summaryrefslogtreecommitdiff
path: root/drivers/hid
AgeCommit message (Collapse)Author
6 daysMerge tag 'fbdev-for-7.4-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev updates from Helge Deller: "A whole lot of small fixes all over many drivers, but the majority of changes are related to code cleanups regarding the cursor handling in vt and fbcon. Fixes: - core: initialize modelist in framebuffer_alloc() - core: bitblit: fix glyph clipping when fbcon pans - fbcon: restore font geometry if font rotation fails - sh_mobile_lcdcfb: restore the per-overlay sysfs attributes - udlfb: don't rebuild the mode list while the framebuffer is in use - atmel_lcdfb: prevent FIFO work after removal Cleanups: - vt, fbcon, vgacon: cursor code rework & cleanups - MAINTAINERS: name the deller/linux-fbdev for-next branch - drop unused FB_IOMEM_HELPERS_DEFERRED Kconfig option - acornfb: remove unused code - atafb: fix sparse warnings and avoid casts - sstfb: use managed PCI device enable - gxt4500, kyro, nvidia: release write-combining handle on probe failure - various drivers: typo fixes in comments - various drivers: fix error path on fb_deferred_io_init() failure - various drivers: use FB blanking constants instead of VESA constants" * tag 'fbdev-for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (53 commits) fbdev: xilinxfb: Use FB blanking constants fbdev: platinumfb: Use FB blanking constants fbdev: sa1100fb: Remove comment on VESA DPMS modes fbdev: i810fb: Use FB blanking constants fbdev: au1100fb: Use FB blanking constants fbcon: Retry rotated font allocation after failure fbcon: Rebuild rotated font buffer on font change fbcon: Include font geometry in the rotated font cache fbdev: bitblit: Fix glyph clipping when fbcon pans fbcon: Replace fbcon_fill_cursor_mask() with fbcon_cursor_glyph() lib/fonts: Add font_glyph_cursor() helper vgacon: Use vt_cursor_{start,end}() vgacon: Remove trailing whitespaces vt: Add cursor-size helpers MAINTAINERS: name the deller/linux-fbdev for-next branch fbdev: atafb: avoid cast when assigning buffer address pointer fbdev: atafb: fix sparse warnings fbdev: atyfb_base: fix typos in comments fbdev: aty128fb: fix typos in comments fbdev: mach64: fix typos in comments ...
8 daysMerge tag 'mm-stable-2026-10-19-21-33' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: - "selftests/mm: improve khugepaged coverage" (Kiryl Shutsemau): Give khugepaged a proper workout. Extend the tests to all supported mTHP orders, check exactly which windows collapsed, and make scan completion deterministic. Race collapse against faults, pinning, fork and remap; verify that the contents survive. Add coverage for whole-page-table zaps and memory pressure too. - "selftests/mm: separate GUP microbenchmarking from functional testing" (Sarthak Sharma): Untangle GUP benchmarking from correctness testing. Move the benchmark into tools/mm, add a standalone harness-based GUP selftest, and move shared helpers into tools/lib/mm. Give each tool one job instead of mixing timing measurements with correctness checks. Cover the mapping, pinning and batch-size combinations explicitly. - "mm: Switch device DAX to section-based vmemmap optimization" (Muchun Song): Apply section-based vmemmap optimization to device DAX. Rework the backing metadata layout to save memory while preserving the handling of device memory hotplug and its different alignment and lifetime requirements. - "mm: Introduce section-based vmemmap optimization for HugeTLB" (Muchun Song): Cut the memory consumed by HugeTLB's struct page array with section-based vmemmap optimization. Arrange the metadata so large huge pages need fewer backing pages, while keeping initialization, teardown and the various hugepage configurations straight. - "mm/huge_memory: clean up and decouple the anon and file split helpers" (Kairui Song): Separate anonymous and file-backed folio splitting, which have rather different locking and bookkeeping requirements. Move the work into separate helpers, drop dead checks and tidy swap-cache handling. Fix error paths, including one that could leave a folio frozen. Keep the swap cache cases separate from file-cache splitting. - "mm: Unconditional per-VMA locks and cleanups" (Dave Hansen): Make per-VMA locking unconditional and clean up the old conditional code around it. This removes configuration-dependent plumbing and lets callers depend on one locking model rather than carrying both cases along. - "memcg: remove the v1 soft limit" (Shakeel Butt): Remove the old cgroup v1 memory soft-limit machinery. This has long since been superseded by the newer memory-control interfaces; hauling around a separate reclaim scheme for it no longer buys us much. - "read proc/pid/smaps_rollup under per-vma lock" (Suren Baghdasaryan): Read /proc/PID/smaps_rollup using per-VMA locks where possible, rather than holding mmap_lock across the entire walk. Retain the contention fallback and add tearing tests. This considerably reduces latency when another thread is busy changing its mappings. - "mm/damon: introduce data access-as-a-data attribute" (SJ Park): Teach DAMON to expose memory access observations as data attributes, making them available to the probe and filtering machinery. Extend the interfaces, documentation and tests so the new information can be used rather than merely collected. - "Remove PG_private by using page/folio->private checks instead" (Zi Yan): Get rid of PG_private and use the folio's private pointer to say whether private data is attached. Convert the filesystem users, including erofs, f2fs and md, and clean up the old accessors and flags. There are a few special cases, notably swapcache and hugetlb, which need explicit care. - "mm: make userland page table freeing RCU-safe" (Lorenzo Stoakes): Make freeing userspace page tables safe against RCU readers. Sort out the page-table lifetime and locking rules so walkers cannot stumble over freed tables while mappings are being torn down. - "make unused huge shrinker memcg aware" (Qi Zheng): Make shmem's unused-huge-folio shrinker aware of memory cgroups, so reclaim can find those folios under the right memcg. Wire up the per-memcg tracking and its lifetime rules, and give the shrinklist its own lockdep class to avoid spurious dependency reports. - "mm: Drop pxd_ERROR()" (Anshuman Khandual): Remove the old pxd_ERROR() page-table checks and their architecture-specific baggage. Simplify the common page-table interfaces and callers now that these checks no longer serve a useful purpose. - "memcg: group struct fields by access pattern" (Shakeel Butt): Rearrange memcg's hot and cold fields according to how they're actually accessed. Keep frequently updated counters and their neighboring state from fighting over cachelines and reduce needless cacheline traffic. - "mm/damon/core: fix the size charged for a filter-trimmed region" (Donggeun Yoo): Fix DAMOS quota accounting when a filter trims a monitoring region. Charge only the part left after filtering, not the original region, and add KUnit coverage. Previously the excluded memory could eat into the quota and make schemes run more slowly than requested. - "mm/damon: add kunit and selftests for probes and probe weights" (SJ Park): Add more tests for DAMON probes and their weights, including validation and the results reported to userspace. This is mostly about catching regressions in the newer probe infrastructure before they become harder to diagnose. - "mm: memcontrol: constify the read side of the read side of the memcg API" (Tal Zussman): Mark the read-only parts of the memcg interface const, from folio and lruvec accessors to counters and swap helpers. Most of this is mechanical, but it makes the contracts clearer and lets the compiler catch accidental writes. - "mm/damon/vaddr: support {prep,apply}_probes" (SJ Park): Support the new prepare/apply probe operations in DAMON's virtual-address backend. This brings vaddr monitoring into line with the probe infrastructure and makes the added probe types useful there too. - "mm/mglru: clean up folio counters and flag usage" (Kairui Song): Simplify MGLRU's folio counters and flag handling. Remove redundant accounting paths and make the state transitions easier to follow without changing the intended reclaim policy. - "arch, mm/execmem: resolve confusion about set_direct_map_valid_noflush()" (Mike Rapoport (Microsoft)): Clarify and straighten out the set_direct_map_valid_noflush() interface across architectures and execmem. Make the requested mapping changes and the callers' expectations agree, rather than relying on subtly different architecture behavior. - "mm: zswap: free cold writeback folios promptly" (Alexandre Ghiti): Free zswap writeback folios as soon as their disk write completes. They are cold temporary buffers, so putting them on the LRU only makes reclaim rediscover them later. Extend swap-cache dropbehind and let zswap keep these folios off the LRU altogether. - "mm: gup: cleanup gup_fast call chain" (Aristeu Rozanski): Clean up the GUP-fast call chain and simplify how the fast-path helpers pass their arguments and results around. Keep the page-pin behavior the same while making the call sequence easier to maintain. - "mm: optimize zone-device memmap initialization" (Li Zhe): Speed up initialization of zone-device struct pages. Avoid redundant work when setting up large device-memory ranges, where touching every descriptor can get expensive. - "mm/zswap: shrink zswap_entry via a pool id" (Jianyue Wu): Reduce the size of zswap_entry by storing a compact pool identifier instead of a full pointer. Keep the pool lookup and lifetime handling correct while saving per-entry metadata. - "mm/damon: support access monitoring of hugetlb-backed memory" (Krishna Iyer): Let DAMON monitor hugetlb-backed memory too. Extend the relevant access checks and add coverage so those mappings no longer fall through a hole in the monitoring machinery. - "mm/execmem: fixes and cleanups for the ROX cache" (Mike Rapoport): Tidy execmem's read-only-executable cache and fix its handling of the awkward allocation and release cases. The aim is to make the cache's ownership and permission transitions more predictable. - "zsmallc: remove old object read API" (Sergey Senozhatsky): Drop zsmalloc's old object-read API and move its remaining users to the supported access mechanism. This removes a duplicate interface which we no longer need. - "mm/mempolicy: stop copying state in the interleave paths" (Gregory Price): Stop copying mempolicy state in the interleave paths when a reference to the existing policy will do. This avoids extra work and makes the ownership rules less obscure. - "mm/mglru: speed up inc_min_seq() and fix cold/hot inversions" (Barry Song): Make MGLRU's generation advancement cheaper and fix cases where cold and hot folios end up in the wrong order. Adjust the counter and list handling so reclaim doesn't keep passing over the better eviction candidates. - "mm: Fix MF_DELAYED handling on memory failure" (Lisa Wang): Treat MF_DELAYED as a partially completed memory-failure operation, not an outright failure. Propagate that result correctly through shmem and the generic handler, fix the extra-reference accounting, and add tests for the resulting SIGBUS behavior. - "tools/mm/page_owner_sort: fix --sort, add module filter, improve usage" (Ye Liu): Fix page_owner_sort's --sort handling, add module-based filtering and make the usage output more helpful. This makes the tool less frustrating when tracking down who is holding on to pages. - "mm/damon: move damos filter range arguments validation to core" (SJ Park): Move DAMOS filter range validation into the core, where all callers can share it. Also close the sysfs read-twice races which could pass inconsistent ranges, and add tests for invalid input. - "mm/damon: misc cleanups" (Zenghui Yu): Clean up a collection of small DAMON rough edges in the core, interfaces and tests. No large behavior change here, just simpler code and fewer opportunities for confusion. - "mm/damon: cleanup code, add test cases, and update guidances in docs" (SJ Park): Clean up DAMON's core and interfaces, add missing test cases and bring the documentation into line with the code. These changes should make the newer facilities easier to understand and maintain. - "mm/damon: introduce hugepage_size probe filter" (SJ Park): Add a DAMON probe filter for hugepage size. Let users select a range of folio sizes through sysfs, validate the range and document the new interface, so monitoring can concentrate on memory backed by the desired hugepage sizes. - "selftests/mm: pagemap_ioctl test fixes and cleanups" (Zenghui Yu): Fix some pagemap ioctl test assumptions and clean up their setup and reporting. Make failures point to the