* [PATCH AUTOSEL 6.18-6.1] HID: bpf: Add Huion Inspiroy Frego M button quirk
[not found] <20260831133314.4125787-1-sashal@kernel.org>
@ 2026-08-31 13:24 ` Sasha Levin
2026-08-31 13:24 ` [PATCH AUTOSEL 6.18-6.12] HID: multitouch: Honor ContactCount for Yoga Book 9 to suppress ghost contacts Sasha Levin
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Sasha Levin @ 2026-08-31 13:24 UTC (permalink / raw)
To: patches, stable
Cc: Nikhil Chatterjee, Benjamin Tissoires, Sasha Levin, jikos,
linux-kernel, linux-input
From: Nikhil Chatterjee <nikhilc1527@gmail.com>
[ Upstream commit 857e71cb0a538b1660743a4267a1e789575f7966 ]
The Huion Inspiroy Frego M pen report descriptor exposes the second
side button as Secondary Tip Switch instead of Secondary Barrel Switch.
This makes userspace see the control as the wrong pen button.
Add a HID-BPF report descriptor fixup for the Bluetooth 256c:8251
device and USB 256c:2012 L610 variant. The fixup matches the expected
pen descriptor and rewrites the offending usage from Secondary Tip
Switch to Secondary Barrel Switch.
Tested by building the HID-BPF object with:
make -C drivers/hid/bpf/progs Huion__Inspiroy-Frego-M.bpf.o
Signed-off-by: Nikhil Chatterjee <nikhilc1527@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
LLM Generated explanations, may be completely bogus:
The background git searches finished and match the earlier analysis:
- **`git log --grep="Frego"` / `--grep="Inspiroy Frego"`** — no matches
in this tree; the quirk is not present in 6.18.44.
- **`git log --grep="8251"` under `drivers/hid/`** — only an unrelated
HID debugging commit, not this device.
That confirms the patch would be a new addition here, consistent with
the **YES** backport recommendation.
.../bpf/progs/Huion__Inspiroy-Frego-M.bpf.c | 87 +++++++++++++++++++
1 file changed, 87 insertions(+)
create mode 100644 drivers/hid/bpf/progs/Huion__Inspiroy-Frego-M.bpf.c
diff --git a/drivers/hid/bpf/progs/Huion__Inspiroy-Frego-M.bpf.c b/drivers/hid/bpf/progs/Huion__Inspiroy-Frego-M.bpf.c
new file mode 100644
index 0000000000000..e6ba2295dc775
--- /dev/null
+++ b/drivers/hid/bpf/progs/Huion__Inspiroy-Frego-M.bpf.c
@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#include "vmlinux.h"
+#include "hid_bpf.h"
+#include "hid_bpf_helpers.h"
+#include <bpf/bpf_tracing.h>
+
+/*
+ * Huion Inspiroy Frego M Pen Tablet
+ * Model L610
+ * 256c:8251 (Bluetooth)
+ * 256c:2012 (USB)
+ */
+#define VID_HUION 0x256C
+#define PID_INSPIROY_FREGO_M 0x8251
+#define PID_L610 0x2012
+
+#define PEN_RDESC_SIZE 125
+#define SECONDARY_SWITCH_OFFSET 17
+
+HID_BPF_CONFIG(
+ HID_DEVICE(BUS_BLUETOOTH, HID_GROUP_GENERIC, VID_HUION, PID_INSPIROY_FREGO_M),
+ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, VID_HUION, PID_L610)
+);
+
+/*
+ * The pen descriptor reports the second side button as Secondary Tip Switch
+ * instead of Secondary Barrel Switch.
+ *
+ * Relevant part of the original pen report descriptor:
+ *
+ * 0x09, 0x42, // Usage (Tip Switch) 12
+ * 0x09, 0x44, // Usage (Barrel Switch) 14
+ * 0x09, 0x43, // Usage (Secondary Tip Switch) 16 <- change to 0x5a
+ * 0x09, 0x3c, // Usage (Invert) 18
+ * 0x09, 0x45, // Usage (Eraser) 20
+ * 0x15, 0x00, // Logical Minimum (0) 22
+ * 0x25, 0x01, // Logical Maximum (1) 24
+ */
+SEC(HID_BPF_RDESC_FIXUP)
+int BPF_PROG(fix_secondary_barrel_rdesc, struct hid_bpf_ctx *hctx)
+{
+ __u8 *data = hid_bpf_get_data(hctx, 0 /* offset */, HID_MAX_DESCRIPTOR_SIZE /* size */);
+
+ if (!data)
+ return 0; /* EPERM check */
+
+ if (hctx->size != PEN_RDESC_SIZE)
+ return 0;
+
+ if (data[0] != 0x05 || data[1] != 0x0d || /* Usage Page (Digitizers) */
+ data[2] != 0x09 || data[3] != 0x02 || /* Usage (Pen) */
+ data[16] != 0x09 ||
+ data[SECONDARY_SWITCH_OFFSET] != 0x43) /* Secondary Tip Switch */
+ return 0;
+
+ data[SECONDARY_SWITCH_OFFSET] = 0x5a;
+
+ return 0;
+}
+
+HID_BPF_OPS(fix_secondary_barrel) = {
+ .hid_rdesc_fixup = (void *)fix_secondary_barrel_rdesc,
+};
+
+SEC("syscall")
+int probe(struct hid_bpf_probe_args *ctx)
+{
+ ctx->retval = ctx->rdesc_size != PEN_RDESC_SIZE;
+ if (ctx->retval) {
+ ctx->retval = -EINVAL;
+ return 0;
+ }
+
+ if (ctx->rdesc[0] != 0x05 || ctx->rdesc[1] != 0x0d || /* Usage Page (Digitizers) */
+ ctx->rdesc[2] != 0x09 || ctx->rdesc[3] != 0x02 || /* Usage (Pen) */
+ ctx->rdesc[16] != 0x09 ||
+ ctx->rdesc[SECONDARY_SWITCH_OFFSET] != 0x43) { /* Secondary Tip Switch */
+ ctx->retval = -EINVAL;
+ return 0;
+ }
+
+ ctx->retval = 0;
+
+ return 0;
+}
+
+char _license[] SEC("license") = "GPL";
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH AUTOSEL 6.18-6.12] HID: multitouch: Honor ContactCount for Yoga Book 9 to suppress ghost contacts
[not found] <20260831133314.4125787-1-sashal@kernel.org>
2026-08-31 13:24 ` [PATCH AUTOSEL 6.18-6.1] HID: bpf: Add Huion Inspiroy Frego M button quirk Sasha Levin
@ 2026-08-31 13:24 ` Sasha Levin
2026-08-31 13:30 ` [PATCH AUTOSEL 6.18-6.12] HID: multitouch: Fix Yoga Book 9 14IAH10 touchscreen misclassification Sasha Levin
2026-08-31 13:31 ` [PATCH AUTOSEL 6.18-6.1] HID: hidpp: fix potential UAF in hidpp_connect_event() Sasha Levin
3 siblings, 0 replies; 5+ messages in thread
From: Sasha Levin @ 2026-08-31 13:24 UTC (permalink / raw)
To: patches, stable
Cc: Dave Carey, Jiri Kosina, Sasha Levin, jikos, bentiss, linux-input,
linux-kernel
From: Dave Carey <carvsdriver@gmail.com>
[ Upstream commit ef257b8be9776915ca468bae6c91e31757e69734 ]
The INGENIC 17EF:6161 firmware on the Lenovo Yoga Book 9 14IAH10
does not clear stale contact slots when fingers are lifted. Each
HID report contains up to 10 finger slots, but only the first
ContactCount slots represent valid contacts; the remaining slots
retain TipSwitch=1 with positions from previous touches.
Raw HID capture confirms this: across a 60-second capture with
repeated multi-finger gestures, 90% of frames had more TipSwitch=1
slots than the reported ContactCount. The ContactCount field itself
is always accurate.
Add MT_QUIRK_CONTACT_CNT_ACCURATE to the MT_CLS_YOGABOOK9I class so
the driver stops processing slots once ContactCount valid contacts
have been consumed, discarding the stale ghost entries per HID
specification section 17. MT_QUIRK_NOT_SEEN_MEANS_UP (already in
the class) ensures that any slot skipped by this guard is released
via INPUT_MT_DROP_UNUSED at frame sync.
