold, tiny pointer movement deltas can easily
end the gesture.
Add a movement threshold to avoid small movement, before or after the hold
timeout, ending the gesture and make the hold-to-interact user
interaction more reliable.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
When 1 or 2 fingers are used to hold, use a faster timer to make the
"hold to stop kinetic scrolling" user interaction feel more immediate.
Also handle double tap and tap and drag interations to send only one
hold gesture instead of two.
Holding with 3 or 4 fingers remains the same to try to avoid callers
missusing hold gestures to build their own tap implementation.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Add an extra parameter to the common gesture test functions to allow to hold
before performing the gesture.
This parameter will be used by the hold tests allowing to share the code.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Hold gestures are notifications about fingers on the touchpad.
There is no coordinate attached to a hold gesture, merely the number of fingers.
A hold gesture starts when the user places a finger on the touchpad and
ends when all fingers are lifted. It is cancelled when the finger(s) move
past applicable thresholds and trigger some other interaction like pointer
movement or scrolling.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Valgrind can be too slow to run some time based tests. In those cases, we
need to disable hold gestures.
Add the required functions to configure hold gestures: enable, disable,
get default state and get current state.
Keep them private as they are intended to be used only from the tests.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Add hold gestures to the public API and the private functions to notify them.
Also add hold gestures to debug-events and debug-gui.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
A pinch is defined as two fingers moving in different directions, and a
scroll as two fingers moving in the same direction.
Often enough when the user is trying to pinch, we may initially see both
fingers moving in the same direction and decide that they want to
scroll.
Add a grace period during which we may transition to a pinch in those
situations.
Test fix: touchpad_trackpoint_buttons_2fg_scroll emits movements that
change the distance between fingers, which triggers this new transition
and makes the test fail; correct this.
Signed-off-by: novenary <streetwalkermc@gmail.com>
This assumption dates back roughly a decade when INPUT_PROP_BUTTONPAD was
introduced into the kernel. To my knowledge, devices right now erroneously
advertise INPUT_PROP_BUTTONPAD when they are not a clickpad (but then they
have BTN_RIGHT) or they lack INPUT_PROP_BUTTONPAD (and only have BTN_LEFT).
So let's change our assumption here - if a clickpad has a right button log the
kernel bug and continue with the assumption the device is a touchpad with
physical buttons.
To disable that warning, fix the kernel or add an AttrInputPropDisable quirk
for the device.
Fixes#595
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
There is only one touchpad with a physical left button but no right button and
that is the old Apple touchpad, discontinued in 2008. Not a huge number of
those left, I assume.
So let's change our assumptions because these days the vast majority of
touchpads are clickpads - any touchpad that only has a left button is treated
as clickpad, even where the kernel doesn't set the INPUT_PROP_BUTTONPAD.
We do need to check for BTN_LEFT as well though, because Wacom touchpads (i.e.
the touch part of non-integrated Wacom tablets) don't have a left button
either.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Don't middle click on clickpads with click method clickfinger when more than
3 fingers are used.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
With a new helper function strv_from_argv we can re-use the device opening
loop for all the use-cases we have.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Without this, each finger movement happens in a different evdev event frame.
Since we average deltas for gestures, this messes with the expected data.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
There's no test case where we need to do something immediately after the last
event so we might as well do everything in the same loop.
This also fixes a bug where the first movement would usually get swallowed.
Test cases in general put the finger down at x/y, then move them to some other
position. We'd expect the first event in a loop to happen at x+n/y+n, not at
x/y again.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
