| Age | Commit message (Collapse) | Author |
|---|
|
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input updates from Dmitry Torokhov:
- Updates to input core to reject parent device overrides on managed
input devices so devres lifetime management is not split across
different devices, along with fixes for da7280, drv2665, drv2667, and
tps6507x-ts that were reparenting managed input devices, and removal
of redundant parent assignments across multiple drivers
- A fix in input core to always accept EV_SYN events in input_event()
and input_inject_event() so events seeded before device registration
are properly flushed by input_sync()
- A fix in matrix-keymap helper to reject keycodes above KEY_MAX and
prevent out-of-bounds bitmap writes
- Fixes and cleanups for HP GSC PS/2 (gscps2) serio driver to resolve
race conditions in port list management, ring buffer access, and
interrupt handling, return IRQ_NONE for unhandled shared interrupts,
and drop busy-waiting on transmit
- Fixes for maple_keyb driver to correct inverted key press detection,
implement open and close methods so polling only runs while the
device is open, and clean up unused driver fields
- Fixes for maplecontrol driver to emit EV_SYN after reporting events,
only enable axes reported by the controller with corrected hat
limits, and stop polling and clear the callback on close
- Updates to maplemouse driver to stop polling and clear the callback
on close and drop redundant driver data cleanup
- Fixes for matrix_keypad driver reverting forced switching of row
GPIOs to input mode that broke row interrupts on platforms with
separate GPIO and interrupt pinmux functions, and propagating the
actual error code from matrix_keypad_build_keymap()
- A fix for st-keyscan driver to keep the interrupt disabled while the
peripheral clock is gated off to prevent bus faults, along with probe
error handling improvements
- A fix for mms114 touchscreen driver to disable interrupts before
synthesizing touch release events during suspend so concurrent
interrupts do not leave stuck active touch slots
- Updates to xpad driver to support GameSir Nova Lite controller
- A number of updates to device tree bindings, including a new schema
for Analog Devices AD7147 CapTouch controller, conversion of SiS 9200
I2C touchscreen binding to DT schema format, and allowing the
wakeup-source property on Dialog DA9062 onkey
- Other assorted driver cleanups, style fixes, and conversions,
including switching to named initializers for acpi_device_id tables
and converting cyttsp5 to DEFINE_SIMPLE_DEV_PM_OPS.
* tag 'input-for-v7.4-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (94 commits)
Revert "Input: matrix_keypad - force switch rows to input mode"
Input: s6sy761 - drop duplicate axis initialization in s6sy761_probe()
Input: always accept EV_SYN in input_event()
dt-bindings: input: dlg,da9062-onkey: Allow wakeup-source property
Input: xpad - add GameSir Nova Lite support
Input: touchscreen - use named initializers for acpi_device_id
Input: mouse - cyapa: use named initializers for acpi_device_id
Input: misc - use named initializers for acpi_device_id
Input: keyboard - use named initializers for acpi_device_id
Input: reject parent overrides on managed input devices
Input: tps6507x-ts - fix input device parent assignment
Input: drv2667 - fix input device parent assignment
Input: drv2665 - fix input device parent assignment
Input: da7280 - fix input device parent assignment
Input: maple_keyb - remove unused mdev->driver assignment
Input: maplecontrol - remove unused mdev->driver assignment
Input: maplemouse - remove unused mdev->driver assignment
Input: maplecontrol - remove redundant drvdata resetting
Input: maple_keyb - remove redundant drvdata resetting
Input: maplemouse - remove redundant drvdata resetting
...
|
|
Prepare input updates for 7.4 merge window.
|
|
Use a designated initializer for the acpi_device_id fields which makes the
code more readable and consistent with how lists are initialized in the
rest of the kernel code base. Also drop explicitly setting fields to 0
where it is redundant.
Unify the list terminator to have a single space between the brackets and
no trailing comma.
