diff -Nru libinput-1.15.5/debian/changelog libinput-1.15.5/debian/changelog --- libinput-1.15.5/debian/changelog 2020-04-14 14:54:11.000000000 +0000 +++ libinput-1.15.5/debian/changelog 2022-04-14 04:00:23.000000000 +0000 @@ -1,3 +1,29 @@ +libinput (1.15.5-1ubuntu0.3) focal-security; urgency=medium + + * SECURITY UPDATE: Format string vulnerability + - d/p/0001-evdev-strip-the-device-name-of-format-directives.patch: + Cleanup device name to ensure format string directives are + neutralised when logging in src/evdev.c. Based on upstream patch. + - CVE-2022-1215 + + -- Alex Murray Thu, 14 Apr 2022 13:30:23 +0930 + +libinput (1.15.5-1ubuntu0.2) focal; urgency=medium + + * quirks: Unset INPUT_PROP_BUTTONPAD for Dell Precision 7550/7750. + (LP: #1906341) + * Update control build-dep libevdev-dev (>= 1.9.0+dfsg-1ubuntu0.1) for + libevdev_disable_property API + + -- Kai-Chuan Hsieh Tue, 01 Dec 2020 15:17:34 +0800 + +libinput (1.15.5-1ubuntu0.1) focal; urgency=medium + + * quirks: Customize ALPS i2c touchpad palm detect pressure threshold + (LP: #1897553) + + -- Kai-Chuan Hsieh Mon, 28 Sep 2020 18:29:24 +0800 + libinput (1.15.5-1) unstable; urgency=medium * New upstream release. diff -Nru libinput-1.15.5/debian/control libinput-1.15.5/debian/control --- libinput-1.15.5/debian/control 2020-04-14 14:52:13.000000000 +0000 +++ libinput-1.15.5/debian/control 2020-12-01 07:17:34.000000000 +0000 @@ -1,7 +1,8 @@ Source: libinput Section: libs Priority: optional -Maintainer: Debian X Strike Force +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Debian X Strike Force Uploaders: Emilio Pozuelo Monfort , Héctor Orón Martínez Build-Depends: debhelper-compat (= 12), @@ -9,7 +10,7 @@ pkg-config, libmtdev-dev (>= 1.1.0), libudev-dev, - libevdev-dev (>= 0.4), + libevdev-dev (>= 1.9.0+dfsg-1ubuntu0.1), libwacom-dev (>= 0.20), Standards-Version: 4.4.0 Vcs-Git: https://salsa.debian.org/xorg-team/lib/libinput.git @@ -71,7 +72,7 @@ libinput10 (= ${binary:Version}), libmtdev-dev (>= 1.1.0), libudev-dev, - libevdev-dev (>= 0.4), + libevdev-dev (>= 1.9.0+dfsg-1ubuntu0.1), libwacom-dev (>= 0.20), ${shlibs:Depends}, ${misc:Depends}, diff -Nru libinput-1.15.5/debian/patches/0001-evdev-strip-the-device-name-of-format-directives.patch libinput-1.15.5/debian/patches/0001-evdev-strip-the-device-name-of-format-directives.patch --- libinput-1.15.5/debian/patches/0001-evdev-strip-the-device-name-of-format-directives.patch 1970-01-01 00:00:00.000000000 +0000 +++ libinput-1.15.5/debian/patches/0001-evdev-strip-the-device-name-of-format-directives.patch 2022-04-14 04:00:17.000000000 +0000 @@ -0,0 +1,338 @@ +Backport of the following upstream patch: + +From 6d11367f31e37c4bb3902e91ffebd5418a957f67 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Wed, 30 Mar 2022 09:25:22 +1000 +Subject: [PATCH] evdev: strip the device name of format directives +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This fixes a format string vulnerabilty. + +evdev_log_message() composes a format string consisting of a fixed +prefix (including the rendered device name) and the passed-in format +buffer. This format string is then passed with the arguments to the +actual log handler, which usually and eventually ends up being printf. + +If the device name contains a printf-style