linux.git/drivers/input/mouse, branch master

treewide: refresh kmalloc_obj() conversions

2026-09-05T04:37:00+00:00

This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook

Merge branch 'next' into for-linus

2026-08-15T04:26:07+00:00

Prepare input updates for 7.3 merge window.

Input: elan_i2c - sort include statements

2026-08-13T00:44:06+00:00

Sort the include statements before adding new ones in the next change. Reviewed-by: Andy Shevchenko Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20260811122011.3539250-3-wenst@chromium.org Signed-off-by: Dmitry Torokhov

Input: elan_i2c - optimize update speed for IC Type 0x19.

2026-08-13T00:37:45+00:00

Reduce update time by optimizing the update sequence and removing unnecessary delays. Signed-off-by: jingle.wu@emc.com.tw Link: https://patch.msgid.link/KL1PR01MB5116A253A126179473EDB7ACDCCA2@KL1PR01MB5116.apcprd01.prod.exchangelabs.com Signed-off-by: Dmitry Torokhov

Input: synaptics_i2c - return 0 explicitly on success

2026-08-05T04:27:53+00:00

error is always zero at the last return in synaptics_i2c_reg_set(). Explicitly return 0 on the success path instead of returning error, which is the preferred way when there are multiple failure points. No functional change. Signed-off-by: Sang-Heon Jeon Link: https://patch.msgid.link/20260729171001.260698-4-ekffu200098@gmail.com Signed-off-by: Dmitry Torokhov

Input: focaltech - use signed coordinates to prevent underflow

2026-08-04T05:24:02+00:00

focaltech_finger_state stores finger coordinates x and y as unsigned int. When processing relative packets, negative deltas can cause unsigned integer underflow if the finger moves past the left or bottom boundary of the touchpad, wrapping the coordinates to values near UINT_MAX. When clamping the coordinates in focaltech_report_state(), these underflowed values are clamped against priv->x_max / priv->y_max instead of 0, causing the cursor to jump erratically to the opposite edge of the touchpad. Change the coordinate variables and limits to signed int so that negative values resulting from relative movements clamp correctly to 0, and write the clamped values back to state in focaltech_report_state() to prevent coordinate wind-up accumulation at the touchpad boundaries. Fixes: 05be1d079ec0 ("Input: psmouse - support for the FocalTech PS/2 protocol extensions") Reported-by: sashiko-bot@kernel.org Link: https://patch.msgid.link/am_tH_F938rK6ask@google.com Assisted-by: Antigravity:gemini-3.6-flash Signed-off-by: Dmitry Torokhov

Input: psmouse - use guard() for resource management

2026-08-04T00:06:27+00:00

Replace manual serialization with guard(mutex) and guard(serio_pause_rx) where appropriate. This eliminates the need for explicit goto-based error paths. Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/20260727050803.1269941-4-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov

Input: psmouse - modernize PNP ID parsing

2026-08-04T00:06:26+00:00

Rewrite psmouse_matches_pnp_id() to parse and match the space-separated PNP ID string directly in place without dynamic memory allocation. Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/20260727050803.1269941-3-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov

Input: psmouse - clean up locking around disable_work_sync()

2026-08-04T00:06:26+00:00

In the past, psmouse_disconnect() used cancel_work_sync(). Because cancel_work_sync() must be called with the psmouse_mutex dropped, and we needed to prevent psmouse_receive_byte() from re-queueing the work behind our back, the code transitioned the device to PSMOUSE_CMD_MODE while holding the mutex, then dropped the mutex and cancelled the work. When cancel_work_sync() was replaced with disable_work_sync() in this path, the mutex juggling remained. However, disable_work_sync() inherently prevents the work from being executed or re-queued, making the mutex juggling unnecessary. Clean this up by moving disable_work_sync() to the very top of psmouse_disconnect(), before we acquire psmouse_mutex. Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/20260727050803.1269941-2-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov

Input: psmouse - fix use-after-free during protocol disconnect

2026-08-04T00:06:26+00:00

When a PS/2 mouse is disconnected or unbound, psmouse_disconnect() calls the protocol disconnect handler (psmouse->disconnect()). During this time, stray bytes arriving from the physical controller can still be passed to psmouse_handle_byte(), which will invoke psmouse->protocol_handler(). This creates an asynchronous race condition with vendor disconnect handlers (such as synaptics_disconnect()), which free vendor-specific private structures (psmouse->private). If a byte arrives while the structures are being freed, it leads to a use-after-free or NULL pointer dereference in the protocol handler. Fix this by explicitly setting psmouse->protocol_handler to NULL safely wrapped in scoped_guard(serio_pause_rx, serio) immediately before calling the vendor disconnect handler. We also add an unlikely check in psmouse_handle_byte() to safely drop incoming bytes if the protocol handler is NULL. Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/20260727050803.1269941-1-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov