[PATCH] HID: multitouch: keep MT_IO_FLAGS_RUNNING inside the flags word

[PATCH] HID: multitouch: keep MT_IO_FLAGS_RUNNING inside the flags word

[Aldo Ariel Panzardo]

MT_IO_FLAGS_RUNNING is bit 32 of td->mt_io_flags, which is a single
unsigned long. On 32-bit architectures a long is 32 bits wide, so the
valid bit indices are 0-31 and bit 32 falls in the next word. Both users
take and release the flag with atomic bitops:

    test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
    clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);

so on a 32-bit build every report and every sticky-finger timer expiry
reads and writes the four bytes that follow mt_io_flags in struct
mt_device -- inputmode_value, maxcontacts and the is_* flags -- instead
of the flags word itself.

Before commit 46f781e0d151 ("HID: multitouch: fix sticky fingers") the
flag was bit 0 and the word only had to hold three flags. That commit
reserved the low eight bits for per-slot state (MT_IO_SLOTS_MASK) and
moved the flag out to bit 32, one word too far on 32-bit builds.

Put it at MT_IO_SLOTS_BITS, the first bit above the reserved slot range.
The value is only ever used as a bit index, so nothing else has to
change.

Fixes: 46f781e0d151 ("HID: multitouch: fix sticky fingers")
Cc: stable@vger.kernel.org
Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260723224211.613112-1-you@example.com?part=1
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
This applies on top of "HID: multitouch: bound the slot index before
touching mt_io_flags", which introduces MT_IO_SLOTS_BITS. The two are
separate defects with the same Fixes: tag, so they should backport
together.

 drivers/hid/hid-multitouch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index a75c821f7758..e7d811ed4123 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -99,7 +99,7 @@ enum report_mode {
 
 #define MT_IO_SLOTS_MASK		GENMASK(7, 0) /* reserve first 8 bits for slot tracking */
 #define MT_IO_SLOTS_BITS		8 /* bits covered by MT_IO_SLOTS_MASK */
-#define MT_IO_FLAGS_RUNNING		32
+#define MT_IO_FLAGS_RUNNING		MT_IO_SLOTS_BITS
 
 static const bool mtrue = true;		/* default for true */
 static const bool mfalse;		/* default for false */
-- 
2.43.0