operation that went wrong rather than to test harness bookkeeping. - "mm: avoid large folio splits when swap is unavailable" (Johannes Weiner): Avoid splitting large folios merely to attempt swap when no swap space is available. There is little point paying for an expensive split when reclaim cannot actually swap the resulting pages out. - "mm: workingset: fix the shadow node budget under MGLRU" (Hui Zhu): Fix the workingset shadow-node budget with MGLRU enabled. Keep the shadow entries within the intended limits so refault tracking does not quietly consume more metadata than it should. - "selftests/mm: TAP output and global-state fixes" (Song Hu): Fix selftests which produce misleading TAP output or fail to restore global settings after a run. A test ought to leave the system as it found it, particularly when a whole suite follows behind. - "mm: remove page_swap_entry()" (Tal Zussman): Remove page_swap_entry() and convert its remaining users to the folio and swap-entry helpers. Lose an old page-level interface and make the swap paths a little more consistent. - "mm: refactor zonelist constructors and iterators" (Gregory Price): Refactor the zonelist construction and walk helpers to reduce duplicated logic. Keep the allocation ordering rules intact while making it clearer how zones are selected. - "mm: kmemleak: batch the struct page scan" (Breno Leitao): Scan adjacent struct pages in batches instead of taking kmemleak_lock once for every single page. This preserves scan coverage and the lock-hold bound, while cutting overhead substantially on debug kernels. - "mm/damon: misc improvements in tests and documents" (Zenghui Yu): Fix some DAMON selftests which leave kdamond running or fail under Python safe-path mode, and improve the KUnit coverage and documentation. Nothing especially glamorous, but these are worth doing. - "mm/damon: introduce probe_hits_wsum DAMOS core filter" (SJ Park): Add a DAMOS core filter using weighted probe-hit counts. This gives schemes another way to select regions based on what the monitoring probes observed. - "mm/mglru: fix ineffective memory protection for non-kswapd reclaim" (Ridong Chen): Fix MGLRU's memory protection handling for reclaim outside kswapd. The protection settings weren't having the intended effect in these paths, leaving protected memory more exposed than requested. - "mm/damon: improve readability, clarity and test coverage" (SJ Park): Simplify a handful of DAMON core helpers, clarify their behavior and expand test coverage. There are no intended userspace-visible changes in this batch. - "mm: replace PF_KCOMPACTD/PF_KSWAPD with kthread_func()" (Kefeng Wang): Stop identifying reclaim and compaction workers through the PF_KSWAPD and PF_KCOMPACTD task flags. Use their kthread functions instead and remove the redundant flag plumbing. - "mm/hugetlb: fix surplus accounting and availability checks during demotion" (Longlong Xia): Fix HugeTLB surplus accounting and availability checks when demoting huge pages. Keep the counters and reservation decisions consistent as one huge page turns into several smaller ones. - "mm/damon: add kunit tests for probe_hits handling and probe params validation" (Jason Angelov): Add KUnit tests for DAMON probe-hit handling and invalid probe parameters. These cover edge cases that were too easy to miss in ordinary monitoring tests. - "mm/damon: fix misc bugs in kunit, quota goals and sysfs refresh_ms" (SJ Park): Fix a few DAMON bugs in KUnit tests, quota-goal handling and the sysfs refresh interval. Small fixes, but the incorrect results and control behavior were real. - "mm: zswap: optimize zswap invalidate and store" (Kefeng Wang): Simplify zswap's invalidate and store paths to avoid avoidable lookups and work. Keep the entry lifetime rules intact while making those frequent operations cheaper. - "mm: replace custom ratelimiting logic" (Pedro Falcato): Replace hand-rolled MM rate limiting with the common kernel helpers. There is no need to maintain another local version of the same mechanism. - "mm/vmalloc: minor cleanups" (Ye Liu): Tidy some vmalloc initialization and reporting code, and pull duplicated vmap-area insertion work into a helper. No functional changes are intended. - "mm/mglru: clean up isolate_folios for readability and clarity" (Ridong Chen): Clean up MGLRU's isolate_folios() so the decisions are easier to read and verify. Keep reclaim behavior unchanged while removing unnecessary twists in the control flow. - "Catch automatic storage in IDA and Maple Tree definitions" (Yury Norov): Catch IDA and maple-tree definitions placed in automatic storage where the lifetime rules are wrong or easy to get wrong. Add checks so such mistakes are harder to slip through unnoticed. - "mm, swap: some random fixes and cleanups" (Kemeng Shi): Fix and simplify a few unrelated swap paths, removing redundant work and tidying up error handling. A small collection of things which were better fixed than left lying around. - "mm/page_io: folio conversion cleanups" (Tal Zussman): Finish some page-to-folio conversions in swap I/O, removing obsolete wrappers and using folio operations consistently. The I/O behavior is intended to remain the same. - "mm/swap: skip empty clusters in the swapoff scan" (Youngjun Park): Skip empty swap clusters during swapoff instead of walking slots which have nothing to release. This avoids pointless work on sparsely used swap devices. - "mm: trace: decode architecture-specific VMA flags" (Meijing Zhao): Teach the VMA trace output to decode architecture-specific flags, rather than leaving them as unexplained bits. That should make tracing a good deal more useful when debugging unusual mappings. - "mm, swap: don't spin on a bad swap entry" (Breno Leitao): Stop repeatedly retrying a swap entry which is already known to be bad. Make the error path terminate cleanly instead of wasting CPU chasing an entry that cannot be used. - "mm/page_isolation: fix UBSAN shift-out-of-bounds in isolate_single_pageblock" (Qi Xi): Fix an out-of-range shift in isolate_single_pageblock() and tighten its associated boundary handling. UBSAN found the issue; the result should be more robust pageblock isolation. - "mm: khugepaged: fix tracepoint UAF" (Vernon Yang): Fix a use-after-free in khugepaged tracepoint handling. Make sure the information recorded by tracing stays valid for as long as the trace event