Input: elantench - fix misreporting trackpoint coordinates

commit be896bd3b72b44126c55768f14c22a8729b0992e upstream.

Some firmwares occasionally report bogus data from trackpoint, with X or Y
displacement being too large (outside of [-127, 127] range). Let's drop such
packets so that we do not generate jumps.

Signed-off-by: Phoenix Huang <phoenix@emc.com.tw>
Tested-by: Yufei Du <yufeidu@cs.unc.edu>
Link: https://lore.kernel.org/r/20210729010940.5752-1-phoenix@emc.com.tw
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 2d0bc029619ff9e1e37daf062cd79b56e7b6a045..956d9cd34796485cfde3b73da2300cea199cfe3f 100644 (file)
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -517,6 +517,19 @@ static void elantech_report_trackpoint(struct psmouse *psmouse,
        case 0x16008020U:
        case 0x26800010U:
        case 0x36808000U:
+
+               /*
+                * This firmware misreport coordinates for trackpoint
+                * occasionally. Discard packets outside of [-127, 127] range
+                * to prevent cursor jumps.
+                */
+               if (packet[4] == 0x80 || packet[5] == 0x80 ||
+                   packet[1] >> 7 == packet[4] >> 7 ||
+                   packet[2] >> 7 == packet[5] >> 7) {
+                       elantech_debug("discarding packet [%6ph]\n", packet);
+                       break;
+
+               }
                x = packet[4] - (int)((packet[1]^0x80) << 1);
                y = (int)((packet[2]^0x80) << 1) - packet[5];