Signed-off-by: Dave Carey <carvsdriver@gmail.com>
Tested-by: Dave Carey <carvsdriver@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
LLM Generated explanations, may be completely bogus:
# Stable Backport Analysis: HID multitouch Yoga Book 9 ContactCount
**Local tree:** `v6.18.44` (6.18.y stable)
---
## PHASE 1: COMMIT MESSAGE FORENSICS
### Step 1.1: Subject Line
**Record:** `[HID: multitouch]` `[Honor]` — Honor the HID ContactCount
field on Lenovo Yoga Book 9 to suppress ghost/stale touch contacts
caused by firmware not clearing lifted finger slots.
### Step 1.2: Tags
**Record:**
| Tag | Value |
|-----|-------|
| Signed-off-by | Dave Carey `<carvsdriver@gmail.com>` (author) |
| Tested-by | Dave Carey `<carvsdriver@gmail.com>` |
| Signed-off-by | Jiri Kosina `<jkosina@suse.com>` (HID maintainer) |
| Fixes: | None |
| Reported-by: | None |
| Cc: stable | None (expected for manual review) |
| Link: | None |
**Notable patterns:** Hardware-tested by author on the affected device.
No syzbot/sanitizer reports. Part of Dave Carey’s two-commit “Yoga Book
9 UX” series merged for Linux 7.2 (per OpenWall git-pull summary).
### Step 1.3: Body Analysis
**Record:**
- **Bug:** INGENIC `17EF:6161` firmware on Lenovo Yoga Book 9 14IAH10
does not clear stale contact slots when fingers lift. Up to 10 slots
per report, but only the first `ContactCount` slots are valid;
remaining slots keep `TipSwitch=1` with old positions.
- **Symptom:** Ghost touch contacts — phantom fingers reported at stale
positions, breaking multi-touch gestures and usability.
- **Evidence:** 60-second raw HID capture: 90% of frames had more
`TipSwitch=1` slots than `ContactCount`; `ContactCount` itself was
always accurate.
- **Root cause:** Driver processes all slots with `TipSwitch=1` instead
of stopping at `ContactCount`.
- **Fix mechanism:** Add `MT_QUIRK_CONTACT_CNT_ACCURATE` to
`MT_CLS_YOGABOOK9I`. Author states `MT_QUIRK_NOT_SEEN_MEANS_UP`
(already in upstream class) releases skipped slots via
`INPUT_MT_DROP_UNUSED` at frame sync.
### Step 1.4: Hidden Bug Fix?
**Record:** Not disguised — this is an explicit hardware/firmware quirk
fix for ghost touch contacts. Standard HID multitouch quirk pattern.
---
## PHASE 2: DIFF ANALYSIS
### Step 2.1: Inventory
**Record:**
| File | Change |
|------|--------|
| `drivers/hid/hid-multitouch.c` | +1 line |
**Functions modified:** None — only the `mt_classes[]` static table
entry for `MT_CLS_YOGABOOK9I`.
**Scope:** Single-file, single-line surgical quirk addition.
### Step 2.2: Code Flow Change
**Record:**
- **Before:** All finger slots with `TipSwitch=1` are processed for
`MT_CLS_YOGABOOK9I`, including stale slots beyond `ContactCount`.
- **After:** In `mt_process_slot()`, when
`MT_QUIRK_CONTACT_CNT_ACCURATE` is set and `app->num_received >=
app->num_expected` (from `ContactCount`), processing returns `-EAGAIN`
and the slot is skipped:
```1110:1112:drivers/hid/hid-multitouch.c
if ((quirks & MT_QUIRK_CONTACT_CNT_ACCURATE) &&
app->num_received >= app->num_expected)
return -EAGAIN;
```
- **Affected path:** Normal multitouch report processing hot path for
Yoga Book 9 devices.
### Step 2.3: Bug Mechanism
**Record:**
- **Category:** Hardware quirk / logic correctness fix
- **Mechanism:** Firmware violates HID spec §17 by leaving stale active
slots. `MT_QUIRK_CONTACT_CNT_ACCURATE` enforces spec-compliant
behavior: only the first `ContactCount` contacts are valid. Companion
quirk `MT_QUIRK_NOT_SEEN_MEANS_UP` sets `INPUT_MT_DROP_UNUSED` so
skipped/unseen slots are released at `input_mt_sync_frame()`.
### Step 2.4: Fix Quality
**Record:**
- **Quality:** Obviously correct — same quirk is already used for SIS,
Smart Tech, Egallax, Win8 PTP, and many other classes in this file.
- **Risk:** Very low — one flag addition to an existing quirk table
entry; no new APIs, no structural changes.
- **Regression risk:** Minimal; quirk is device-class-specific and only
affects `MT_CLS_YOGABOOK9I` matched devices.
- **Caveat:** Upstream testing was done with
`MT_QUIRK_NOT_SEEN_MEANS_UP` also present in the class; this tree’s
`MT_CLS_YOGABOOK9I` entry lacks that flag (see Phase 6).
---
## PHASE 3: GIT HISTORY INVESTIGATION
### Step 3.1: Blame
**Record:** `MT_CLS_YOGABOOK9I` class introduced in `409d19050cde8`
(Brian Howard, 2026-03-04) — “HID: multitouch: add quirks for Lenovo
Yoga Book 9i”. Present in this 6.18.y tree. The buggy behavior is
firmware-side; kernel support without `CONTACT_CNT_ACCURATE` has existed
since that commit.
### Step 3.2: Fixes: Tag
**Record:** No `Fixes:` tag present. N/A.
### Step 3.3: Related File History
**Record:**
- `409d19050cde8` — Introduced `MT_CLS_YOGABOOK9I`,
`MT_QUIRK_YOGABOOK9I`, device ID `USB_DEVICE_ID_LENOVO_YOGABOOK9I`
(0x6161), bogus-report filtering in `mt_report()`.
- `5d29d7ff8679e` — Dave Carey’s USB cdc-acm quirk for Yoga Book 9
14IAH10 (`17EF:6161`), already in this tree with `Cc: stable`.
- Upstream 7.2 series includes a **prior** Dave Carey commit: “HID:
multitouch: Fix Yoga Book 9 14IAH10 touchscreen misclassification”
(adds `mt_yogabook9_fixup()`, `MT_QUIRK_NOT_SEEN_MEANS_UP`,
`maxcontacts = 10`) — **not present in this 6.18.y tree**.
- This commit is patch 2/2 of Dave Carey’s Yoga Book 9 multitouch UX
fixes in the 7.2 merge window.
### Step 3.4: Author Context
**Record:** Dave Carey is the reporter/fixer for Yoga Book 9 14IAH10
hardware issues. Same author’s cdc-acm fix is already in 6.18.44. Jiri
Kosina (HID maintainer) signed off.
### Step 3.5: Dependencies
**Record:**
- **Soft dependency:** Commit message explicitly relies on
`MT_QUIRK_NOT_SEEN_MEANS_UP` being in the `MT_CLS_YOGABOOK9I` class
for complete ghost-contact release via `INPUT_MT_DROP_UNUSED`. That
flag is **not** in this tree’s YOGABOOK9I class (added upstream in the
companion misclassification commit).
- **Infrastructure dependency:** `MT_QUIRK_CONTACT_CNT_ACCURATE`
mechanism fully exists in this tree (since early multitouch driver
history). `mt_post_parse()` strips the quirk only if
`!app->have_contact_count`; the 14IAH10 device reports
`HID_DG_CONTACTCOUNT`.
- **Standalone applicability:** The one-line change applies cleanly. For
full effectiveness, backport should also add
`MT_QUIRK_NOT_SEEN_MEANS_UP` to the same class entry (trivial one-line
addition, not a separate subsystem).
---
## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH
### Step 4.1: Original Discussion
**Record:** `b4 dig -c <commit>` could not be run — commit hash not
present in this tree. Lore.kernel.org and patch.msgid.link blocked by
bot protection. OpenWall git-pull summary (2026-06-16) confirms both
Dave Carey Yoga Book 9 multitouch commits merged for 7.2 under “UX
improvement fixes for Yoga Book 9.”