Signed-off-by: Pawel Zalewski <pzalewski@thegoodpenguin.co.uk>
Link: https://patch.msgid.link/20261013-acpi-input-v1-2-53ad09ba82b7@thegoodpenguin.co.uk
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Assigning the I2C bus controller (client->dev.parent) instead of the
I2C client (&client->dev) as the parent device after
devm_input_allocate_device() causes input_register_device() to attach
the devm unregistration action to the parent controller device rather
than the client device. This leaves the input device registered on
driver unbind, leading to use-after-free.
devm_input_allocate_device() already sets input_dev->dev.parent to
&client->dev. Drop the redundant and erroneous assignment.
Fixes: 1c24622572d6 ("Input: add support for the DRV2667 haptic driver")
Assisted-by: LLM
Link: https://patch.msgid.link/20261008094736.918137-3-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Assigning the I2C bus controller (client->dev.parent) instead of the
I2C client (&client->dev) as the parent device after
devm_input_allocate_device() causes input_register_device() to attach
the devm unregistration action to the parent controller device rather
than the client device. This leaves the input device registered on
driver unbind, leading to use-after-free.
devm_input_allocate_device() already sets input_dev->dev.parent to
&client->dev. Drop the redundant and erroneous assignment.
Fixes: 4d10da13467e ("Input: add TI drv2665 haptics driver")
Assisted-by: LLM
Link: https://patch.msgid.link/20261008094736.918137-2-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Assigning the I2C bus controller (client->dev.parent) instead of the
I2C client (&client->dev) as the parent device after
devm_input_allocate_device() causes input_register_device() to attach
the devm unregistration action to the parent controller device rather
than the client device. This leaves the input device registered on
driver unbind, leading to use-after-free.
devm_input_allocate_device() already sets input_dev->dev.parent to
&client->dev. Drop the redundant and erroneous assignment.
Fixes: cd3f609823a5 ("Input: new da7280 haptic driver")
Assisted-by: LLM
Link: https://patch.msgid.link/20261008094736.918137-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:
- A fix for the ati_remote2 sysfs attributes handling, resolving type
confusion after conversion to dev_groups
- Updates to the xpad joystick driver adding support for the Corsair
Novablade Pro controller (wired and 2.4 GHz wireless) and a newer
hardware revision of the 8BitDo Pro 2 Wired Controller for Xbox.
* tag 'input-for-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox
Input: xpad - add support for Corsair Novablade Pro
Input: ati_remote2 - fix type confusion in device attribute handlers
|
|
devm_input_allocate_device() already initializes
wm831x_on->dev->dev.parent to the supplied parent device, so the
explicit assignment in wm831x_on_probe() is redundant. Remove it.
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
devm_input_allocate_device() already initializes pwr->dev.parent to the
supplied parent device, so the explicit assignment in
twl4030_pwrbutton_probe() is redundant. Remove it.
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
devm_input_allocate_device() already initializes idev->dev.parent to the
supplied parent device, so the explicit assignment in
tps6521x_pb_probe() is redundant. Remove it.
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
devm_input_allocate_device() already initializes idev->dev.parent to the
supplied parent device, so the explicit assignment in
retu_pwrbutton_probe() is redundant. Remove it.
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
assignment
devm_input_allocate_device() already initializes
haptic->input_dev->dev.parent to the supplied parent device, so the
explicit assignment in regulator_haptic_probe() is redundant. Remove it.
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
devm_input_allocate_device() already initializes
vibrator->input->dev.parent to the supplied parent device, so the
explicit assignment in pwm_vibrator_probe() is redundant. Remove it.
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
devm_input_allocate_device() already initializes input->dev.parent to
the supplied parent device, so the explicit assignment in
max8925_onkey_probe() is redundant. Remove it.
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
devm_input_allocate_device() already initializes
haptic->input_dev->dev.parent to the supplied parent device, so the
explicit assignment in max77693_haptic_probe() is redundant. Remove it.
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
devm_input_allocate_device() already initializes input->dev.parent to
the supplied parent device, so the explicit assignment in
e3x0_button_probe() is redundant. Remove it.
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
devm_input_allocate_device() already initializes priv->input->dev.parent
to the supplied parent device, so the explicit assignment in
ariel_pwrbutton_probe() is redundant. Remove it.
