This fixes a format string vulnerabilty.
evdev_log_message() composes a format string consisting of a fixed
prefix (including the rendered device name) and the passed-in format
buffer. This format string is then passed with the arguments to the
actual log handler, which usually and eventually ends up being printf.
If the device name contains a printf-style format directive, these ended
up in the format string and thus get interpreted correctly, e.g. for a
device "Foo%sBar" the log message vs printf invocation ends up being:
evdev_log_message(device, "some message %s", "some argument");
printf("event9 - Foo%sBar: some message %s", "some argument");
This can enable an attacker to execute malicious code with the
privileges of the process using libinput.
To exploit this, an attacker needs to be able to create a kernel device
with a malicious name, e.g. through /dev/uinput or a Bluetooth device.
To fix this, convert any potential format directives in the device name
by duplicating percentages.
Pre-rendering the device to avoid the issue altogether would be nicer
but the current log level hooks do not easily allow for this. The device
name is the only user-controlled part of the format string.
A second potential issue is the sysname of the device which is also
sanitized.
This issue was found by Albin Eldstål-Ahrens and Benjamin Svensson from
Assured AB, and independently by Lukas Lamster.
Fixes#752
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Declare the variables used to keep track of joystick buttons and
keyboard keys right before they are used for better readability and
consistency.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Create a list of well-known keyboard keys containing one the most
representative key(s) of a group.
The rule is based on the assumption that if the representative key is
present, other keys of the group should be present as well.
The groups are:
- Modifiers group: KEY_LEFTCTRL.
- Character group: KEY_CAPSLOCK.
- Numeric group: KEY_NUMLOCK.
- Editing keys: KEY_INSERT.
- Multimedia keys: KEY_MUTE, KEY_CALC, KEY_FILE, KEY_MAIL,
KEY_PLAYPAUSE and KEY_BRIGHTNESSDOWN.
When 4 of these keys are found, the device is tagged as a keyboard.
Fix#745
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
The most common trigger for this is the debouncing timer which is a mere
12ms and is effectively unavoidable, virtually every caller will
trigger those messages at some point.
Let's add a grace period of 20ms below which we don't log this message
to avoid logspam. And in the process, bump the equivalent warning
message up to 20ms as well.
Related #711
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The EVDEV_UDEV_TAG_JOYSTICK is set when a joystick or gamepad button
is found. However, it can not be used to identify joysticks or
gamepads because there are keyboards that also have it. Even worse,
many joysticks also map KEY_* and thus are tagged as keyboards.
In order to be able to detect joysticks and gamepads and
differentiate them from keyboards, apply the following rules:
1. The device is tagged as joystick but not as tablet
2. It has at least 2 joystick buttons
3. It doesn't have 10 keyboard keys
Fix#701Fix#415Fix#703
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Move the logic to detect joysticks and gamepads to its own function.
Refactor, no functional changes.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
When required, invert horizontal scrolling in evdev_notify_axis_wheel
following the QUIRK_MODEL_INVERT_HORIZONTAL_SCROLLING quirk.
Fix#669
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Move the logic used to parse boolean quirks and udev flags to a common
function in utils.
Refactor, no functional changes.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Starting with kernel v5.0 two new axes are available for high-resolution wheel
scrolling: REL_WHEEL_HI_RES and REL_HWHEEL_HI_RES. Both axes send data in
fractions of 120 where each multiple of 120 amounts to one logical scroll
event. Fractions of 120 indicate a wheel movement less than one detent.
This commit adds a new API for scroll events. Three new event types that encode
the axis source in the event type name and a new API to get a normalized-to-120
value that also used by Windows and the kernel (each multiple of 120 represents
a logical scroll click).
This addresses a main shortcoming with the existing API - it was unreliable to
calculate the click angle based on the axis value+discrete events and thus any
caller using the axis value alone would be left with some ambiguity. With the
v120 API it's now possible to (usually) calculate the click angle, but more
importantly it provides the simplest hw-independent way of scrolling by a
click or a fraction of a click.
A new event type is required, the only way to integrate the v120 value
otherwise was to start sending events with a discrete value of 0. This
would break existing xf86-input-libinput (divide by zero, fixed in 0.28.2) and
weston (general confusion). mutter, kwin are unaffected.
With the new API, the old POINTER_AXIS event are deprecated - callers should use
the new API where available and discard any POINTER_AXIS events.
Notable: REL_WHEEL/REL_HWHEEL are emulated by the kernel but there's no
guarantee that they'll come every accumulated 120 values, e.g. Logitech mice
often send events that don't add up to 120 per detent.
We use the kernel's wheel click emulation instead of doing our own.
libinput guarantees high-resolution events even on pre-5.0 kernels.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
In the various logging functions where we need to modify the format
argument, disable the compiler warnings. Interestingly, GCC doesn't seem
to mind those but building with clang unleashes pages of warnings.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This was observed when running in device mode with:
`libinput debug-events $EVENT_NODE`
When removing the monitored device, the no "device removed" message was
not shown.
Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
This causes a bunch of "your system is too slow" messages in e.g. the various
gesture tests.
Fixes 95a72990Fixes#601
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The dispatch time is taken during libinput_dispatch(), i.e. at the beginning
of an event sequence. We always read all events off the device, so where
events come in while we're inside the main dispatch loop, our event time may
be later than the saved dispatch_time. This causes an uint underflow and our
tdelta > 10 will be true for that case.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Two cases where this can happen: system is currently slow and delaying events,
n which case we'll get a burst and it'll show up in the log files anyway. Or
the system is generally slow and we get these warnings all the time. In the
latter case, let's not spam the log.
Fixes#533
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The latter requires libevdev 1.10 but since that'll take a while to filter
into our various CI systems, let's make it conditional.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Currently unused, but let's get this in because we may need this very soon for
broken tablets.
Enabling EV_ABS axes requires an absinfo struct - we default to a simple 0-1
axis range for those as the most generic option. Anything more custom will
need more custom treatment when we need it.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
There are a number of devices that have the ID_INPUT_JOYSTICK tag set by udev,
usually because of seemingly random event codes set. We cannot rely on
ID_INPUT_JOYSTICK to be accurate enough.
Fixes#517
This reverts commit eededbeb7f.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
libwacom has been unsetting ID_INPUT_JOYSTICK for known tablets since 2015
(libwacom 0.12) so this comment is outdated. And the input-id udev builtin
never labels something as tablet *and* joystick. Which means: systemd sets
either tablet or joystick. For tablets that are known to libwacom the joystick
bit gets corrected and we only see the tablet bits.
Tablets unknown to libwacom remain as joysticks and are ignored but that's the
behavior we had anyway.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
A device may have ID_INPUT_JOYSTICK and ID_INPUT_KEY in which case it would
still get added, despite being a joystick device. Make sure we check only the
tablet and joystick bits - where a device has the joystick bit set but not the
tablet one we ignore it.
Note that this check will get removed in the next commit anyway, it's just
here to make tracking the change easier in the history (and figuring out where
potential regressions come from).
Fixes#415
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
If we know that the tablet mode switch is bogus anyway, filter the event and
don't pass it to the caller. They won't know whether it's bogus so the only
result we get here is buggy behaviour.
This is the simplest solution here, it filters the mode switch at the lowest
level and thus the caller won't know that the tablet even has a mode switch at
all. Where the device doesn't have any other switches it'll also lose the
switch capability.
This may cause issues in some niche cases where the event node only has
that one bit and we now disabled it leaving us with a zero-event bit device.
Shouldn't matter to callers, but let's see.
Fixes#491
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This has never been supported through the stack. No device ever had the
required MOUSE_WHEEL_TILT_VERTICAL/HORIZONTAL udev property set, so
libinput never set the right axis source. Neither weston nor mutter
added the code for it. Even if we added wheel tilt for devices now, it
would break those devices. And the benefit we get from having those
separate is miniscule at best.
So let's do the long-term thing and just deprecate this axis source.
The wheel tilt mouse test device remains in the test suite, with the
udev properties set just to verify that we do indeed ignore those now.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Take a snapshot of the time every 10 libinput_dispatch() calls. During event
processing, check if the event timestamp is more than 10ms in the past and
warn if it is. This should provide a warning to users when the compositor is
too slow to processes events but events aren't coming in fast enough to
trigger SYN_DROPPED.
Because we check the device event time against the dispatch time we may get
warnings for multiple devices on delayed processing. This is intended, it's
good to know which devices were affected.
In the test suite we need to ignore the warning though, since we compose the
events in very specific ways it's common to exceed that threshold
(particularly when calling litest_touch_move_to).