### Step 4.2: Reviewers
**Record:** Jiri Kosina (HID maintainer) committed. Author Tested-by on
actual hardware. UNVERIFIED: full lore thread review comments.
### Step 4.3: Bug Report
**Record:** No formal bugzilla/syzbot link. Author provided quantitative
HID capture data (90% of frames affected). Real hardware testing on
Lenovo Yoga Book 9 14IAH10.
### Step 4.4: Related Patches
**Record:** Companion commit “Fix Yoga Book 9 14IAH10 touchscreen
misclassification” (descriptor fixup, `NOT_SEEN_MEANS_UP`,
`maxcontacts=10`) is upstream-only and not in 6.18.44. This commit is
logically the second half of a two-patch series but is self-contained as
a one-line quirk addition.
### Step 4.5: Stable List History
**Record:** UNVERIFIED — lore stable list inaccessible. Related cdc-acm
fix for same device was explicitly nominated with `Cc: stable` and is
already in this tree.
---
## PHASE 5: CODE SEMANTIC ANALYSIS
### Step 5.1: Key Functions
**Record:** No functions modified. Quirk affects behavior in:
- `mt_process_slot()` — enforces ContactCount limit
- `mt_touch_report()` — sets `num_expected` from ContactCount
- `mt_post_parse()` / `mt_input_configured()` — `NOT_SEEN_MEANS_UP` →
`INPUT_MT_DROP_UNUSED`
### Step 5.2: Callers
**Record:** `mt_process_slot()` called from `mt_touch_report()` during
every multitouch HID report — common per-frame hot path for all
multitouch devices. Yoga Book 9 devices match `MT_CLS_YOGABOOK9I` via:
```2380:2383:drivers/hid/hid-multitouch.c
{ .driver_data = MT_CLS_YOGABOOK9I,
HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
USB_VENDOR_ID_LENOVO,
USB_DEVICE_ID_LENOVO_YOGABOOK9I) },
```
### Step 5.3: Callees
**Record:** `mt_process_slot()` → `mt_compute_slot()`,
`input_mt_report_slot_state()`. Frame end → `mt_sync_frame()` →
`input_mt_sync_frame()`.
### Step 5.4: Reachability
**Record:** Triggered on every touch report from Yoga Book 9 touchscreen
during normal use. Userspace-reachable via touch input events. High-
frequency, user-visible path.
### Step 5.5: Similar Patterns
**Record:** `MT_QUIRK_CONTACT_CNT_ACCURATE` used identically in
`MT_CLS_SIS`, `MT_CLS_SMART_TECH`, `MT_CLS_EGALAX_P80H84`, and all Win8
PTP classes — well-established pattern for firmware that misreports
contact slots.
---
## PHASE 6: CROSS-REFERENCING AGAINST LOCAL TREE (v6.18.44)
### Step 6.1: Buggy Code Present?
**Record:** **YES.** `MT_CLS_YOGABOOK9I` exists since `409d19050cde8`
(March 2026) without `MT_QUIRK_CONTACT_CNT_ACCURATE`:
```442:448:drivers/hid/hid-multitouch.c
{ .name = MT_CLS_YOGABOOK9I,
.quirks = MT_QUIRK_ALWAYS_VALID |
MT_QUIRK_FORCE_MULTI_INPUT |
MT_QUIRK_SEPARATE_APP_REPORT |
MT_QUIRK_HOVERING |
MT_QUIRK_YOGABOOK9I,
.export_all_inputs = true
},
```
USB cdc-acm quirk for the same `17EF:6161` device (`5d29d7ff8679e`) is
already in this tree.
### Step 6.2: Backport Complications
**Record:** **Clean apply** for the one-line
`MT_QUIRK_CONTACT_CNT_ACCURATE` addition. Minor backport adjustment
recommended: also add `MT_QUIRK_NOT_SEEN_MEANS_UP` to the same class
entry (present upstream, absent here) for complete ghost-contact
release. No file restructuring conflicts.
### Step 6.3: Related Fixes Already Present?
**Record:** Base Yoga Book 9i support (`409d19050cde8`) and cdc-acm
watchdog fix (`5d29d7ff8679e`) are present. Misclassification fixup
(`mt_yogabook9_fixup`) and `NOT_SEEN_MEANS_UP` on YOGABOOK9I are **not**
present. No duplicate fix for ghost contacts found.
---
## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT
### Step 7.1: Subsystem Criticality
**Record:** `drivers/hid/` — **IMPORTANT** (input/HID subsystem).
Affects touch input for a specific laptop model, not core kernel paths.
### Step 7.2: Subsystem Activity
**Record:** Actively maintained; recent commits in `hid-multitouch.c` on
this tree include out-of-bounds fix (`37daa8c96bd56`), Egallax class,
latency quirk.
---
## PHASE 8: IMPACT AND RISK ASSESSMENT
### Step 8.1: Who Is Affected
**Record:** **Device-specific** — Lenovo Yoga Book 9 14IAH10 (and
potentially other Gen 8–10 models using `17EF:6161` with the same
firmware behavior). Users who already have Yoga Book 9i multitouch
support in 6.18.y.
### Step 8.2: Trigger Conditions
**Record:** Every multi-touch interaction where fingers are lifted —
extremely common during normal laptop use. Not privilege-dependent;
affects all users of this hardware.
### Step 8.3: Failure Mode Severity
**Record:** Ghost/stale touch contacts at wrong screen positions.
**Severity: MEDIUM** — no kernel crash, no data corruption, no security
issue, but significant UX degradation (phantom touches, broken gestures,
unintended UI interaction). This is a real, reproducible hardware bug
with quantified impact (90% of frames).
### Step 8.4: Risk-Benefit
**Record:**
- **Benefit:** HIGH for affected Yoga Book 9 users — restores correct
multitouch behavior on a supported device.
- **Risk:** VERY LOW — one-line quirk flag on an existing device class;
identical pattern used across many other devices.
- **Ratio:** Favorable. Standard hardware-quirk stable material.
---
## PHASE 9: FINAL SYNTHESIS
### Step 9.1: Evidence Summary
**FOR backport:**
- Real firmware bug on hardware already supported in 6.18.44
- Hardware quirk — explicit stable exception category
- One-line, surgical, obviously correct change
- `MT_QUIRK_CONTACT_CNT_ACCURATE` infrastructure fully present and
battle-tested
- Author tested on actual hardware; HID maintainer signed off
- Companion cdc-acm fix for same device already in this tree
- Quantified impact (90% of frames affected)
**AGAINST backport:**
- Not a crash/security/corruption issue — UX/input correctness only
- Upstream fix assumes `MT_QUIRK_NOT_SEEN_MEANS_UP` is already in the
class; this tree lacks it (backport should add both flags)
- Companion “misclassification” commit not in tree (separate concern;
touch may work without it via existing `409d19050cde8` support)
- Device is relatively new/niche
**Unresolved:**
- Full lore review thread inaccessible
- Whether misclassification fixup is also needed for 14IAH10 on 6.18.y
(separate from this ghost-contact fix)
### Step 9.2: Stable Rules Checklist
| Criterion | Result |
|-----------|--------|
| 1. Obviously correct and tested? | **PASS** — standard quirk,
hardware-tested; backport should include `NOT_SEEN_MEANS_UP` for tested
configuration |
| 2. Fixes real bug affecting users? | **PASS** — ghost contacts on
supported hardware |
| 3. Important issue? | **PASS (MEDIUM)** — hardware quirk affecting
input correctness on every touch interaction |
| 4. Small and contained? | **PASS** — 1 line |
| 5. No new features/APIs? | **PASS** — quirk flag on existing class |
| 6. Can apply to local tree? | **PASS** — clean apply; recommend adding
`NOT_SEEN_MEANS_UP` alongside |
### Step 9.3: Exception Category
**Record:** **Hardware quirk/workaround** for broken device firmware —
automatic stable qualification per stable-kernel-rules exceptions.