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
devm_input_allocate_device() already initializes input->dev.parent to
the supplied parent device, so the explicit assignments in
ad714x_probe() are redundant. Remove them.
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
devm_input_allocate_device() already initializes input->dev.parent to
the supplied parent device, so the explicit assignment in
ab8500_ponkey_probe() is redundant. Remove it.
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
devm_input_allocate_device() already initializes info->idev->dev.parent
to the supplied parent device, so the explicit assignment in
pm860x_onkey_probe() is redundant. Remove it.
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
devm_input_allocate_device() already initializes idev->dev.parent to
the supplied parent device, so the explicit assignment in
axp20x_pek_probe_input_device() is redundant. Remove it.
Reported-by: sashiko-bot@kernel.org
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Previously, the channel_mask and mode_mask attributes were registered on
the parent usb_device via sysfs_create_group(). When commit b20d6bf8014b
("Input: ati-remote2 - use driver core to instantiate device
attributes") converted the driver to let the driver core manage them via
dev_groups in struct usb_driver, the attributes moved to the bound
usb_interface devices, but the show and store callbacks were not updated
accordingly.
As a result, the callbacks still invoked to_usb_device() on a device
pointer belonging to a struct usb_interface, producing an invalid
usb_device pointer.
Use to_usb_interface() directly in the attribute handlers to obtain the
interface and its driver data.
Fixes: b20d6bf8014b ("Input: ati-remote2 - use driver core to instantiate device attributes")
Assisted-by: DeepSeek-V4.1-Flash
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20261009040302.3087205-1-vulab@iscas.ac.cn
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:
- Fixes for evdev and input compat handling to zero-initialize on-stack
absinfo and force-feedback effect structures before partial or compat
copies from userspace, preventing kernel stack memory disclosure
- Fixes for the Synaptics RMI4 driver to prevent an out-of-bounds read
when writing multi-chunk blocks over SMBus and to avoid a NULL
pointer dereference during suspend/resume when the RMI device is
unbound
- Fixes for the soc_button_array driver to propagate -EPROBE_DEFER on
non-Bay Trail/Cherry Trail platforms (fixing broken power and volume
buttons on the Microsoft Surface Pro 11) and to validate the ACPI
package element count before dereferencing
- A fix for the adp5588-keys driver to cache the initial GPIO hardware
state before registering the gpiochip so pre-configured pin states
are not clobbered by GPIO hogs during registration
- A fix for the cyttsp5 touchscreen driver to clamp the device-supplied
HID report size before copying into the response buffer, preventing a
buffer overflow
- A fix for the HP SDC serio driver to use timer_shutdown_sync() on
module exit so the periodic kicker timer cannot rearm itself during
teardown
- A fix for the eeti_ts touchscreen driver to export its OF module
alias so the module autoloads on Device Tree platforms
- Updates to the xpad joystick driver adding support for the Victrix
Pro BFG controller and Azeron devices, and fixing the device type
classification for the PDP Marvel Xbox 360 controller
- Quirks for the i8042 and atkbd drivers to keep the built-in keyboards
functional on the Acer Aspire Go 15 AG15-42P and Xiaomi Redmi Book
Pro 16 2026
- A quirk for the Synaptics PS/2 touchpad driver disabling SMBus
InterTouch on the Lenovo ThinkPad T440p (board ID 2722) so the
touchpad and TrackPoint respond immediately at boot
- Other minor updates and documentation fixes, including reading the
"ti,poll-period" property as u32 in tsc2007, adding the mt6572
compatible to the MediaTek keypad Device Tree binding, fixing an
attribute name typo in the trackpoint sysfs ABI documentation, and
documenting that no new LED codes should be added to the input
subsystem
* tag 'input-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: hp_sdc - shut down kicker timer on module exit
Input: xpad - add support for Victrix Pro BFG Controller
Input: tsc2007 - read "ti,poll-period" as u32
Input: trackpoint - fix the inertia attribute name in the ABI document
Input: eeti_ts - publish the OF module alias
Input: xpad - add support for Azeron devices
Input: xpad - fix PDP Marvel Xbox 360 controller
Input: document that no new LED codes should be added
Input: soc_button_array - check btns_desc->package.count
Input: soc_button_array - fix MS Surface Pro 11 probe failure
Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
Input: cyttsp5 - clamp the HID report size before memcpy
Input: zero ff_effect before compat copy in input_ff_effect_from_user
Input: evdev - zero absinfo before partial copy in EVIOCSABS
Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
dt-bindings: input: mediatek,mt6779-keypad: add mt6572
Input: adp5588-keys - cache GPIO state before registering the gpiochip
|
|
Check that btns_desc->package.count is not 0 before accessing
btns_desc->package.elements[0].
Fixes: 4c3362f44980 ("Input: soc_button_array - add support for ACPI 6.0 Generic Button Device")
Cc: stable@vger.kernel.org
Reported-by: Shashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-input/20260909091440.3384C1F00A3A@smtp.kernel.org/
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Link: https://patch.msgid.link/20260909093934.29411-2-johannes.goede@oss.qualcomm.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
On the MS Surface Pro 11 soc_button_array probing races with the GPIO
driver probing. If soc_button_array wins the race then gpiod_get() returns
EPROBE_DEFER, which should normally take care of retrying later, but
the soc_button_array code deliberately ignores EPROBE_DEFER causing it
to fail its probe() which causes the volume and power buttons to now work.
The ignoring of EPROBE_DEFER is there to deal with a problem specific to
older Bay Trail (BYT) and Cherry Trail (CHT) tablets which often use this
driver. Modify the error handling to only ignore EPROBE_DEFER on BYT and
CHT platforms and propagate EPROBE_DEFER normally on other platforms.
Fixes: bcf059578980 ("Input: soc_button_array - partial revert of support for newer surface devices")
Cc: stable@vger.kernel.org
Reported-by: Sergey Lebedev <lsa.uz@pm.me>
Closes: https://lore.kernel.org/lkml/20260830141355.55898-1-lsa.uz@pm.me/
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Tested-by: Sergey Lebedev <lsa.uz@pm.me>
Link: https://patch.msgid.link/20260909093934.29411-1-johannes.goede@oss.qualcomm.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci
This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.
Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.
Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook <kees+treewide@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
Pull HID updates from Jiri Kosina:
"Core:
- fix long-standing force-feedback initialization race across the
subsystem (Dmitry Torokhov)
- switch to system_dfl_wq (Marco Crivellari)
AMD-SFH:
- support for tablet-mode switch for AMD SFH-based systems (Basavaraj
Natikar)
HyperX:
- support for HyperX QuadCast 2 (Benjamin Blume)
I2C-HID:
- support for devices that provide HID descriptor solely through
the ACPI _DSM method (XIE Zhibang)
Intel-THC-HID:
- support for full I2C bus config parameters (Even Xu)
Logitech:
- HID++ 2.0 repogrammable button support (Elliot Douglas)
- Bolt receiver support for HID++ devices (Erik Håkansson)
MSI:
- support for MSI Claw (Derek J. Clark)
Steam:
- initial support for 2026 Steam Controller (Vicki Pfau)
- support for sensor events on the 2025 Steam Controller (Vicki Pfau)
And many, many other fixes for various long standing issues that were
found by new modern tools, and quite a few device ID additions"
* tag 'hid-for-linus-2026081901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (146 commits)
HID: tmff: Use 64-bit arithmetic for force feedback scaling
HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU
HID: sensor: custom: Fix field sysfs group cleanup on failure
HID: sensor: custom: Fix use-after-free in enable_sensor
HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
HID: haptic: don't write an uninitialized value to unhandled usages
HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown
HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown
HID: steam: Zero out inputs when disabling gamepad mode
HID: steam: Clean up locking
HID: steam: Don't set feature reports when disconnecting
HID: steam: Fix wording of connect/disconnect logs
HID: steam: Initial 2026 Steam Controller support
HID: steam: Refactor registration
HID: logitech: add Bolt receiver support for Logitech HID++ devices
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
HID: universal-pidff: stop the device when force-feedback init fails
HID: haptic: move FF initialization into .input_configured()
HID: logitech-hidpp: move FF initialization to .input_configured()
HID: megaworld: move FF initialization to .input_configured()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio updates from Bartosz Golaszewski:
"GPIO core:
- extend the gpio-regmap abstraction layer with more features
allowing users to override configuration setting, translate
register values and masks and enable/disable interrupts
- extend GPIO kunit tests with suites verifying probe ordering by
software node devlink support and software node hogs
- shrink GPIO kunit initialization code
- coding style updates (remove commas from sentinels where
applicable)
- with all users now converted treewide to using real firmware node
links for software node GPIO lookup: remove the deprecated
label-matching mechanism from from GPIO core
- drop redundant return value check of nonseekable_open() in
gpiolib-cdev
- use IRQ trigger helpers where applicable
Driver updates:
- refactor error paths and logging in gpio-nomadik
- use more modern interfaces for getting resources in gpio-rockchip,
gpio-bt8xx and gpio-pca9570
- add missing MODULE_DEVICE_TABLE() to gpio-sifive and gpio-vf610
- drop unused FILONOFF macro from gpio-rcar
- extend build coverage of ioport GPIO drivers with COMPILE_TEST=y
- only enable the gpio-rtd driver by default with ARCH_REALTEK=y to
avoid bloating the build
- refactor coding style in several drivers
- use correct endianess translation in gpio-pcf85x
- add wake-up interrupt support to gpio-mvebu
- apply initial value in direction output setter in gpio-by-pinctrl
Misc:
- replace linux/gpio.h inclusions treewide with linux/gpio/legacy.h
which now exports all the deprecated APIs
- select GPIOLIB_LEGACY in Kconfig where required treewide
- use software nodes for gpio-keys in MFD drivers
Devicetree bindings:
- describe the realtek rtd1625 GPIO controller
- document new models for gpio-pca95xx and gpio-cadence
- document new property in gpio-rockchip"
* tag 'gpio-updates-for-v7.3-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (61 commits)
gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper
dt-bindings: gpio: rockchip,gpio-bank: Add rockchip,grf property
gpio: Use IRQ trigger mask helpers
gpio: allow COMPILE_TEST for IOPORT drivers
gpio: realtek: Add driver for Realtek DHC RTD1625 SoC
gpio: regmap: Add IRQ enable/disable helpers
gpio: regmap: Add set_config callback
gpio: regmap: Add value_xlate callback
gpio: regmap: Add gpio_regmap_operation to extend reg_mask_xlate callback
gpio: regmap: Order kernel-doc descriptions with the actual appearance
gpio: regmap: Apply default resource callbacks for regmap IRQ chip
gpio: regmap: Provide default IRQ resource request and release callbacks
Revert "gpio: realtek: Add driver for Realtek DHC RTD1625 SoC"
gpib: gpio: replace linux/gpio.h inclusion
Input: matrix_keyboard - replace linux/gpio.h inclusion
phy: replace linux/gpio.h inclusions
pcmcia: replace linux/gpio.h inclusions
ASoC: replace linux/gpio.h inclusions
mfd: replace linux/gpio.h inclusions
sh: replace linux/gpio.h inclusions
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-next
Linux 7.2
|
|
Prepare input updates for 7.3 merge window.
|
|
Report whether an AMD convertible is in laptop or tablet mode using the
operating-mode sensor provided by the Sensor Fusion Hub, and expose it
to userspace as SW_TABLET_MODE, so userspace can react to the device
being folded into tablet posture.
Cc: Helge Bahmann <hcb@chaoticmind.net>
Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input updates from Dmitry Torokhov:
- Fixes for information leaks and OOB accesses across several drivers,
including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra
- Improvements to the synaptics-rmi4 driver to properly handle F54
worker errors and prevent buffer overflows
- Input validation fixes in the hynitron_cstxxx touchscreen driver to
prevent issues with invalid finger IDs and touch counts
- Fixes for use-after-free and initialization bugs in the byd mouse and
psxpad-spi drivers
- New quirks for the atkbd driver to make keyboard work on HONOR and
Xiaomi laptops
- Support for the ZENAIM LEVERLESS controller in the xpad driver.
* tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: evdev - sanitize event type index when fetching event masks
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
Input: synaptics-rmi4 - zero report size on F54 work error
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
Input: hynitron_cstxxx - validate touch count and finger IDs
Input: evdev - fix information leak in evdev_pass_values()
fixp-arith: convert comments to kernel-doc format
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Input: atkbd - skip deactivate for HONOR ZQC-P
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
Input: iforce - validate input packet lengths
Input: psxpad-spi - set driver data before use
Input: cs40l50-vibra - validate custom data from user space
Input: xpad - add support for ZENAIM LEVERLESS
Input: edt-ft5x06 - ignore contacts with an out-of-range slot id
Input: byd - synchronize timer deletion before freeing private data
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground into gpio/for-next
gpio: legacy interface cleanups for 7.3
These are the remaining patches for legacy gpio interface
cleanup, ensuring that files referencing them are sure to
have CONFIG_GPIOLIB_LEGACY set, and use linux/gpio/legacy.h
instead of the old linux/gpio.h header.
There are a few more patches already merged in other
branches for 7.3, including soc, led, net and media. Once
everything is in, we can apply the final patches to turn
off CONFIG_GPIOLIB_LEGACY by default and remove the obsolete
header file.
This branch is based on the immutable ib-mfd-legacy-gpio-7.3
branch from mfd.git to avoid a conflict in the rohm drivers.
|
|
cs40l50_add() copies the custom data of an FF_PERIODIC/FF_CUSTOM effect
straight from the ff_effect the user passed to EVIOCSFF, without
requiring it to hold anything:
work_data.custom_data = memdup_array_user(periodic->custom_data,
periodic->custom_len,
sizeof(s16));
work_data.custom_len = periodic->custom_len;
The driver then reads two words out of that buffer: custom_data[0] as the
waveform bank in cs40l50_effect_bank_set(), and custom_data[1] as the
index within the bank in cs40l50_effect_index_set(). Neither read is
covered by a length check, and custom_len is fully user controlled:
- custom_len == 0 makes memdup_array_user() call memdup_user() with a
length of zero, which returns ZERO_SIZE_PTR rather than an error, so
custom_data[0] dereferences it.
- custom_len == 1 allocates two bytes. A bank of ROM or RAM keeps
effect->type out of the OWT case, and custom_data[1] is then read one
word past the allocation.
The bank value itself is also mishandled. It is masked with
CS40L50_CUSTOM_DATA_MASK (0xffff) but stored in an s16, so a
custom_data[0] of 0x8000 or above wraps to a negative value that passes
the "bank_type >= CS40L50_WVFRM_BANK_NUM" test.
cs40l50_effect_index_set() indexes vib->dsp.banks[] with it before the
switch statement's default case gets a chance to reject it:
base_index = vib->dsp.banks[effect->type].base_index;
max_index = vib->dsp.banks[effect->type].max_index;
Require the two words the driver reads to be present, and hold the masked
bank in a u32 so the existing upper-bound test covers the whole range.
The da7280 haptic driver already range checks custom_len this way.
Fixes: c38fe1bb5d21 ("Input: cs40l50 - Add support for the CS40L50 haptic driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260718074032.1864861-1-sammiee5311@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
This driver converts information from ACPI in x86 based tablets and
laptops into platform_data for the gpio_keys driver, using the obsolete
gpio number based interfaces.
This should really be converted to some other method, but since the
conversion is nontrivial, have this one select GPIOLIB_LEGACY for the
time being.
This enables turning GPIOLIB_LEGACY off by default on most kernel
builds. Since the driver is only used on x86 portables, add a CONFIG_X86
dependency, which means non-x86 allmodconfig builds usuallly build
without the legacy gpio support.