format directive, these ended +up in the format string and thus get interpreted correctly, e.g. for a +device "Foo%sBar" the log message vs printf invocation ends up being: + evdev_log_message(device, "some message %s", "some argument"); + printf("event9 - Foo%sBar: some message %s", "some argument"); + +This can enable an attacker to execute malicious code with the +privileges of the process using libinput. + +To exploit this, an attacker needs to be able to create a kernel device +with a malicious name, e.g. through /dev/uinput or a Bluetooth device. + +To fix this, convert any potential format directives in the device name +by duplicating percentages. + +Pre-rendering the device to avoid the issue altogether would be nicer +but the current log level hooks do not easily allow for this. The device +name is the only user-controlled part of the format string. + +A second potential issue is the sysname of the device which is also +sanitized. + +This issue was found by Albin Eldstål-Ahrens and Benjamin Svensson from +Assured AB. + +Signed-off-by: Peter Hutterer +--- + meson.build | 1 + + src/evdev.c | 31 +++++++++++------ + src/evdev.h | 6 ++-- + src/util-strings.h | 30 ++++++++++++++++ + test/litest-device-format-string.c | 56 ++++++++++++++++++++++++++++++ + test/litest.h | 1 + + test/test-utils.c | 26 ++++++++++++++ + 7 files changed, 139 insertions(+), 12 deletions(-) + create mode 100644 test/litest-device-format-string.c + +--- a/meson.build ++++ b/meson.build +@@ -787,6 +787,7 @@ + 'test/litest-device-dell-canvas-totem-touch.c', + 'test/litest-device-elantech-touchpad.c', + 'test/litest-device-elan-tablet.c', ++ 'test/litest-device-format-string.c', + 'test/litest-device-generic-singletouch.c', + 'test/litest-device-gpio-keys.c', + 'test/litest-device-huion-pentablet.c', +--- a/src/evdev.c ++++ b/src/evdev.c +@@ -2147,19 +2147,19 @@ + struct libinput *libinput = seat->libinput; + struct evdev_device *device = NULL; + int rc; +- int fd; ++ int fd = -1; + int unhandled_device = 0; + const char *devnode = udev_device_get_devnode(udev_device); +- const char *sysname = udev_device_get_sysname(udev_device); ++ char *sysname = str_sanitize(udev_device_get_sysname(udev_device)); + + if (!devnode) { + log_info(libinput, "%s: no device node associated\n", sysname); +- return NULL; ++ goto err; + } + + if (udev_device_should_be_ignored(udev_device)) { + log_debug(libinput, "%s: device is ignored\n", sysname); +- return NULL; ++ goto err; + } + + /* Use non-blocking mode so that we can loop on read on +@@ -2173,13 +2173,15 @@ + sysname, + devnode, + strerror(-fd)); +- return NULL; ++ goto err; + } + + if (!evdev_device_have_same_syspath(udev_device, fd)) + goto err; + + device = zalloc(sizeof *device); ++ device->sysname = sysname; ++ sysname = NULL; + + libinput_device_init(&device->base, seat); + libinput_seat_ref(seat); +@@ -2202,6 +2204,9 @@ + device->dispatch = NULL; + device->fd = fd; + device->devname = libevdev_get_name(device->evdev); ++ /* the log_prefix_name is used as part of a printf format string and ++ * must not contain % directives, see evdev_log_msg */ ++ device->log_prefix_name = str_sanitize(device->devname); + device->scroll.threshold = 5.0; /* Default may be overridden */ + device->scroll.direction_lock_threshold = 5.0; /* Default may be overridden */ + device->scroll.direction = 0; +@@ -2244,9 +2249,14 @@ + return device; + + err: +- close_restricted(libinput, fd); +- if (device) +- evdev_device_destroy(device); ++ if (fd >= 0) { ++ close_restricted(libinput, fd); ++ if (device) { ++ evdev_device_destroy(device); ++ } ++ } ++ ++ free(sysname); + + return unhandled_device ? EVDEV_UNHANDLED_DEVICE : NULL; + } +@@ -2260,7 +2270,7 @@ + const char * + evdev_device_get_sysname(struct evdev_device *device) + { +- return udev_device_get_sysname(device->udev_device); ++ return device->sysname; + } + + const char * +@@ -2838,6 +2848,8 @@ + if (device->base.group) + libinput_device_group_unref(device->base.group); + ++ free(device->log_prefix_name); ++ free(device->sysname); + free(device->output_name); + filter_destroy(device->pointer.filter); + libinput_timer_destroy(&device->scroll.timer); +--- a/src/evdev.h ++++ b/src/evdev.h +@@ -169,6 +169,8 @@ + struct udev_device *udev_device; + char *output_name; + const char *devname; ++ char *log_prefix_name; ++ char *sysname; + bool was_removed; + int fd; + enum evdev_device_seat_capability seat_caps; +@@ -771,7 +773,7 @@ + sizeof(buf), + "%-7s - %s%s%s", + evdev_device_get_sysname(device), +- (priority > LIBINPUT_LOG_PRIORITY_DEBUG) ? device->devname : "", ++ (priority > LIBINPUT_LOG_PRIORITY_DEBUG) ? device->log_prefix_name : "", + (priority > LIBINPUT_LOG_PRIORITY_DEBUG) ? ": " : "", + format); + +@@ -806,7 +808,7 @@ + sizeof(buf), + "%-7s - %s%s%s", + evdev_device_get_sysname(device), +- (priority > LIBINPUT_LOG_PRIORITY_DEBUG) ? device->devname : "", ++ (priority > LIBINPUT_LOG_PRIORITY_DEBUG) ? device->log_prefix_name : "", + (priority > LIBINPUT_LOG_PRIORITY_DEBUG) ? ": " : "", + format); + +--- a/src/util-strings.h ++++ b/src/util-strings.h +@@ -111,6 +111,8 @@ + return rc; + } + ++#include "util-macros.h" ++ + static inline bool + safe_atoi_base(const char *str, int *val, int base) + { +@@ -338,3 +340,33 @@ + + return str; + } ++ ++ ++/** ++ * Return a copy of str with all % converted to %% to make the string ++ * acceptable as printf format. ++ */ ++static inline char * ++str_sanitize(const char *str) ++{ ++ if (!str) ++ return NULL; ++ ++ if (!strchr(str, '%')) ++ return strdup(str); ++ ++ size_t slen = min(strlen(str), 512); ++ char *sanitized = zalloc(2 * slen + 1); ++ const char *src = str; ++ char *dst = sanitized; ++ ++ for (size_t i = 0; i < slen; i++) { ++ if (*src == '%') ++ *dst++ = '%'; ++ *dst++ = *src++; ++ } ++ *dst = '\0'; ++ ++ return sanitized; ++} ++ +--- /dev/null ++++ b/test/litest-device-format-string.c +@@ -0,0 +1,56 @@ ++ ++/* ++ * Copyright © 2013 Red Hat, Inc. ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a ++ * copy of this software and associated documentation files (the "Software"), ++ * to deal in the Software without restriction, including without limitation ++ * the rights to use, copy, modify, merge, publish, distribute, sublicense, ++ * and/or sell copies of the Software, and to permit persons to whom the ++ * Software is furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice (including the next ++ * paragraph) shall be included in all copies or substantial portions of the ++ * Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL ++ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER ++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING ++ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER ++ * DEALINGS IN THE SOFTWARE. ++ */ ++ ++#include "config.h" ++ ++#include "litest.h" ++#include "litest-int.h" ++ ++static struct input_id input_id = { ++ .bustype = 0x3, ++ .vendor = 0x0123, ++ .product = 0x0456, ++}; ++ ++static int events[] = { ++ EV_KEY, BTN_LEFT, ++ EV_KEY, BTN_RIGHT, ++ EV_KEY, BTN_MIDDLE, ++ EV_REL, REL_X, ++ EV_REL, REL_Y, ++ EV_REL, REL_WHEEL, ++ EV_REL, REL_WHEEL_HI_RES, ++ -1 , -1, ++}; ++ ++TEST_DEVICE("mouse-format-string", ++ .type = LITEST_MOUSE_FORMAT_STRING, ++ .features = LITEST_RELATIVE | LITEST_BUTTON | LITEST_WHEEL, ++ .interface = NULL, ++ ++ .name = "Evil %s %d %x Mouse %p %", ++ .id = &input_id, ++ .absinfo = NULL, ++ .events = events, ++) +--- a/test/litest.h ++++ b/test/litest.h +@@ -303,6 +303,7 @@ + LITEST_ALPS_3FG, + LITEST_ELAN_TABLET, + LITEST_ABSINFO_OVERRIDE, ++ LITEST_MOUSE_FORMAT_STRING, + }; + + #define LITEST_DEVICELESS -2 +--- a/test/test-utils.c ++++ b/test/test-utils.c +@@ -1071,6 +1071,31 @@ + } + END_TEST + ++START_TEST(strsanitize_test) ++{ ++ struct strsanitize_test { ++ const char *string; ++ const char *expected; ++ } tests[] = { ++ { "foobar", "foobar" }, ++ { "", "" }, ++ { "%", "%%" }, ++ { "%%%%", "%%%%%%%%" }, ++ { "x %s", "x %%s" }, ++ { "x %", "x %%" }, ++ { "%sx", "%%sx" }, ++ { "%s%s", "%%s%%s" }, ++ { NULL, NULL }, ++ }; ++ ++ for (struct strsanitize_test *t = tests; t->string; t++) { ++ char *sanitized = str_sanitize(t->string); ++ ck_assert_str_eq(sanitized, t->expected); ++ free(sanitized); ++ } ++} ++END_TEST ++ + START_TEST(list_test_insert) + { + struct list_test { +@@ -1177,6 +1202,7 @@ + tcase_add_test(tc, kvsplit_double_test); + tcase_add_test(tc, strjoin_test); + tcase_add_test(tc, strstrip_test); ++ tcase_add_test(tc, strsanitize_test); + tcase_add_test(tc, time_conversion); + + tcase_add_test(tc, list_test_insert); diff -Nru libinput-1.15.5/debian/patches/0001-quirks-Customize-ALPS-i2c-touchpad-palm-detect-press.patch libinput-1.15.5/debian/patches/0001-quirks-Customize-ALPS-i2c-touchpad-palm-detect-press.patch --- libinput-1.15.5/debian/patches/0001-quirks-Customize-ALPS-i2c-touchpad-palm-detect-press.patch 1970-01-01 00:00:00.000000000 +0000 +++ libinput-1.15.5/debian/patches/0001-quirks-Customize-ALPS-i2c-touchpad-palm-detect-press.patch 2020-09-28 10:29:24.000000000 +0000 @@ -0,0 +1,38 @@ +From f0997536a7a3e384bfe64b67c5c1f874656042c6 Mon Sep 17 00:00:00 2001 +From: Kai-Chuan Hsieh +Date: Mon, 28 Sep 2020 10:43:28 +0800 +Subject: [PATCH] quirks: Customize ALPS i2c touchpad palm detect pressure + threshold + +ALPS i2c touchpad support ABS_PRESSURE and ABS_MT_PRESSURE capabilities, +The default threshold 130 is too easy to across while finger movement. +It will cause the cursor stalled after the threshold is achieved, which +impacts user experience. +Test with some ALPS touchpads 0488:101A, 0488:101D, 0488:101E, the value +180 is good on those platforms. + +Signed-off-by: Kai-Chuan Hsieh +--- + quirks/30-vendor-alps.quirks | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/quirks/30-vendor-alps.quirks b/quirks/30-vendor-alps.quirks +index 6ebcbb85..abdf98ea 