### Step 9.4: Decision Rationale
This is a textbook stable hardware-quirk fix: a one-line addition of an
existing, well-proven quirk flag to a device class that already exists
in v6.18.44. The Lenovo Yoga Book 9 14IAH10 is already partially
supported (HID multitouch class + USB cdc-acm quirk), and users on this
stable tree will hit the ghost-contact firmware bug during normal use.
The fix is minimal, device-scoped, and follows an established pattern
used by a dozen other device classes in the same file. The only backport
consideration is that the tested upstream configuration also includes
`MT_QUIRK_NOT_SEEN_MEANS_UP`, which should be added alongside
`MT_QUIRK_CONTACT_CNT_ACCURATE` in the backport for complete
effectiveness — a trivial one-line addition, not a blocker.
---
## Verification
- **[Phase 1]** Parsed commit message and tags from user-provided diff
and message
- **[Phase 2]** Diff analysis: +1 line to `MT_CLS_YOGABOOK9I` quirks in
`mt_classes[]`
- **[Phase 2]** Read `mt_process_slot()` lines 1110–1112: confirmed
`CONTACT_CNT_ACCURATE` guard logic
- **[Phase 2]** Read `mt_post_parse()` line 1774–1775: confirmed quirk
stripped if no ContactCount field
- **[Phase 3]** `git describe HEAD`: v6.18.44
- **[Phase 3]** `make kernelversion`: 6.18.44
- **[Phase 3]** `git blame -L 442,449`: YOGABOOK9I introduced in
`409d19050cde8`
- **[Phase 3]** `git show 409d19050cde8`: confirmed base Yoga Book 9i
support in tree since 2026-03-04
- **[Phase 3]** `git show 5d29d7ff8679e`: confirmed cdc-acm quirk for
same 17EF:6161 device in tree
- **[Phase 3]** `git log --grep`: commit not in tree; no local history
for this specific patch
- **[Phase 4]** `b4 dig -c`: failed — no commit hash in tree
- **[Phase 4]** WebFetch lore.kernel.org: blocked by bot protection
- **[Phase 4]** WebSearch: confirmed commit in Linux 7.2 HID merge; part
of Dave Carey Yoga Book 9 UX series
- **[Phase 4]** Fetched torvalds/linux `hid-multitouch.c`: confirmed
upstream YOGABOOK9I has both `NOT_SEEN_MEANS_UP` and
`CONTACT_CNT_ACCURATE`
- **[Phase 5]** `grep MT_QUIRK_CONTACT_CNT_ACCURATE`: confirmed
widespread use in this tree
- **[Phase 5]** `grep MT_CLS_YOGABOOK9I`: confirmed device ID 0x6161
match entry at line 2380
- **[Phase 6]** Read current YOGABOOK9I class: lacks
`CONTACT_CNT_ACCURATE` and `NOT_SEEN_MEANS_UP`
- **[Phase 6]** `grep mt_yogabook9_fixup`: not present in this tree
(misclassification fix is separate)
- **[Phase 7]** `git log --oneline -5 -- drivers/hid/hid-multitouch.c`:
confirmed active maintenance
- **UNVERIFIED:** Full lore review thread and stable-list nomination
history (sites blocked)
**YES**The background `git log --grep` search finished with no matches —
the **Honor ContactCount for Yoga Book 9** commit is not in this
`v6.18.44` tree, which fits treating it as a backport candidate rather
than something already applied.
That lines up with the earlier analysis: `MT_CLS_YOGABOOK9I` is already
here (since `409d19050cde8`), but it still lacks
`MT_QUIRK_CONTACT_CNT_ACCURATE`. This is a one-line hardware quirk fix
worth backporting; for full effect on 6.18.y, the backport should also
add `MT_QUIRK_NOT_SEEN_MEANS_UP` to the same class entry.
**YES**
drivers/hid/hid-multitouch.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 0e204acdc9306..5b7f532c6e0b0 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -442,6 +442,7 @@ static const struct mt_class mt_classes[] = {
{ .name = MT_CLS_YOGABOOK9I,
.quirks = MT_QUIRK_NOT_SEEN_MEANS_UP |
MT_QUIRK_ALWAYS_VALID |
+ MT_QUIRK_CONTACT_CNT_ACCURATE |
MT_QUIRK_FORCE_MULTI_INPUT |
MT_QUIRK_SEPARATE_APP_REPORT |
MT_QUIRK_HOVERING |
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH AUTOSEL 6.18-6.12] HID: multitouch: Fix Yoga Book 9 14IAH10 touchscreen misclassification
[not found] <20260831133314.4125787-1-sashal@kernel.org>
2026-08-31 13:24 ` [PATCH AUTOSEL 6.18-6.1] HID: bpf: Add Huion Inspiroy Frego M button quirk Sasha Levin
2026-08-31 13:24 ` [PATCH AUTOSEL 6.18-6.12] HID: multitouch: Honor ContactCount for Yoga Book 9 to suppress ghost contacts Sasha Levin
@ 2026-08-31 13:30 ` Sasha Levin
2026-08-31 13:31 ` [PATCH AUTOSEL 6.18-6.1] HID: hidpp: fix potential UAF in hidpp_connect_event() Sasha Levin
3 siblings, 0 replies; 5+ messages in thread
From: Sasha Levin @ 2026-08-31 13:30 UTC (permalink / raw)
To: patches, stable
Cc: Dave Carey, Jiri Kosina, Sasha Levin, jikos, bentiss, linux-input,
linux-kernel
From: Dave Carey <carvsdriver@gmail.com>
[ Upstream commit f1bd44b9b62c6fbdaacdd5d115ebe3fe543fcfa1 ]
The Lenovo Yoga Book 9 14IAH10 (83KJ) (17EF:6161) firmware includes a
HID_DG_TOUCHPAD application collection designed for the Windows inbox HID
driver's Win8 PTP touchpad mode. On Linux the HID_DG_TOUCHSCREEN
collections provide the correct direct-touch interface. The presence of
the touchpad collection causes hid-multitouch to misclassify the
touchscreen nodes as indirect buttonpads, leaving them non-functional.
Within the touchpad collection:
- HID_UP_BUTTON usages trigger the touchscreen-with-buttons heuristic
that sets INPUT_MT_POINTER on the touchscreen applications.
- The HID_DG_TOUCHPAD application itself sets INPUT_MT_POINTER via
mt_allocate_application(), propagating to all touchscreen nodes.
- A HID_DG_BUTTONTYPE feature (report 0x51) returns MT_BUTTONTYPE_CLICKPAD,
setting td->is_buttonpad = true for the entire device.
Additionally, the firmware resets if any USB control request arrives while
the CDC-ACM interface is initialising (~1.18 s after enumeration).
The Win8 compliance blob (0xff00:0xc5) and Contact Count Max feature
reports in the touchscreen collections trigger GET_REPORT calls at probe
that hit this window. Surface Switch (0x57) and Button Switch (0x58)
feature reports are sent by mt_set_modes() on every input-device open and
close, repeatedly hitting this window throughout device lifetime.
The firmware also leaves a persistent ghost contact in its contact buffer
(contact ID 2, fixed coordinates, tip always asserted) on every enumeration.
This ghost occupies a multitouch slot and prevents KWin from seeing a clean
finger-lift, causing stuck touch state. The ghost is cleared when Input
Mode is set via HID_REQ_SET_REPORT at probe.
Fix using a report descriptor fixup in mt_report_fixup() and a class
definition update:
1. Remove the entire HID_DG_TOUCHPAD application collection. Parsing
HID short items from its header to the matching End Collection and
closing the gap with memmove eliminates all three BUTTONPAD
heuristics and the feature reports within the collection.
2. Neutralize the Win8 compliance blob feature reports remaining in the
touchscreen collections by changing Usage Page 0xff00 to 0x0f00,
preventing the case 0xff0000c5 branch in mt_feature_mapping() from
issuing GET_REPORT.
3. Neutralize the Contact Count Max feature reports by changing usage
0x55 to 0x00; set maxcontacts = 10 in the class definition so the
driver uses the correct contact limit without querying the device.