needs it. - "mm/damon: fix DAMOS bugs in core, paddr and vaddr" (SJ Park): Fix several DAMOS problems across the core and physical- and virtual-address backends. The changes close error cases and bring the implementations back into agreement. - "mm/hugetlb_cgroup: move the per-node usage along with the folio" (Hongfu Li): Move HugeTLB per-node usage accounting when folios migrate between nodes or are reparented to another cgroup. Otherwise numa_stat can retain stale charges and even underflow when the folio is freed. - "docs/core-api: memory-allocation: add k[mz]alloc_obj() and clarify kmalloc" (Mike Rapoport): Document the typed k[mz]alloc_obj() allocation helpers and clear up some kmalloc guidance. Make it easier for callers to choose the right interface. - "selftests/mm: Validate selections and scope memfd_secret setup" (Tianyi Chen): Check selftest selections before running and confine memfd_secret setup to the cases that actually need it. Avoid confusing failures caused by the test harness itself. - "mm/damon: move zero damos quota target_value handling to the core layer" (SJ Park): Handle a zero DAMOS quota goal target in the core rather than making each user of the interface invent its own rule. Keep quota decisions consistent across callers. - "mm/damon: Introduce a huge page collapsing mechanism using auto tuning" (Asier Gutierrez): Add an auto-tuned DAMON mechanism for collapsing huge pages. Use monitoring feedback to decide when collapse is worthwhile rather than forcing one fixed policy onto every workload. - "kmemleak: fix stale documentation and raise the verbose default" (Breno Leitao): Bring the kmemleak documentation up to date and require a third confirming scan before verbose kernels print a suspected leak. The extra scan helps suppress transient false positives in noisy debug builds. - "mm/memory: improve insert_pages() error handling" (Avi Weiss): Tighten insert_pages() error handling so partial failures are reported and cleaned up consistently. The caller should not have to guess how far the operation got. - "mm/damon: allow NULL or unstarted damon_ctx parameter for damon_call()" (SJ Park): Make damon_call() handle NULL and not-yet-started contexts safely. Simplify the rules for callers and avoid an indefinite wait on an invalid state. - "mm/damon: introduce pgidle_set probe filter type" (SJ Park): Add a pgidle_set DAMON probe filter, giving monitoring users another way to select pages by their idle-tracking state. Wire it through the filter interfaces and tests. - "mm/damon/core: remove unused helper functions" (Cheng-Han Wu): Remove DAMON core helpers which no longer have callers. Keep the API surface smaller rather than retaining dead code just in case. - "mm: stop calling pmd_folio() on special PMDs" (Gregory Price): Avoid calling pmd_folio() on special PMD mappings that have no struct page. The old assumption could fault in procfs walkers; use the normal-folio checks and handle those mappings properly. - "mm: remove three unused helpers from mm.h" (Tal Zussman): Remove three unused helpers from mm.h. Fewer obsolete interfaces for the next person to stumble over. - "mm/damon: improvements in efficiency, error handling, documents" (Liew Rui Yan): Skip needless DAMOS quota work once the quota is full, propagate a missing sysfs error and tidy a couple of comments. The ignored error could make a monitoring-start request appear successful when it wasn't. - "docs/mm/damon/design: add explanation of nr_snapshots" (Liew Rui Yan): Explain DAMON's nr_snapshots accounting in the design documentation and straighten out the associated terminology. Make it clearer what users should expect from that counter. - "selftests/cgroup: fixes for test_zswap on single core VM" (Wilson Felipe Pereira): Fix two test_zswap failures on single-CPU VMs. Wait for the exiting child's cgroup to become unpopulated before reconfiguring it, and avoid another test assumption which breaks under constrained scheduling. - "docs/ksm: fix advisor documentation and comment" (Jinjiang Tu): Correct the KSM advisor documentation and a misleading code comment. Keep the description aligned with how the advisor actually works. - "Fix bugs in HugeTLB allocation when mem_cgroup_charge_hugetlb() fails" (Ackerley Tng): Fix HugeTLB allocation cleanup when the memcg charge fails. Make sure failure exits undo what was allocated rather than leaving stale accounting or resources behind. - "mm, memcg: fix memory.peak reset clobbering other fds' watermark" (Ridong Chen): Fix memory.peak reset handling so resetting one file descriptor doesn't overwrite the watermark kept for another. Keep those per-open measurements independent as intended. - "mm: reject zone device folios in more folio walkers" (Gregory Price): Reject zone-device folios in page walkers that cannot safely handle them. Extend the existing checks rather than assuming every folio has ordinary system-memory backing. - "percpu: remove code with no effect" (Sang-Heon Jeon): Remove a few pieces of percpu code which no longer do anything. There is no reason to keep maintaining dead paths. * tag 'mm-stable-2026-10-19-21-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (539 commits) mm: shmem: assign a lock class to the unused huge shrinklist mm: vmscan: put rotation-missed folios at the LRU tail mm: kmemleak: scan the struct page array in MAX_SCAN_SIZE batches mm: kmemleak: move the struct page scan into a helper mm/damon: document that a zero sample_interval is accepted mm/damon: fix typos in comments mm/damon/sysfs: propagate damon_call() error in turn_damon_on mm/damon/core: skip quota score setup when the quota is full mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region mm/damon/core: charge only the part of a region the filter left mm: disallow raw PFN mappings of huge/shared zeropage selftests/mm: zap whole PTE tables in the khugepaged race harness selftests/mm: add memory-pressure threads to the khugepaged race harness selftests/mm: race the collapse of windows with holes selftests/mm: add khugepaged race harness selftests/mm: check that one khugepaged pass collapses one window selftests/mm: run every supported collapse order by default selftests/mm: cover a shared-source collapse write race selftests/mm: parameterize the mixed-source collapse case by source order selftests/mm: add order-parameterized khugepaged collapse cases ...