100644 +--- a/quirks/30-vendor-alps.quirks ++++ b/quirks/30-vendor-alps.quirks +@@ -19,6 +19,12 @@ MatchVendor=0x0002 + MatchProduct=0x0008 + ModelALPSSerialTouchpad=1 + ++[ALPS i2c Touchpads] ++MatchUdevType=touchpad ++MatchBus=i2c ++MatchVendor=0x0488 ++AttrPalmPressureThreshold=180 ++ + [ALPS v8 Touchpads] + MatchUdevType=touchpad + MatchBus=ps2 +-- +2.25.1 + diff -Nru libinput-1.15.5/debian/patches/add-model-quirk-for-dell-precision-7x50.patch libinput-1.15.5/debian/patches/add-model-quirk-for-dell-precision-7x50.patch --- libinput-1.15.5/debian/patches/add-model-quirk-for-dell-precision-7x50.patch 1970-01-01 00:00:00.000000000 +0000 +++ libinput-1.15.5/debian/patches/add-model-quirk-for-dell-precision-7x50.patch 2020-12-01 07:17:34.000000000 +0000 @@ -0,0 +1,52 @@ +quirks: add quirk for Dell Precision 7550/7750 touchpad + +Dell Precision 7550/7750 touchpad report device capability denoted by [1] is wrongly +configured as clickpad, so that kernel driver will set INPUT_PROP_BUTTONPAD bit, +unset it for keep handling BTN_RIGHT event in libinput. + +[1] https://docs.microsoft.com/en-us/windows-hardware/design/component-guidelines/windows-precision-touchpad-required-hid-top-level-collections +--- a/src/quirks.h ++++ b/src/quirks.h +@@ -89,6 +89,7 @@ + QUIRK_MODEL_WACOM_TOUCHPAD, + QUIRK_MODEL_WACOM_ISDV4_PEN, + QUIRK_MODEL_DELL_CANVAS_TOTEM, ++ QUIRK_MODEL_DELL_PRECISION7X50_TOUCHPAD, + + _QUIRK_LAST_MODEL_QUIRK_, /* Guard: do not modify */ + +--- a/src/evdev.c ++++ b/src/evdev.c +@@ -2054,6 +2054,11 @@ + if (evdev_device_has_model_quirk(device, QUIRK_MODEL_HP_ZBOOK_STUDIO_G3)) + libevdev_set_abs_maximum(device->evdev, ABS_MT_SLOT, 1); + ++ /* Touchpad is not a clickpad but INPUT_PROP_BUTTONPAD is set */ ++ if (evdev_device_has_model_quirk(device, QUIRK_MODEL_DELL_PRECISION7X50_TOUCHPAD)) ++ libevdev_disable_property(device->evdev, ++ INPUT_PROP_BUTTONPAD); ++ + /* Generally we don't care about MSC_TIMESTAMP and it can cause + * unnecessary wakeups but on some devices we need to watch it for + * pointer jumps */ +--- a/src/quirks.c ++++ b/src/quirks.c +@@ -256,6 +256,7 @@ + case QUIRK_MODEL_WACOM_TOUCHPAD: return "ModelWacomTouchpad"; + case QUIRK_MODEL_WACOM_ISDV4_PEN: return "ModelWacomISDV4Pen"; + case QUIRK_MODEL_DELL_CANVAS_TOTEM: return "ModelDellCanvasTotem"; ++ case QUIRK_MODEL_DELL_PRECISION7X50_TOUCHPAD: return "ModelDellPrecision7x50Touchpad"; + + case QUIRK_ATTR_SIZE_HINT: return "AttrSizeHint"; + case QUIRK_ATTR_TOUCH_SIZE_RANGE: return "AttrTouchSizeRange"; +--- a/quirks/50-system-dell.quirks ++++ b/quirks/50-system-dell.quirks +@@ -73,3 +73,8 @@ + MatchVendor=0x2575 + MatchProduct=0x0204 + ModelDellCanvasTotem=1 ++ ++[Latitude 7x50 Touchpad] ++MatchName=DELL09C?:00 0488:120A Touchpad ++MatchDMIModalias=dmi:*svnDellInc.:pnPrecision7?50:* ++ModelDellPrecision7x50Touchpad=1 diff -Nru libinput-1.15.5/debian/patches/series libinput-1.15.5/debian/patches/series --- libinput-1.15.5/debian/patches/series 2020-04-14 14:52:13.000000000 +0000 +++ libinput-1.15.5/debian/patches/series 2022-04-14 03:54:11.000000000 +0000 @@ -1 +1,4 @@ #placeholder +0001-quirks-Customize-ALPS-i2c-touchpad-palm-detect-press.patch +add-model-quirk-for-dell-precision-7x50.patch +0001-evdev-strip-the-device-name-of-format-directives.patch