4. Neutralize Surface Switch (0x57) and Button Switch (0x58) feature
report usages in the Device Configuration collection so mt_set_modes()
does not issue HID_REQ_SET_REPORT for these on every input-device
open/close. Input Mode (0x52) is intentionally left intact: the single
HID_REQ_SET_REPORT at probe flushes the firmware's contact buffer and
clears the persistent ghost contact. By probe time the cdc-acm driver
has already satisfied the CDC-ACM init watchdog (~130 ms), so this
request arrives safely after the reset window has closed.
5. Add MT_QUIRK_NOT_SEEN_MEANS_UP to the MT_CLS_YOGABOOK9I class so that
contacts not present in a frame are released via INPUT_MT_DROP_UNUSED,
preventing stale multitouch slots from lingering if the firmware omits
a contact from a report.
Signed-off-by: Dave Carey <carvsdriver@gmail.com>
Tested-by: Dave Carey <carvsdriver@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
LLM Generated explanations, may be completely bogus:
## Phase 1: Commit Message Forensics
**Step 1.1 — Subject line**
Record: **[HID: multitouch]** **[Fix]** **Yoga Book 9 14IAH10
touchscreen misclassification** — fixes incorrect buttonpad
classification that leaves touchscreens non-functional on Lenovo Yoga
Book 9 14IAH10 (83KJ, 17EF:6161).
**Step 1.2 — Tags**
Record:
- **Signed-off-by:** Dave Carey `<carvsdriver@gmail.com>` (author)
- **Tested-by:** Dave Carey `<carvsdriver@gmail.com>`
- **Signed-off-by:** Jiri Kosina `<jkosina@suse.com>` (HID maintainer)
- No `Fixes:`, `Reported-by:`, `Cc: stable`, `Link:`, `Reviewed-by:`, or
`Acked-by:` tags in the provided commit message
- Notable: author hardware-tested; maintainer signed off
**Step 1.3 — Body analysis**
Record:
- **Bug:** `hid-multitouch` misclassifies both touchscreen nodes as
indirect buttonpads (`INPUT_PROP_BUTTONPAD` / `INPUT_MT_POINTER`), so
libinput/KWin suppress direct touch; touchscreens are non-functional.
- **Root cause:** Windows-oriented `HID_DG_TOUCHPAD` collection plus
buttonpad heuristics (`HID_UP_BUTTON` in touchscreen collections,
`mt_allocate_application()` touchpad handling, `HID_DG_BUTTONTYPE`
clickpad feature).
- **Additional bugs:** USB control requests during CDC-ACM init window
(~1.18 s) cause firmware reset; repeated `mt_set_modes()` SET_REPORT
on open/close hits that window; persistent ghost contact (ID 2) causes
stuck touch state.
- **Symptom:** Non-functional touchscreens; possible USB resets / stuck
multitouch state.
- **Version info:** Specific to Yoga Book 9 14IAH10 (83KJ), USB
17EF:6161.
**Step 1.4 — Hidden bug fix?**
Record: **Yes.** Although framed as descriptor/class fixup, this is a
real hardware/firmware bug fix (misclassification, firmware reset
sensitivity, ghost contact), not cosmetic cleanup.
---
## Phase 2: Diff Analysis
**Step 2.1 — Inventory**
Record:
- **File:** `drivers/hid/hid-multitouch.c` only
- **Scope:** ~145 lines added, 1 line changed in class definition
- **Functions modified/added:** `mt_classes[]` (`MT_CLS_YOGABOOK9I`),
new `mt_yogabook9_fixup()`, `mt_report_fixup()`
- **Classification:** Single-file, device-specific surgical fix
**Step 2.2 — Code flow changes**
Record:
- **Before:** Full HID report descriptor parsed as-is; touchpad
collection triggers buttonpad heuristics; `mt_feature_mapping()`
issues GET_REPORT for Win8 blob/contact max; `mt_set_modes()`
SET_REPORT on Surface/Button Switch every open/close.
- **After:** For 17EF:6161 only, `mt_report_fixup()` strips touchpad
collection, neutralizes problematic feature usages/pages before
parsing; class gets `MT_QUIRK_NOT_SEEN_MEANS_UP` and `maxcontacts =
10`.
- **Paths affected:** HID probe (`report_fixup` → parse), feature
mapping, input open/close (`mt_set_modes`), multitouch slot lifecycle.
**Step 2.3 — Bug mechanism**
Record: **Hardware workaround / logic correctness fix**
- Removes source of `INPUT_MT_POINTER` / `is_buttonpad`
misclassification
- Prevents probe-time and runtime HID control traffic that triggers
firmware reset
- Clears ghost-contact behavior via retained Input Mode SET_REPORT at
probe plus `MT_QUIRK_NOT_SEEN_MEANS_UP`
**Step 2.4 — Fix quality**
Record: **High quality, maintainer-aligned.** v2 replaced scattered
`MT_QUIRK_YOGABOOK9I` guards with descriptor fixup per Benjamin
Tissoires’ review. Follows existing `mt_report_fixup()` pattern (Goodix
fixup already present). Device-gated to Lenovo 17EF:6161 only. Minor
regression risk on older Yoga Book 9i (same VID:PID) from class quirk
changes, but descriptor surgery is pattern-driven and largely no-op if
patterns absent.
---
## Phase 3: Git History Investigation
**Step 3.1 — Blame**
Record:
- `MT_CLS_YOGABOOK9I` introduced in `409d19050cde8` (Brian Howard,
2025-12-02) — “add quirks for Lenovo Yoga Book 9i”
- `mt_report_fixup()` exists since before 6.18 merge base; currently
only Goodix fixup, no Yoga Book fixup
- Buggy classification paths (`mt_allocate_application`,
`mt_touch_input_mapping`, `mt_feature_mapping`, `mt_set_modes`) are
long-standing generic multitouch logic
**Step 3.2 — Fixes: tag**
Record: **N/A** — no `Fixes:` tag in commit message.
**Step 3.3 — Related file history**
Record:
- `409d19050cde8` — original Yoga Book 9i support (Gen 8–10, same
17EF:6161)
- `5d29d7ff8679e` — USB cdc-acm quirk for Yoga Book 9 14IAH10 (already
in this tree, `Cc: stable`)
- Candidate HID fix **not present** in this tree
- Standalone patch (not part of a multi-patch HID series)
**Step 3.4 — Author context**
Record: Dave Carey authored the companion cdc-acm 14IAH10 fix already
merged here. HID subsystem maintainer chain includes Jiri Kosina sign-
off.
**Step 3.5 — Dependencies**
Record:
- **Requires in tree:** `MT_CLS_YOGABOOK9I`,
`USB_DEVICE_ID_LENOVO_YOGABOOK9I` (0x6161), `mt_report_fixup` hook —
**all present**
- **Complementary:** cdc-acm quirk `5d29d7ff8679e` already in 6.18.43;
HID fix assumes CDC-ACM init completes before probe-time Input Mode
SET_REPORT
- **Can apply standalone:** Yes, to this tree
---
## Phase 4: Mailing List and External Research
**Step 4.1 — Original discussion**
Record:
- Thread: https://yhbt.net/lore/linux-
input/20260413125803.46792-1-carvsdriver@gmail.com/T/
- v1 (2026-04-02): scattered quirk guards
- v2 (2026-04-13): descriptor fixup (matches analyzed commit)
- Benjamin Tissoires reviewed v1, requested descriptor fixup instead of
sprinkling quirk guards; author implemented v2 accordingly
- No explicit `Cc: stable` nomination in thread
- No NAK; constructive review leading to v2 redesign
**Step 4.2 — Reviewers**
Record: CC’d: `jikos@`, `bentiss@` (Benjamin Tissoires), `linux-input@`,
`linux-kernel@`
**Step 4.3 — Bug report**
Record: No syzbot/bugzilla link in this commit. Original Yoga Book 9i
work referenced bugzilla 220386 for earlier models; 14IAH10 issue
documented by hardware owner with detailed firmware analysis.
**Step 4.4 — Series context**
Record: Two-patch user-space fix set with cdc-acm quirk (already in
tree) + this HID fix. HID v2 is self-contained.
**Step 4.5 — Stable list**
Record: No stable-list discussion found for this HID patch. Companion
cdc-acm patch was nominated `Cc: stable`.