9 daysMerge branch 'for-7.4/amd_sfh' into for-linusJiri Kosina
- support for newer AMD SoCs (Basavaraj Natikar) - sysfs attributes of operating-mode telemetry (Basavaraj Natikar)
9 daysMerge branch 'for-7.4/apple' into for-linusJiri Kosina
- power management fix for Apple Touch Bar (Andre Eikmeyer) - fix for trackpad hanling on T2 Macs (Aditya Garg)
9 daysMerge branch 'for-7.4/asus' into for-linusJiri Kosina
- SG Mobile LED support (Denis Benato) - power management fix for ROG Ally (Deni Benato) - asus_work() hardening (Denis Benato) - fix for invalid keyboard feature reports being sent on ASUS laptops with I2C/HID touchpads (Panz Dev)
10 daysMerge branch 'for-7.4/core' into for-linusJiri Kosina
- OOB fix in s32ton() (Alan Stern) - switch to named initializers for acpi_device_id (Pawel Zalewski) - UAF fix in hiddev (Yousef Alhouseen)
10 daysMerge branch 'for-7.4/i2c-hid' into for-linusJiri Kosina
- power management fix for i2c-hid, removing bus timeout from every reboot (Justin Yeh)
10 daysMerge branch 'for-7.4/intel-thc-hid' into for-linusJiri Kosina
- conversion of intel-thc-hid to hid_safe_input_report() (Even Xu)
10 daysMerge branch 'for-7.4/lenovo' into for-linusJiri Kosina
- various functionality fixes and code cleanups of lenovo-go-s driver (Derek J. Clark)
10 daysMerge branch 'for-7.4/nintendo' into for-linusJiri Kosina
- support for Switch 2 controller (Vicki Pfau) - support for PDP Afterglow controller (Aiman Najjar)
10 daysMerge branch 'for-7.4/pulsar' into for-linusJiri Kosina
10 daysMerge branch 'for-7.4/roccat' into for-linusJiri Kosina
- fixed handling of short reports (Jiale Yao)
10 daysMerge branch 'for-7.4/wacom' into for-linusJiri Kosina
- UAF fixes (Lee Jones) - SW_MUTE_DEVICE semantics fix (Lee Jones, Ping Cheng)
10 daysMerge branch 'for-7.4/wiimote' into for-linusJiri Kosina
- switch to scoped_guard (Rafael Passos) - LED-indicated controller ID support (Rafael Passos)
12 daysHID: nintendo: introduce dependency in USB_HIDJiri Kosina
hid-nintendo does depend on USB_HID. Reflect that in Kconfig. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202610171559.gZ0QBMFv-lkp@intel.com/ Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: asus: add keyboard dock of the ASUS Transformer Book T302CHI device IDJiri Kosina
synonym reports: "The dock (USB 0b05:182f) reports brightness on the ASUS vendor usage page 0xff31, usages 0x10 and 0x20, which hid-asus already maps to KEY_BRIGHTNESSDOWN / KEY_BRIGHTNESSUP. Because the device is not in asus_devices[], it is claimed by hid-generic, which ignores the vendor page entirely, so Fn+F5 and Fn+F6 produce no input events at all - not even a scancode. Keys on the standard consumer page (volume) on the same device work fine, which makes this look like a backlight or ACPI problem rather than a HID one." Add the device ID. Reported-by: synonym <20000l@pm.me> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: wacom: fix wacom_intuos_irq NULL pen_input derefMatheus Alves de Almeida
Currently, wacom_intuos_irq() passes the parent of wacom_wac's pen_input to the dev_dbg() in the unknown report path. However, pen_input can be NULL on interfaces without a pen, causing a NULL pointer dereference. Get the HID device from the enclosing struct wacom and use hid_dbg() instead. Fixes: eb71d1bb270e ("Input: wacom - use dev_xxx() instead of naked printk()s and dbg()s") Reported-by: syzbot+b5a7cd83622c747977de@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5a7cd83622c747977de Signed-off-by: Matheus Alves de Almeida <matheus.aalmeida@inf.ufrgs.br> Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: hid-lenovo-go-s: Use devm_kzalloc for drvdataDerek J. Clark
Changes drvdata from static global to devm allocation per device. Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver") Cc: stable@vger.kernel.org Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: hid-lenovo-go-s: Move static led_classdev_mc to drvdata structDerek J. Clark
In the next patch I will switch drvdata from static global to a devm_kzalloc struct. In preparation for that, move the led_classdev_mc to be a member of the gos_cfg_drvdata struct. As part of that effort, provide a constant name when accessing it and access the led_classdev through the led_classdev_mc. Fixes: be6d7dbb368ba840d7 ("HID: hid-lenovo-go-s: Add RGB LED control interface") Cc: stable@vger.kernel.org Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: hid-lenovo-go-s: Reorganize and rename hid_gos_cfgDerek J. Clark
Renames hid_gos_cfg struct to gos_cfg_drvdata in preparation for later fixes. This is a prerequisite for later fixes. No functional change intended. Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver") Cc: stable@vger.kernel.org Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: hid-lenovo-go-s: Move attribute init to after device queryDerek J. Clark
Currently this driver registers attributes before the MCU is ready to accept commands. This can lead to attribute access that blocks the MCU in some rare cases. Move attribute construction to gos_cfg_setup, after the device has been queried. Gate creation to drvdata.gp_registered and drvdata.rgb_registered so a resume before setup has run doesn't prevent attribute creation or attempt to re-register the same attributes. Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver") Cc: stable@vger.kernel.org Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: hid-lenovo-go-s: Add suspend function and gate access under bool.Derek J. Clark
Currently a device can suspend while delayed work is pending or executing. Cancel delayed work if it was pending and restart it if it hasn't run yet. Gate access to show/store functions behind a bool to prevent access prior to cfg_setup() being completed. Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver") Cc: stable@vger.kernel.org Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: hid-lenovo-go-s: Add kobject_uevent notify during reset-resumeDerek J. Clark
Adds kobject_uevent notification after setting os_mode attribute on resume. Fixes: 3524900cc571bd922a ("HID: hid-lenovo-go-s: restore OS_TYPE after resume from s2idle") Cc: stable@vger.kernel.org Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: hid-lenovo-go-s: Use pm_ptr for reset_resume callbackDerek J. Clark
Adds missing pm_ptr to the .reset_resume callback for hid-lenovo-go-s Fixes: 3524900cc571bd922a ("HID: hid-lenovo-go-s: restore OS_TYPE after resume from s2idle") Cc: stable@vger.kernel.org Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: hid-lenovo-go-s: Prevent deadlock if device removed during setupDerek J. Clark