Link: https://lore.kernel.org/all/ah-1z9LhVG0wtfBw@google.com/
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> # for input
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
Sync up with mainline to pull in stable fixes to avoid merge conflicts.
|
|
The driver has a match table for the usb bus wired into its driver
structure, but the table is not exported with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE() entry so module alias information
is generated for automatic module loading.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260704151730.42772-1-pengpeng@iscas.ac.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
files)
Replace the #include of <linux/mod_devicetable.h> by the more specific
<linux/device-id/*.h> where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.
Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
|
|
The ISA1200 is a haptic feedback unit from Imagis Technology using two
motors for haptic feedback in mobile phones. Used in many mobile devices
c. 2012 including Samsung Galxy S Advance GT-I9070 (Janice), Samsung Beam
GT-I8350 (Gavini), LG Optimus 4X P880 and LG Optimus Vu P895.
The exact datasheet for the ISA1200 is not available; all data was modeled
based on available downstream kernel sources for various devices and
fragments of information scattered across the internet.
Tested-by: Linus Walleij <linusw@kernel.org> # GT-I9070 Janice
Signed-off-by: Linus Walleij <linusw@kernel.org>
Co-developed-by: Svyatoslav Ryhel <clamor95@gmail.com>
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Link: https://patch.msgid.link/20260617070528.35006-3-clamor95@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
There is no need to keep changelogs in driver sources, they are tracked
in git.
Signed-off-by: Elliot Tester <elliotctester1@gmail.com>
Link: https://patch.msgid.link/20260514193302.117488-1-elliotctester1@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
The driver parses CDC union descriptors in ims_pcu_get_cdc_union_desc()
by iterating through the extra descriptor data. However, it does not
verify that the bLength of each descriptor is at least 2. A malicious
device could provide a descriptor with bLength = 0, leading to an
infinite loop in the driver.
Add a check to ensure bLength is at least 2 before proceeding with
parsing.
Fixes: 628329d52474 (Input: add IMS Passenger Control Unit driver)
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
The driver processes response data from device buffers without verifying
that the device actually sent enough data. This can lead to
out-of-bounds reads or processing stale data.
Add checks for the expected response length before accessing the
buffers.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
In ims_pcu_line_setup(), the driver uses pcu->cmd_buf as a transfer
buffer for usb_control_msg(). However, pcu->cmd_buf is embedded in the
struct ims_pcu allocation, which violates DMA mapping rules regarding
cacheline alignment.
Use a heap-allocated buffer for the line coding data instead.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
The debug logging in ims_pcu_irq() unconditionally prints data from
pcu->urb_in_buf. However, if the interrupt fired for pcu->urb_ctrl, the
actual data resides in pcu->urb_ctrl_buf. If urb->actual_length for the
control URB exceeds pcu->max_in_size, this leads to an out-of-bounds
read.
Fix this by printing from the correct buffer associated with the URB.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
The driver currently assumes that the first endpoint of the control
interface is an interrupt IN endpoint without verifying it. A malicious
device could provide a different endpoint type, which would then be
passed to usb_fill_int_urb(), potentially leading to kernel warnings
or undefined behavior.
Verify that the control endpoint is an interrupt IN endpoint.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
The ims_pcu_reset_device() sysfs callback calls ims_pcu_execute_command()
without acquiring pcu->cmd_mutex. This can lead to data races and
corruption of the shared command buffer if triggered concurrently with
other commands.
Acquire pcu->cmd_mutex before calling ims_pcu_execute_command().
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
The firmware object was not being released if validation failed.
Use __free(firmware) to ensure the firmware is always released.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
The driver currently trusts the bMasterInterface0 from the CDC union
descriptor without verifying that it matches the interface being
probed. This could lead to the driver overwriting the private data of
another interface.
Validate that the control interface found in the descriptor is indeed
the one we are probing.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
ims_pcu_disconnect() only intended to perform cleanup when the primary
(control) interface is unbound. However, it currently relies on the
interface class to distinguish between control and data interfaces.
A malicious device could present a data interface with the same class
as the control interface, leading to premature cleanup and potential
use-after-free or double-free.
Switch to verifying that the interface being disconnected is indeed
the control interface.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
During probe the driver claims the data interface, but it never releases
it. Release it in disconnect to avoid leaving it permanently claimed.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