---
## Phase 5: Code Semantic Analysis
**Step 5.1 — Key functions**
Record: `mt_yogabook9_fixup()`, `mt_report_fixup()`,
`mt_feature_mapping()`, `mt_set_modes()`, `mt_on_hid_hw_open()`,
`mt_on_hid_hw_close()`, `mt_allocate_application()`,
`mt_touch_input_configured()`
**Step 5.2 — Callers**
Record:
- `mt_report_fixup` — HID core during `hid_parse()` / probe
- `mt_set_modes` — probe, resume, suspend, `mt_on_hid_hw_open/close`
(every userspace open/close of input device)
- `mt_feature_mapping` — during HID feature report parsing at probe
- Impact surface: device probe and normal desktop session input
open/close paths
**Step 5.3 — Callees**
Record: `memmove`, `hid_hw_request(HID_REQ_SET_REPORT)`,
`mt_get_feature` (avoided after fixup), `input_mt_init_slots` with
`INPUT_MT_DROP_UNUSED`
**Step 5.4 — Reachability**
Record: Triggered by plugging in Yoga Book 9 14IAH10 USB composite
device (17EF:6161) and opening touch input devices — common laptop hot
path, not obscure debug-only code.
**Step 5.5 — Similar patterns**
Record: Existing Goodix `mt_report_fixup()` in same function; other HID
descriptor fixups elsewhere in tree. `MT_QUIRK_NOT_SEEN_MEANS_UP`
already used by SIS and other classes.
---
## Phase 6: Cross-Reference Against Local Tree (6.18.43)
**Step 6.1 — Buggy code present?**
Record: **Yes.** Local tree is **6.18.43** (`git describe`:
`v6.18.43-1-gc7f0dac02d232`). `MT_CLS_YOGABOOK9I` and device ID `0x6161`
are bound, but **no `mt_yogabook9_fixup()`**. Generic buttonpad
heuristics and feature-report GET/SET paths are unchanged. cdc-acm
14IAH10 quirk is already present at `drivers/usb/class/cdc-
acm.c:2045-2057`.
**Step 6.2 — Backport difficulty**
Record: **Clean apply expected** — adds new function and one conditional
call in existing `mt_report_fixup()`; small class table tweak. No
structural conflicts observed.
**Step 6.3 — Related fixes already present?**
Record: Partial — `409d190` Yoga Book 9i quirks (bogus InRange drop,
naming) and `5d29d7ff8679e` cdc-acm quirk are present. **This specific
misclassification/descriptor fix is missing.**
---
## Phase 7: Subsystem Context
**Step 7.1 — Subsystem**
Record: **drivers/hid** — IMPORTANT (input/touch for laptop users, not
core kernel, but affects primary interaction on affected hardware)
**Step 7.2 — Activity**
Record: HID subsystem actively maintained in 6.18.y with recent
multitouch and quirk fixes.
---
## Phase 8: Impact and Risk Assessment
**Step 8.1 — Who is affected**
Record: **Driver-specific** — Lenovo Yoga Book 9 14IAH10 (and
potentially other 17EF:6161 Yoga Book 9 variants sharing
descriptor/class binding)
**Step 8.2 — Trigger conditions**
Record: Device enumeration and normal input device use (open/close).
Common on every boot and session. Unprivileged users interact via normal
input stack; not a privilege-escalation vector.
**Step 8.3 — Failure mode severity**
Record:
- Without fix: touchscreens **completely non-functional** (HIGH severity
for affected users)
- Firmware reset window: USB instability / re-enumeration during HID
traffic (HIGH)
- Ghost contact: stuck touch state in compositor (MEDIUM-HIGH)
- Not kernel oops/panic, but makes primary hardware unusable
**Step 8.4 — Risk vs benefit**
Record:
- **Benefit:** HIGH for 14IAH10 owners; completes fix started by
already-backported cdc-acm quirk
- **Risk:** LOW-MEDIUM — ~145 lines, device-gated, but shared
VID:PID/class with earlier Yoga Book 9i could affect Gen 8–10 behavior
(`NOT_SEEN_MEANS_UP`, removing emulated touchpad collection)
- **Ratio:** Benefit clearly outweighs risk for this stable tree where
partial support already exists
---
## Phase 9: Final Synthesis
**Step 9.1 — Evidence compile**
**FOR:**
- Fixes real, user-visible hardware breakage (non-functional
touchscreens)
- Hardware quirk / descriptor fixup — standard stable exception
- Small, single-file, device-specific
- Author Tested-by on actual hardware
- HID maintainer signed off
- Subsystem expert (Tissoires) guided v2 design
- Complementary cdc-acm fix already in 6.18.43 with stable nomination
- Buggy code and prerequisites exist in this tree
- Prevents firmware-reset-triggering HID control traffic
**AGAINST:**
- No syzbot/CVE — usability/hardware enablement, not security
- Shared 17EF:6161 with earlier Yoga Book 9i — possible regression on
Gen 8–10 (untested on those models in v2)
- Larger than a one-liner quirk, but still contained
- Not yet merged in this checkout (candidate evaluation)
**UNRESOLVED:**
- Whether v2 was merged to mainline beyond this 6.18.43 checkout (not
needed for backport decision)
- Regression testing on pre-14IAH10 Yoga Book 9i units
**Step 9.2 — Stable rules checklist**
1. Obviously correct and tested? **PASS** — detailed mechanism, hardware
Tested-by, maintainer SOB, expert-reviewed approach
2. Fixes real bug affecting users? **PASS** — touchscreens non-
functional on 14IAH10
3. Important issue? **PASS** — primary input hardware unusable; USB
reset sensitivity
4. Small and contained? **PASS** — one file, device-specific
5. No new features/APIs? **PASS** — descriptor quirk only
6. Can apply to local tree? **PASS** — prerequisites present, clean
apply expected
**Step 9.3 — Exception category**
Record: **Hardware quirk/workaround** (HID report descriptor fixup for
broken firmware/descriptor)
**Step 9.4 — Decision rationale**
For **Linux 6.18.y** specifically: the tree already ships Yoga Book 9i
(`MT_CLS_YOGABOOK9I`, 17EF:6161) support and the cdc-acm 14IAH10 quirk,
but without this HID fix the touchscreens remain misclassified and non-
functional on the 14IAH10. This is exactly the kind of device-specific
hardware workaround stable trees accept. The fix is self-contained,
reviewed, tested, and completes an already-started stable-relevant
enablement path.
---
## Verification
- [Phase 1] Parsed commit message and tags from user-provided commit
text
- [Phase 2] Analyzed full diff: `mt_yogabook9_fixup()`, class changes,
`mt_report_fixup()` hook
- [Phase 3] `git describe HEAD` → v6.18.43; `git log --grep="Yoga Book"`
→ `409d190`, `5d29d7ff8679e`; `git blame` on lines 442-448, 1567+
- [Phase 3] `git show 409d19050cde8` — original Yoga Book 9i support
confirmed
- [Phase 3] `git show 5d29d7ff8679e` — cdc-acm quirk with `Cc: stable`
confirmed in tree
- [Phase 4] Fetched lore thread via yhbt.net; v1→v2 evolution and
Tissoires review confirmed
- [Phase 4] UNVERIFIED: `b4 dig -c <hash>` — commit hash not in local
repo
- [Phase 5] `grep` confirmed `mt_set_modes` called from
open/close/resume/suspend; `mt_feature_mapping` GET_REPORT paths at
lines 549-574
- [Phase 5] Read `mt_allocate_application`, `mt_touch_input_mapping`,
`mt_touch_input_configured` buttonpad heuristics
- [Phase 6] `grep` — `mt_yogabook9_fixup` **absent**;
`MT_CLS_YOGABOOK9I` and `USB_DEVICE_ID_LENOVO_YOGABOOK9I` **present**
- [Phase 6] Read `cdc-acm.c:2045-2057` — 14IAH10 quirk present
- [Phase 6] Read current `mt_report_fixup()` — only Goodix fixup, no
Yoga Book call
- [Phase 8] Failure mode: non-functional touchscreens + firmware reset
sensitivity on 17EF:6161 without fix
**YES**
drivers/hid/hid-multitouch.c | 146 ++++++++++++++++++++++++++++++++++-
1 file changed, 145 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 1959481dc7820..0e204acdc9306 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -440,11 +440,13 @@ static const struct mt_class mt_classes[] = {
MT_QUIRK_CONTACT_CNT_ACCURATE,
},
{ .name = MT_CLS_YOGABOOK9I,
- .quirks = MT_QUIRK_ALWAYS_VALID |
+ .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP |
+ MT_QUIRK_ALWAYS_VALID |
MT_QUIRK_FORCE_MULTI_INPUT |
MT_QUIRK_SEPARATE_APP_REPORT |
MT_QUIRK_HOVERING |
MT_QUIRK_YOGABOOK9I,
+ .maxcontacts = 10,
.export_all_inputs = true
},
{ .name = MT_CLS_EGALAX_P80H84,
@@ -1564,6 +1566,144 @@ static int mt_event(struct hid_device *hid, struct hid_field *field,
return 0;
}
+/*
+ * Yoga Book 9 14IAH10 descriptor fixup.