hid_gos_cfg_remove() calls a mutex before canceling delayed work. That delayed work function calls mcu_property_out(), which holds the same mutex. Prevent deadlock my removing the mutex prior to stopping the work. Additionally, since cancel_delayed_work has the potential to re-arm, switch to disable_delayed_work. Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver") Cc: stable@vger.kernel.org Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: hid-lenovo-go-s: Bound stale reply window before reusing send_cmd_completeDerek J. Clark
mcu_property_out() reinits send_cmd_complete immediately after a timeout is detected, before the next command that reuses it is sent. If the MCU's reply to the timed-out command arrives after this reinit but before the next command's wait begins, it silently satisfies the next, unrelated command's wait instead of the one it actually answers, handing that caller stale data with no way to detect the mismatch. Track when a command has timed out via cmd_orphaned. Before the next command reuses the completion, wait a bounded 25ms for a stale reply to arrive and be consumed, then unconditionally clear the flag and reinit the completion. This does not fully eliminate the window in which an unrelated reply could still be received, but bounds it to a short interval right before a new command is sent. Behavior matches the solution to the same problem in hid-msi. Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver") Cc: stable@vger.kernel.org Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: hid-lenovo-go-s: Return ret instead of 0 in mcu_property_out()Derek J. Clark
Currently mcu_property_out() blanket returns 0, discarding the ret value and any errors with it. Wait completion returns a positive value when it is not timed out, which would error on all successes, so if it is positive return the ret value from the raw event handler. Only if it is 0 set it to -EBUSY, otherwise pass the actual error. Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver") Cc: stable@vger.kernel.org Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: logitech-hidpp: cancel reset_hi_res_work on probe failureDmitriy Geels
The probe error path cancels hidpp->work before freeing the HID++ device data, but does not cancel reset_hi_res_work. reset_hi_res_work can be scheduled while probing the device. If probe subsequently fails, the work can run after the driver data has been freed. Cancel reset_hi_res_work in the probe error path to prevent a potential use-after-free. Fixes: ed80cc4667ac ("HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL") Signed-off-by: Dmitriy Geels <dmitriy.geels@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: apple: ignore the trackpad on T2 MacsAditya Garg
The trackpad on T2 Macs is incorrectly bound by the hid-apple driver. This is due to both trackpad and keyboard sharing the same VID/PID. Use the existing APPLE_IGNORE_MOUSE quirk for the same. Signed-off-by: Aditya Garg <aditya.garg@linux.dev> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: usbhid: skip interrupt IN polling for devices with no input reportsAhmed Yaseen
usbhid starts polling a device's interrupt IN endpoint on open (usbhid_open() -> hid_start_in()). If the report descriptor declares no input reports there is nothing to read there, so the poll is useless, and on some composite devices it is also harmful. The ASUS ROG N-Key keyboards expose a second, input-less interface used only for RGB control via feature reports. Opening its hidraw node (any hidraw reader does, including SDL/Steam Input or a plain cat) starts the pointless IN poll and keypress reports on the keyboard interface get dropped for as long as the node stays open: a lost key-down drops a letter, a lost key-up leaves the key stuck. usbmon shows the dropped reports never reach the URB layer. The useless poll itself is long-standing; commit 4ac74ea68f64 ("HID: asus: early return for ROG devices") is what exposes it on these devices by keeping the input-less interface alive instead of ejecting it, so its hidraw node can be opened and the poll started. Skip the poll in usbhid_open() when the device has no input reports. Feature reports and hidraw output keep working over the control and OUT endpoints, so the interface is otherwise unaffected. Fixes: 4ac74ea68f64 ("HID: asus: early return for ROG devices") Link: https://discuss.cachyos.org/t/keyboard-input-issues-on-asus-rog-strix-16-2025-with-cachyos-during-gaming/30823 Link: https://github.com/ublue-os/bazzite/issues/4590 Cc: stable@vger.kernel.org Tested-by: Kerim Kabirov <the.privat33r+linux@pm.me> Tested-by: GameBurrow <gameburrow@pm.me> Signed-off-by: Ahmed Yaseen <yaseen@ghoul.dev> Reviewed-by: Denis Benato <denis.benato@linux.dev> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: mcp2221: always initialize and cancel init_workMyeonghun Pak
The writable gpio_mode_enforce parameter can change between probe and remove. If it changes from false to true after probe, remove skips cancellation of init_work. Pending or running work can then access devm-managed driver state after teardown. Changing it from true to false can make remove cancel an uninitialized delayed work item. Initialize init_work whenever IIO is reachable and cancel it unconditionally on remove. Keep the parameter check only for scheduling the initialization. The false-to-true cancellation gap was previously reported by Sashiko. We also encountered this issue during our static-analysis research. Fixes: 200e6c6e94fa ("HID: mcp2221: Add module parameter to enfoce GPIO mode") Reported-by: Sashiko <sashiko-bot@kernel.org> Link: https://lore.kernel.org/linux-input/20260715143415.916A21F00A3A@smtp.kernel.org/ Assisted-by: LLM Cc: stable@vger.kernel.org Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: magicmouse: fix null pointer dereference in magicmouse_event()Nehuen Lian Bova
Add a guard clause to check if 'msc' and 'msc->input' is NULL before attempting to access its fields, preventing a general protection fault. Fixes: b8d56ef91cc3 ("HID: magicmouse: Apple Magic Mouse 2 USB-C support") Reported-by: syzbot+5ad4fc9c8360b68e353f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5ad4fc9c8360b68e353f Signed-off-by: Nehuen Lian Bova <nehuenlian.kernel@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: core: Fix out-of-bounds left shift by 32 in s32ton()Alan Stern
Syzbot reported an out-of-bounds shift (32-bit integer shifted left by 32) in the s32ton() routine in the HID core. This routine converts a signed 32-bit integer to a signed n-bit integer, and it caps the value of n at 32. But when n == 32 there's no need to do anything; it can simply return the input value. This will avoid calculating (1 << n) when n is 32, which was the cause of the invalid shift. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Fixes: 69c02ffde6ed ("HID: core: clamp report_size in s32ton() to avoid undefined shift") Reported-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/6ac9cbd8.a150a118.27e199.0025.GAE@google.com/ Tested-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Link: https://patch.msgid.link/dfa0aa1c-e55e-4316-8307-f72a07383634@rowland.harvard.edu Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2026-10-16HID: asus: add support for xgm ledDenis Benato
