[PATCH 1/2] input: fix typos in comments

[PATCH 1/2] input: fix typos in comments

[Hemanth Selam]

Fix typos in comments, reported by scripts/checkpatch.pl using the
misspelling list in scripts/spelling.txt.  Only touches comments, no code
changes.

Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
---
 drivers/input/keyboard/imx_keypad.c        | 2 +-
 drivers/input/keyboard/pxa27x_keypad.c     | 2 +-
 drivers/input/mouse/elantech.h             | 2 +-
 drivers/input/rmi4/rmi_f54.c               | 2 +-
 drivers/input/touchscreen/exc3000.c        | 2 +-
 drivers/input/touchscreen/usbtouchscreen.c | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/input/keyboard/imx_keypad.c b/drivers/input/keyboard/imx_keypad.c
index ccde60cd6bb3..9e0898588e06 100644
--- a/drivers/input/keyboard/imx_keypad.c
+++ b/drivers/input/keyboard/imx_keypad.c
@@ -396,7 +396,7 @@ static int imx_keypad_open(struct input_dev *dev)
 
 	imx_keypad_config(keypad);
 
-	/* Sanity control, not all the rows must be actived now. */
+	/* Sanity control, not all the rows must be activated now. */
 	if ((readw(keypad->mmio_base + KPDR) & keypad->rows_en_mask) == 0) {
 		dev_err(&dev->dev,
 			"too many keys pressed, control pins initialisation\n");
diff --git a/drivers/input/keyboard/pxa27x_keypad.c b/drivers/input/keyboard/pxa27x_keypad.c
index 4519eecb317b..320021e9d81b 100644
--- a/drivers/input/keyboard/pxa27x_keypad.c
+++ b/drivers/input/keyboard/pxa27x_keypad.c
@@ -522,7 +522,7 @@ static void pxa27x_keypad_config(struct pxa27x_keypad *keypad)
 		direct_key_num = keypad->direct_key_num;
 
 	/*
-	 * Direct keys usage may not start from KP_DKIN0, check the platfrom
+	 * Direct keys usage may not start from KP_DKIN0, check the platform
 	 * mask data to config the specific.
 	 */
 	if (!keypad->direct_key_mask)
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index 571e6ca11d33..a2ab57a11b64 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -57,7 +57,7 @@
 
 /*
  * One hard to find application note states that X axis range is 0 to 576
- * and Y axis range is 0 to 384 for harware version 1.
+ * and Y axis range is 0 to 384 for hardware version 1.
  * Edge fuzz might be necessary because of bezel around the touchpad
  */
 #define ETP_EDGE_FUZZ_V1		32
diff --git a/drivers/input/rmi4/rmi_f54.c b/drivers/input/rmi4/rmi_f54.c
index 6c6cdec7da9e..43a4e262cd2b 100644
--- a/drivers/input/rmi4/rmi_f54.c
+++ b/drivers/input/rmi4/rmi_f54.c
@@ -193,7 +193,7 @@ static int rmi_f54_request_report(struct rmi_function *fn, u8 report_type)
 
 	/*
 	 * Small delay after disabling interrupts to avoid race condition
-	 * in firmare. This value is a bit higher than absolutely necessary.
+	 * in firmware. This value is a bit higher than absolutely necessary.
 	 * Should be removed once issue is resolved in firmware.
 	 */
 	usleep_range(2000, 3000);
diff --git a/drivers/input/touchscreen/exc3000.c b/drivers/input/touchscreen/exc3000.c
index 037bb35238a3..e18e74781c58 100644
--- a/drivers/input/touchscreen/exc3000.c
+++ b/drivers/input/touchscreen/exc3000.c
@@ -406,7 +406,7 @@ static int exc3000_probe(struct i2c_client *client)
 	 * ensures, that the device probe will not fail for temporary issues
 	 * on the bus.  This is not needed for the sysfs calls (userspace
 	 * will receive the error code and can start another query) and
-	 * cannot be done for touch events (but that only means loosing one
+	 * cannot be done for touch events (but that only means losing one
 	 * or two touch events anyways).
 	 */
 	for (retry = 0; retry < 3; retry++) {
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index 0bbacb517c28..81d24f5fbcc4 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -51,7 +51,7 @@ static bool hwcalib_xy;
 module_param(hwcalib_xy, bool, 0644);
 MODULE_PARM_DESC(hwcalib_xy, "If set hw-calibrated X/Y are used if available");
 
-/* device specifc data/functions */
+/* device specific data/functions */
 struct usbtouch_usb;
 struct usbtouch_device_info {
 	int min_xc, max_xc;
-- 
2.48.1

[PATCH 2/2] input: fix repeated words in comments

[Hemanth Selam]

Drop words accidentally written twice, reported by checkpatch.pl as a
possible repeated word.  Only touches comments, no code changes.

Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
---
 drivers/input/mouse/cyapa.c  | 2 +-
 drivers/input/serio/q40kbd.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/input/mouse/cyapa.c b/drivers/input/mouse/cyapa.c
index 47000c30e4d8..96b79796864a 100644
--- a/drivers/input/mouse/cyapa.c
+++ b/drivers/input/mouse/cyapa.c
@@ -1322,7 +1322,7 @@ static int cyapa_probe(struct i2c_client *client)
 
 	/*
 	 * Register the device in the input subsystem when it's operational.
-	 * Otherwise, keep in this driver, so it can be be recovered or updated
+	 * Otherwise, keep in this driver, so it can be recovered or updated
 	 * through the sysfs mode and update_fw interfaces by user or apps.
 	 */
 	if (cyapa->operational) {
diff --git a/drivers/input/serio/q40kbd.c b/drivers/input/serio/q40kbd.c
index 2f553efbe649..7ab4db61e46f 100644
--- a/drivers/input/serio/q40kbd.c
+++ b/drivers/input/serio/q40kbd.c
@@ -72,7 +72,7 @@ static void q40kbd_stop(void)
 
 /*
  * q40kbd_open() is called when a port is open by the higher layer.
- * It allocates the interrupt and enables in in the chip.
+ * It allocates the interrupt and enables in the chip.
  */
 
 static int q40kbd_open(struct serio *port)
-- 
2.48.1

Re: [PATCH 2/2] input: fix repeated words in comments

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:

New issues:
- [Low] The patch incorrectly fixes a typo, resulting in a grammatically incomplete sentence.

Pre-existing issues:
- [High] Repeated firmware updates via sysfs leak `input_dev` structures and devres nodes due to manual unregistration of a devm-managed device without freeing it.
- [High] The `serio->lock` spinlock is accessed uninitialized if an interrupt fires before `serio_register_port()` completes.
- [High] A Use-After-Free can occur on `q40kbd->port` during device removal if a pending interrupt fires before `free_irq()`.
--

commit 45b867db64f6ee078771ef7b8cf723b44cd0fd23
Author: Hemanth Selam <hemanth.selam@gmail.com>

    input: fix repeated words in comments
    
    Drop words accidentally written twice, reported by checkpatch.pl as a
    possible repeated word.  Only touches comments, no code changes.
    
    Assisted-by: Cursor:claude-opus-5
    Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>

[ ... ]

> diff --git a/drivers/input/serio/q40kbd.c b/drivers/input/serio/q40kbd.c
> index 2f553efbe649d..7ab4db61e46fe 100644
> --- a/drivers/input/serio/q40kbd.c
> +++ b/drivers/input/serio/q40kbd.c
> @@ -72,7 +72,7 @@ static void q40kbd_stop(void)
>  
>  /*
>   * q40kbd_open() is called when a port is open by the higher layer.
> - * It allocates the interrupt and enables in in the chip.
> + * It allocates the interrupt and enables in the chip.

[Severity: Low]
Does this typo fix leave the sentence grammatically incomplete? The original
text "enables in in the chip" appears to be a typo for "enables it in the
chip".

>   */
>  
>  static int q40kbd_open(struct serio *port)

[Severity: High]
This is a pre-existing issue, but does cyapa_update_fw_store() leak memory and
devres tracking nodes on every firmware update?

drivers/input/mouse/cyapa.c:cyapa_update_fw_store() {
    ...
    input_unregister_device(cyapa->input);
    cyapa->input = NULL;
    ...
}

Manual unregistration of a devm-allocated device without freeing it leaves the
devres tracking node and memory orphaned. When cyapa_reinitialize() is called,
it allocates a new input device, creating a new devres node.


[Severity: High]
This is a pre-existing issue, but can the serio port spinlock be accessed
uninitialized if an interrupt fires before q40kbd_probe() completes?

drivers/input/serio/q40kbd.c:q40kbd_probe() {
    ...
    error = request_irq(Q40_IRQ_KEYBOARD, q40kbd_interrupt, 0,
                        DRV_NAME, q40kbd);
    ...
    serio_register_port(q40kbd->port);
    ...
}

If an interrupt fires when request_irq() is called, q40kbd_interrupt() will
call serio_interrupt(), which acquires serio->lock. However, the spinlock
isn't initialized until serio_register_port() is called.


[Severity: High]
This is a pre-existing issue, but is there a use-after-free race during
device removal if a pending interrupt fires before the IRQ is freed?

drivers/input/serio/q40kbd.c:q40kbd_remove() {
    ...
    serio_unregister_port(q40kbd->port);
    free_irq(Q40_IRQ_KEYBOARD, q40kbd);
    ...
}

While serio_unregister_port() calls the close method to mask the hardware
interrupt, it does not wait for already-running handlers. If
q40kbd_interrupt() is executing on another CPU, it can dereference
q40kbd->port after it has been freed by serio_unregister_port().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904111911.32224-1-hemanth.selam@gmail.com?part=2

Re: [PATCH 2/2] input: fix repeated words in comments

[Hemanth Selam]

Please drop this patch.  The sashiko bot flagged it and it is right.

  drivers/input/serio/q40kbd.c
    "It allocates the interrupt and enables in in the chip."

My patch deleted one "in" and left "enables in the chip", which has no
object.  Reading the function, what it enables is the keyboard interrupt,
so the comment should say "enables it in the chip" - a different fix from
the one I sent.

I will send that as a separate patch if you would like it; otherwise
please just drop this one.