+ *
+ * The device includes a HID_DG_TOUCHPAD application collection designed for
+ * the Windows inbox HID driver's Win8 PTP touchpad mode. On Linux we want
+ * only the HID_DG_TOUCHSCREEN collections. The touchpad collection (and the
+ * HID_DG_BUTTONTYPE and Win8 compliance blob features it contains) must be
+ * removed so hid-multitouch does not misclassify the touchscreen nodes as
+ * indirect buttonpads.
+ *
+ * The firmware also resets if any USB control request is received while the
+ * CDC-ACM interface is initialising (~1.18 s after enumeration). Dropping
+ * the Win8 blob and Contact Count Max feature reports prevents the
+ * GET_REPORT calls that hid-multitouch issues at probe.
+ */
+static void mt_yogabook9_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *size)
+{
+ /* Usage Page (Digitizer), Usage (Touch Pad), Collection (Application) */
+ static const __u8 tp_app_hdr[] = { 0x05, 0x0d, 0x09, 0x05, 0xa1, 0x01 };
+ /* Vendor Usage Page 0xff00 (Win8 compliance blob header) */
+ static const __u8 win8_page[] = { 0x06, 0x00, 0xff };
+ /* Usage (Contact Count Max = 0x55) */
+ static const __u8 ccmax_usage[] = { 0x09, 0x55 };
+ unsigned int i;
+
+ /*
+ * Step 1: find and remove the Touch Pad application collection.
+ * Walk HID short items from the collection header to its matching
+ * End Collection, then close the gap with memmove.
+ */
+ for (i = 0; i + sizeof(tp_app_hdr) <= *size; i++) {
+ if (memcmp(rdesc + i, tp_app_hdr, sizeof(tp_app_hdr)) == 0) {
+ __u8 *start = rdesc + i;
+ __u8 *coll_end = NULL;
+ __u8 *p = start;
+ unsigned int drop;
+ int depth = 0;
+
+ while (p < rdesc + *size) {
+ __u8 b = *p;
+ int ds = b & 3;
+ int item_len;
+
+ if (b == 0xfe) { /* long item */
+ if (p + 2 >= rdesc + *size)
+ break;
+ item_len = p[1] + 3;
+ } else {
+ item_len = (ds == 3) ? 5 : ds + 1;
+ }
+ if (p + item_len > rdesc + *size)
+ break;
+
+ if ((b & 0xfc) == 0xa0)
+ depth++; /* Collection */
+ else if (b == 0xc0) {
+ depth--; /* End Collection */
+ if (depth == 0) {
+ coll_end = p;
+ break;
+ }
+ }
+ p += item_len;
+ }
+
+ if (!coll_end) {
+ hid_err(hdev,
+ "Yoga Book 9: Touch Pad End Collection not found\n");
+ break;
+ }
+
+ drop = coll_end - start + 1;
+ memmove(start, coll_end + 1, rdesc + *size - coll_end - 1);
+ *size -= drop;
+ hid_dbg(hdev,
+ "Yoga Book 9: dropped Touch Pad collection (%u bytes)\n",
+ drop);
+ break;
+ }
+ }
+
+ /*
+ * Step 2: neutralize Win8 compliance blob feature reports remaining
+ * in the touchscreen collections. Change Usage Page 0xff00 to 0x0f00
+ * so the case 0xff0000c5 branch in mt_feature_mapping() is not reached
+ * and no GET_REPORT is issued.
+ */
+ for (i = 0; i + sizeof(win8_page) <= *size; i++) {
+ if (memcmp(rdesc + i, win8_page, sizeof(win8_page)) == 0) {
+ rdesc[i + 2] = 0x0f; /* 0xff00 -> 0x0f00 */
+ hid_dbg(hdev,
+ "Yoga Book 9: neutralized Win8 blob at offset %u\n",
+ i);
+ }
+ }
+
+ /*
+ * Step 3: neutralize Contact Count Max feature reports. Change usage
+ * 0x55 (HID_DG_CONTACTMAX) to 0x00 so mt_feature_mapping() does not
+ * issue GET_REPORT. The class maxcontacts field provides the value.
+ */
+ for (i = 0; i + sizeof(ccmax_usage) <= *size; i++) {
+ if (memcmp(rdesc + i, ccmax_usage, sizeof(ccmax_usage)) == 0) {
+ rdesc[i + 1] = 0x00;
+ hid_dbg(hdev,
+ "Yoga Book 9: neutralized ContactMax at offset %u\n",
+ i);
+ }
+ }
+
+ /*
+ * Step 4: neutralize Surface Switch (0x57) and Button Switch (0x58)
+ * feature report usages in the Device Configuration collection.
+ * mt_set_modes() issues HID_REQ_SET_REPORT for these on every
+ * input-device open/close; those repeated control requests hit the
+ * firmware's CDC-ACM init window and trigger resets.
+ *
+ * Input Mode (0x52) is intentionally left intact. mt_set_modes()
+ * sends it once at probe to set the device into touchscreen mode,
+ * which flushes the firmware's contact buffer and clears a persistent
+ * ghost contact (cid 2, fixed coordinates) that otherwise appears on
+ * every enumeration. By probe time cdc_acm has already satisfied the
+ * CDC-ACM init watchdog (~130 ms), so the single SET_REPORT for Input
+ * Mode arrives safely after the reset window has closed.
+ */
+ for (i = 0; i + 2 <= *size; i++) {
+ if (rdesc[i] == 0x09 &&
+ (rdesc[i + 1] == 0x57 ||
+ rdesc[i + 1] == 0x58)) {
+ hid_dbg(hdev,
+ "Yoga Book 9: neutralized set-modes usage 0x%02x at offset %u\n",
+ rdesc[i + 1], i);
+ rdesc[i + 1] = 0x00;
+ }
+ }
+}
+
static const __u8 *mt_report_fixup(struct hid_device *hdev, __u8 *rdesc,
unsigned int *size)
{
@@ -1593,6 +1733,10 @@ got: %x\n",
}
}
+ if (hdev->vendor == USB_VENDOR_ID_LENOVO &&
+ hdev->product == USB_DEVICE_ID_LENOVO_YOGABOOK9I)
+ mt_yogabook9_fixup(hdev, rdesc, size);
+
return rdesc;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH AUTOSEL 6.18-6.1] HID: hidpp: fix potential UAF in hidpp_connect_event()
[not found] <20260831133314.4125787-1-sashal@kernel.org>
` (2 preceding siblings ...)
2026-08-31 13:30 ` [PATCH AUTOSEL 6.18-6.12] HID: multitouch: Fix Yoga Book 9 14IAH10 touchscreen misclassification Sasha Levin
@ 2026-08-31 13:31 ` Sasha Levin
2026-08-31 17:39 ` sashiko-bot
3 siblings, 1 reply; 5+ messages in thread
From: Sasha Levin @ 2026-08-31 13:31 UTC (permalink / raw)
To: patches, stable
Cc: Jiri Kosina, zdi-disclosures, Sasha Levin, jikos, bentiss,
linux-input, linux-kernel
From: Jiri Kosina <jkosina@suse.com>
[ Upstream commit 6df6b1f2c49678211f65647c300bc51dda02893b ]
If input_register_device() fails, we call input_free_device(), but keep
stale pointer to the old device in hidpp->input, which could potentially
lead to UAF. Fix that by resetting it to NULL before returning from
hidpp_connect_event().