XG mobile stations have very bright leds behind the fan that can be turned either ON or OFF: add a cled interface to allow controlling the brightness of those red leds. Let the led core manage the power transitions: the classdev is flagged with LED_CORE_SUSPENDRESUME, so it is switched off at suspend and its last brightness is restored at resume. The EC drives its own blinking pattern during s2idle anyway, so the led state while the machine is asleep is not meaningful. Signed-off-by: Denis Benato <denis.benato@linux.dev> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: asus: reinitialize the device after exiting a sleep stateDenis Benato
The ROG ally needs to have the EC string sent back after resuming from s2idle since the USB device can be turned completely off by the firmware when mcu_powersave firmware-attribute is set to 1. This may also be true for other laptops and certain features might stop working after the device exit from sleep. Assisted-by: opencode:glm-5.2 Signed-off-by: Denis Benato <denis.benato@linux.dev> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: asus: document and harden the worker teardownDenis Benato
asus_work() executes actions against the device: they send feature reports with hid_hw_raw_request() and, for the Fn+F5 fan key fallback, re-inject the raw report into the HID core with hid_report_raw_event(). For this reason the worker must be quiesced before hid_hw_stop(): after the low level driver has stopped, the transport is gone (usbhid_stop() frees the URBs and the I/O buffers) and re-injected reports would race against the input devices being unregistered by hid_disconnect(). Make so that the teardown cannot race to a use-after-free: every site queueing an action holds worker->lock across the .removed check, the list insertion and schedule_work(), and asus_worker_stop() sets .removed and drains the queue under that same lock before calling cancel_work_sync(). An action that passed the check is caught by the latter while any later attempt is discarded by asus_worker_schedule(). Closes: https://lore.kernel.org/all/20260908180032.34C2D1F00A3A@smtp.kernel.org/ Fixes: 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") Assisted-by: zcode:glm-5.3-flash Signed-off-by: Denis Benato <denis.benato@linux.dev> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: zydacron: validate key report lengthJiale Yao
The HID core invokes raw_event callbacks before validating the report length. zc_raw_event() verifies the report ID in byte zero and then reads the key code from byte one for report IDs 0x02 and 0x03 without checking that the second byte is present. A one-byte report reproduced the issue under KASAN: BUG: KASAN: slab-out-of-bounds in zc_raw_event+0x54c/0x580 Read of size 1 by task hidtrigger/93 Call Trace: zc_raw_event+0x54c/0x580 __hid_input_report+0x2ef/0x3a0 inject_store+0x479/0x490 [faketrans] Require both the report ID and key code before processing the report. Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") added the same kind of raw_event length validation to hid-asus. Fixes: d0742abaa1c3 ("HID: add omitted hid-zydacron.c file") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: pxrc: reject short input reportsJiale Yao
The HID core invokes raw_event callbacks before validating the report length. pxrc_raw_event() reads byte seven and writes bytes one and seven without checking that the report contains those bytes. A one-byte input report reproduced the first invalid access under KASAN: BUG: KASAN: slab-out-of-bounds in pxrc_raw_event+0x161/0x260 Read of size 1 by task hidtrigger/90 Call Trace: pxrc_raw_event+0x161/0x260 kasan_report+0x139/0x170 Require all eight bytes before reading or rewriting the report. Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") added the same kind of raw_event length validation to hid-asus. Fixes: acc3e34613da ("HID: Add driver for PhoenixRC Flight Controller") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: prodikeys: validate fixed-format MIDI reportsJiale Yao
The HID core invokes raw_event callbacks before validating the report length. Prodikeys reports 0x01 and 0x04 are passed to handlers that always read bytes one through three, regardless of the supplied size. A truncated report can therefore cause an out-of-bounds read. Require four bytes for the two fixed-format reports. Keep report 0x03 on its existing variable-length path, which derives the number of note pairs from size and only accesses complete pairs. Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") added the same kind of raw_event length validation to hid-asus. Fixes: 3a370ca1dcf8 ("HID: Prodikeys PC-MIDI HID Driver") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: mcp2221: validate response report lengthJiale Yao
MCP2221 responses are 64-byte reports, but mcp2221_raw_event() currently accepts any report of at least four bytes. Several response handlers read far beyond that minimum. In particular, the I2C status response reads offset 20 and copies ADC samples starting at offset 50. Other GPIO, SRAM, and flash response handlers also access fixed offsets beyond byte three. The HID core invokes raw_event callbacks before validating the report length, so a truncated response can cause an out-of-bounds read. Require a complete protocol report before dispatching any response handler. Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") added the same kind of raw_event length validation to hid-asus. Fixes: 67a95c21463d ("HID: mcp2221: add usb to i2c-smbus host bridge") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: mcp2200: validate READ_ALL response lengthJiale Yao
The HID core invokes raw_event callbacks before validating the report length. mcp2200_raw_event() casts a READ_ALL response to struct mcp_read_all_resp and reads fields through offset ten without checking that the response contains the structure. A one-byte READ_ALL response reproduced the issue under KASAN: BUG: KASAN: slab-out-of-bounds in mcp2200_raw_event+0x24b/0x3a0 Read of size 1 by task hidtrigger/89 Call Trace: mcp2200_raw_event+0x24b/0x3a0 kasan_report+0x139/0x170 Reject an incomplete READ_ALL response with a protocol error before reading its fields. The common completion path then wakes the command waiter with the error instead of leaving it to time out. Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") added the same kind of raw_event length validation to hid-asus. Fixes: 740329d7120f ("HID: mcp2200: added driver for GPIOs of MCP2200") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: logitech-dj: validate unnumbered keyboard reportsJiale Yao