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
We're getting too many regressions on other devices for this feature and only
ALPS touchpads need it (it's a kernel driver bug). So let's limit this to
those devices only.
For example, synaptics serial touchpads don't keep the fake fingers and slot
states in sync when going from two to three fingers, causing an erroneous slot
downgrade. See
https://gitlab.freedesktop.org/libinput/libinput/issues/434#note_419912
That interferes with this code but fixing it is hard and anyway,
synaptics touchpads don't need the slot count drop.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Scroll button locking is an accessibility feature. When enabled, the scroll
button does not need to be held down, the first click holds it logically down,
to be released on the second click of that same button.
This is implemented as simple event filter, so we still get the same behavior
from the emulated logical button, i.e. a physical double click results in a
single logical click of that button provided no scrolling was triggered.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Logitech MX Master 2S and 3 by default use natural scrolling
for the horizontal scroll wheel, while the main wheel
uses traditional mode. This change inverts the default
direction of horizontal scrolling.
In evdev_device_calibrate, the user matrix was not being stored when it
was the identity matrix. This resulted in
libinput_device_config_calibration_get_matrix not providing the correct
matrix. Instead of giving the identity matrix, the last non-identity
matrix set was given.
This just moves the storage of the user matrix in
evdev_device_calibrate to be above the identity matrix early return so
that it always get stored.
Signed-off-by: Brian Ashworth <bosrsf04@gmail.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Our udev callout is supposed to reset the kernel fuzz to 0 and move the value
to the LIBINPUT_FUZZ property. This is to stop the kernel from applying its
own hysteresis-like approach.
Where the kernel fuzz is nonzero, something has gone wrong with that approach.
Complain about it and set our fuzz to zero, we are in the hands of the kernel
now. If we leave our fuzz as nonzero, we'll apply our own hysteresis on top of
the kernel's and that leads to unresponsive behavior.
Fixes#313
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
We don't have a hysteresis for tablet devices, so let's leave those as-is.
This may be a slight regression in behavior compared to pre-410b157e84 now the
kernel will apply the fuzz. Let's see if anyone notices, the fuzz is usually
so tiny on tablets that it shouldn't be noticable.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This device looks similar to a MT device on the kernel side, but it's not a
MT device and it's not quite a tablet either. It uses slots to track up to 4
totems off the same device and the only hint that it's not a MT device is that
it sends ABS_MT_TOOL_TYPE / MT_TOOL_DIAL.
udev thinks it's a touchscreen and a tablet but we currently init those
devices as touchscreen (because all wacom tablet touch devices are udev
tablets+tochscreens). So we need a quirk to hook onto this device.
And we use a completely separate dispatch implementation, because adding the
behavior to the tablet interface requires so many exceptions that it's easier
to just add a separate dispatch interface.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Some versions [1] of the Lenovo ThinkPad Compact USB Keyboard with TrackPoint USB
have the pointing stick on an event node that has keys but is not a regular
keyboard. Thus the stick falls through the cracks and gets disabled on tablet
mode switch. Instead of adding more hacks let's do this properly: tag the
pointing stick as external and have the code in place to deal with that.
[1] This may be caused by recent kernel changes
Fixes#291
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
No real changes for the non-tablet code, but for tablets we now keep the
libwacom datbase around. The primary motivating factor here is response time
during tests - initializing the database under valgrind took longer than the
proximity timeouts and caused random test case failures when a proximity out
was triggered before we even got to process the first event.
This is unfortunately a burden on the runtime now since we keep libwacom
around whenever a tablet is connected. Not much of an impact though, I
suspect, chances are you're running a web browser and everything pales against
that anyway.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
All "goto err" resides after fd have been properly initialized.
Fixes "Comparison is always true because fd >= 0." warning by LGTM.
Signed-off-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
When using button scrolling, a hardcoded delay of 200 milliseconds between
button down and scroll events being emitted makes fast scrolling gestures feel
clunky and sometimes fail entirely. This feature comes from
xf86-input-mouse, was copied into xf86-input-evdev and reimplemented in
libinput.
This was, as far as can be determined, to allow right clicks without
triggering scrolling. libinput now also has distance triggers (2bbf4a0117)
and sends button events if no movement has happened for long clicks,
regardless of the delay.
The 200ms delay is thus not really necessary anymore, let's drop it to 38ms
which is just above the 3-event threshold for 8/10/12ms intervals which is
most devices.
Fixes#237
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