The HID core invokes raw_event callbacks before validating the report length. For an unnumbered keyboard report, logi_dj_raw_event() uses the second byte as temporary storage while prepending a report ID. A one-byte report therefore makes both the initial write and the later restoration access data beyond the received report. Reject unnumbered keyboard reports that do not provide the temporary byte. Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") added the same kind of raw_event length validation to hid-asus. Fixes: 74808f9115ce ("HID: logitech-dj: add support for non unifying receivers") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: elo: reject short touchscreen reportsJiale Yao
The HID core invokes raw_event callbacks before validating the report length. elo_raw_event() only checks the first-byte packet marker before elo_process_data() reads coordinates, flags, and pressure through offset seven. A truncated packet beginning with the expected marker can therefore cause an out-of-bounds read. Require the complete eight-byte SmartSet packet before parsing it. Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") added the same kind of raw_event length validation to hid-asus. Fixes: d23efc19478a ("HID: add driver for ELO 4000/4500") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: cp2112: validate response report lengthsJiale Yao
The HID core invokes raw_event callbacks before validating the report length. cp2112_raw_event() reads every field of a transfer status response without checking size. For a data response, it reads the length at offset two and copies that many bytes from offset three, again without ensuring that the input report contains them. Require a complete transfer status structure. For data responses, first require the header and then ensure the clamped payload length fits in the received report before copying it. Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") added the same kind of raw_event length validation to hid-asus. Fixes: e932d8178667 ("HID: add hid-cp2112 driver") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: cougar: reject short special-key reportsJiale Yao
The HID core invokes raw_event callbacks before validating the report length. cougar_raw_event() reads the key code and action from offsets one and two without checking that those bytes are present. A short report on the special interface can therefore cause an out-of-bounds read. Consume reports that do not contain the action field before accessing the fixed offsets, consistent with the callback's handling of other reports on the special interface. Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") added the same kind of raw_event length validation to hid-asus. Fixes: b8e759b8f6da ("HID: cougar: Add support for the Cougar 500k Gaming Keyboard") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: Kysona: Add support for Kysona M600V2 variantTjark Effenberger
The M600V2 has a different HID ID on the wireless dongle. Signed-off-by: Tjark Effenberger <mail@teffenberger.de> Tested-by: Iwan Schadrin <schadrin0108@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: apple: Add GANSS GS3104T PRO to the non-Apple keyboard listDemonPlayer
The GANSS GS3104T PRO is a tri-mode mechanical keyboard that reports Apple's vendor and product IDs (05ac:024f) over USB, over its 2.4 GHz receiver and over Bluetooth, so that macOS recognises it without a vendor driver. hid->name is built from the product string only and it differs per connection mode: USB: "HFD GS3104T PRO" (iManufacturer is "HFD") 2.4 GHz: "GS3104T-PRO 2.4G" (no iManufacturer) Bluetooth: "GS3104T PRO" All three descriptors carry the Apple Fn key usage (Usage Page 0xFF00, Usage 0x03), so hid-apple claims the device in every mode and applies the Apple function key layout: with the default fnmode=3, hidinput_apple_event() resolves real_fnmode to 1 (fkeyslast), so the F-row sends the media keys and Fn has to be held down to get F1-F12. That is not the behaviour the keyboard has on other operating systems. hid-apple already keeps a list of such keyboards and switches them to the fnmode=2 (fkeysfirst) behaviour, but the match is a case-sensitive strncmp() prefix test against hid->name and none of the three names matches an existing entry: the "GANSS" one misses because the brand does not appear in any of the descriptors, and "hfd.cn" does not match either. The non-Apple handling is thus never enabled and users have to pass hid_apple.fnmode=2 on the kernel command line to get the expected default. Add all three names to non_apple_keyboards[]. Signed-off-by: DemonPlayer <a18165943161@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: add ALWAYS_POLL quirk for YJX-CHIP EWEADN wireless receiversLiang Haowen
The 2.4 GHz receiver in EWEADN G5 wireless mice (YJX-CHIP A8A5:2255) presents its mouse data on a standard interrupt IN endpoint. usbhid only submits read URBs for an input device while a userspace consumer holds it open, so on boot or replug the mouse pointer stays dead until something opens the node. The same receiver ships with a number of other EWEADN models (A6, A7, E7, E9, E11, G2SE A, GS02 Pro, S7, S9SE, X23), so the quirk covers the whole family. Cc: Jiri Kosina <jikos@kernel.org> Cc: Benjamin Tissoires <bentiss@kernel.org> Cc: linux-input@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Liang Haowen <nbg2974@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: quirks: Always poll the Anne Pro 2 with product ID a292Gabor Tanz
The wired Anne Pro 2 identifying as 04d9:a292 stops delivering keyboard input after a period of inactivity. Unplugging and reconnecting the keyboard restores input. Keeping ObinsKit running prevents the problem. A read-only userspace reader that keeps USB HID interface 1 open also prevents it, as does usbhid.quirks=0x04d9:0xa292:0x00000400 without either application running. Commit ca28aff0e1dc ("HID: quirks: Always poll Obins Anne Pro 2 keyboard") added HID_QUIRK_ALWAYS_POLL for product ID a293. The variant identifying as 04d9:a292 exhibits the same symptom. Apply the quirk to this product ID as well. Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Gabor Tanz <gabor.tanz@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-10-16HID: wacom: Setup SW_MUTE_DEVICE according to the order of input registrationPing Cheng
The refactored SW_MUTE_DEVICE code assumed that stylus will be the first regiestered input. In reality, touch can be registered before stylus, such as the Wacom Cintiq Pro 13 and 16. This patch covers both touch-first and stylus-first cases. Cc: stable@vger.kernel.org Fixes: ba16e5ffbaa1 ("HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration") Reviewed-by: Lee Jones <lee@kernel.org> Signed-off-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>