Reported-by: zdi-disclosures@trendmicro.com
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
LLM Generated explanations, may be completely bogus:
## Phase 1: Commit Message Forensics
**Step 1.1 — Subject line**
Record: **[HID/hidpp] [fix] [potential UAF in hidpp_connect_event() when
input_register_device() fails]**
**Step 1.2 — Tags**
Record:
- **Fixes:** — not present (expected for manual review)
- **Reported-by:** zdi-disclosures@trendmicro.com (Trend Micro Zero Day
Initiative — security disclosure channel)
- **Tested-by:** — not present
- **Reviewed-by:** — not present
- **Acked-by:** — not present
- **Link:** — not present
- **Cc: stable:** — not present (expected)
- **Signed-off-by:** Jiri Kosina (author); ignore pipeline-added SOBs
per instructions
Notable: ZDI disclosure is a strong security-relevant signal.
**Step 1.3 — Body analysis**
Record:
- **Bug:** On `input_register_device()` failure in
`hidpp_connect_event()`, the driver calls `input_free_device()` but
leaves a stale pointer in `hidpp->input`.
- **Symptom:** Potential use-after-free when later code dereferences
`hidpp->input`.
- **Root cause:** `hidpp_populate_input()` sets `hidpp->input = input`
before registration; the error path frees the device without clearing
the pointer.
- **Version info:** Not specified in the message.
**Step 1.4 — Hidden bug fix?**
Record: **No — this is an explicit UAF fix**, not disguised cleanup.
---
## Phase 2: Diff Analysis
**Step 2.1 — Inventory**
Record:
- **Files:** `drivers/hid/hid-logitech-hidpp.c` (+1 line)
- **Function:** `hidpp_connect_event()`
- **Scope:** Single-file, single-line surgical fix on an error path
**Step 2.2 — Code flow change**
Record:
- **Before:** On `input_register_device()` failure →
`input_free_device(input)` → return, with `hidpp->input` still
pointing at freed memory.
- **After:** On failure → `hidpp->input = NULL` →
`input_free_device(input)` → return.
- **Path affected:** Delayed-init connect work item error path only
(devices with `HIDPP_QUIRK_DELAYED_INIT`).
**Step 2.3 — Bug mechanism**
Record: **Category: use-after-free / memory safety**
- `hidpp_populate_input()` assigns `hidpp->input = input` (line 3810).
- Failure path frees `input` but does not NULL the stored pointer.
- Existing `if (!hidpp->input)` guards do not help — the pointer is non-
NULL but dangling.
**Step 2.4 — Fix quality**
Record:
- **Obviously correct:** Yes — standard pattern: clear pointer before
freeing referenced object.
- **Minimal:** One line, no unrelated changes.
- **Regression risk:** Very low — only affects the failure path;
successful registration is unchanged.
---
## Phase 3: Git History Investigation
**Step 3.1 — Blame**
Record:
- Delayed-init block in `hidpp_connect_event()`: `c39e3d5fc9dd` (2014,
Benjamin Tissoires).
- `hidpp_populate_input()` before register: `e54abaf675ca76` (2019, Hans
de Goede).
- `hidpp->input = input` in `hidpp_populate_input()`: `0610430e3dea`
(2019).
- Error-path `return` without NULLing: `98d67f250472cd` (2022) fixed
`delayed_input` assignment but missed `hidpp->input`.
- **Bug present since ~2019** when populate-before-register was
introduced.
**Step 3.2 — Fixes: tag**
Record: **N/A** — no Fixes: tag in commit message.
**Step 3.3 — Related file history**
Record:
- Recent related fix in this tree: `b846fb0a73e99` — separate G920
force-feedback UAF fix (already backported).
- `680ee411a98e8` — connect event race fix (2023).
- **Standalone fix** — not part of a multi-patch series.
**Step 3.4 — Author context**
Record: Jiri Kosina is the HID subsystem maintainer. Upstream commit:
`6df6b1f2c4967`; stable-format commit: `67eae1a739c6d`.
**Step 3.5 — Dependencies**
Record: **None.** Self-contained one-liner; no prerequisite commits
required.
---
## Phase 4: Mailing List and External Research
**Step 4.1 — Original discussion**
Record:
- `b4 dig -c 6df6b1f2c4967`: https://patch.msgid.link/r7qq6043-p432-
51o0-3s93-r9382q44n027@xreary.bet
- Single v1 submission (2026-06-12); no follow-up revisions found.
- Lore fetch blocked by Anubis bot protection — **could not read thread
replies**.
**Step 4.2 — Reviewers (b4 dig -w)**
Record: CC'd to Jiri Kosina, Benjamin Tissoires (HID maintainer), linux-
kernel, linux-input.
**Step 4.3 — Bug report**
Record: **Reported-by: zdi-disclosures@trendmicro.com** — ZDI security
disclosure. No public syzbot/bugzilla link. ZDI typically reports
exploitable or high-severity kernel issues. Full ZDI advisory not
verified (no Link: tag).
**Step 4.4 — Related patches**
Record: **Standalone** — v1 only, no series dependencies.
**Step 4.5 — Stable list discussion**
Record: **Not searched** (no stable-specific thread found via b4). Not a
negative signal.
---
## Phase 5: Code Semantic Analysis
**Step 5.1 — Key functions**
Record: `hidpp_connect_event()`, `hidpp_populate_input()`,
`hidpp_allocate_input()`, `hidpp_raw_event()`, `m560_raw_event()`,
`wtp_raw_event()`
**Step 5.2 — Callers**
Record:
- `hidpp_connect_event()` — scheduled from `hidpp_raw_hidpp_event()` on
connect events; also from `hidpp_probe()` via `schedule_work()` +
`flush_work()`.
- `hidpp->input` used from raw event handlers (`m560_raw_event`,
`wtp_raw_event`, wheel/button handlers, scroll counter).
**Step 5.3 — Callees**
Record: `hidpp_allocate_input()` → `devm_input_allocate_device()`;
`hidpp_populate_input()` → sets `hidpp->input`;
`input_register_device()` / `input_free_device()` on failure.
**Step 5.4 — Reachability**
Record:
- Affects devices with `HIDPP_QUIRK_DELAYED_INIT`: wireless touchpads
(0x4011, 0x4101, T651) and M560 mouse (0x402d).
- Trigger: `input_register_device()` fails during delayed connect (e.g.
memory pressure).
- After failure, device stays bound and continues receiving HID reports
→ `hidpp_raw_event()` → class-specific handlers use dangling
`hidpp->input`.
- **Userspace-reachable** via device plug/connect; no special privileges
needed to connect a HID device.
**Step 5.5 — Similar patterns**
Record: `b846fb0a73e99` fixed a different UAF in the same driver (G920
FF init). Same driver, same class of bug.
---
## Phase 6: Cross-Reference Against Local Tree
**Step 6.1 — Buggy code in tree?**
Record: **YES.** Local tree is **6.18.44** (`git describe`:
`v6.18.44-1-g2736c32da98b9`). At lines 4279–4284:
```4279:4287:drivers/hid/hid-logitech-hidpp.c
hidpp_populate_input(hidpp, input);
ret = input_register_device(input);
if (ret) {
input_free_device(input);
return;
}
hidpp->delayed_input = input;
```
Missing `hidpp->input = NULL`. Upstream fix `6df6b1f2c4967` is **not**
an ancestor of HEAD.
**Step 6.2 — Backport complications**
Record: **`git apply --check` passes cleanly** — no conflicts expected.
**Step 6.3 — Related fixes already present?**
Record: G920 FF UAF fix (`b846fb0a73e99`) is present. **This specific
`hidpp_connect_event()` UAF fix is not.**
---
## Phase 7: Subsystem Context
**Step 7.1 — Subsystem**
Record: **drivers/hid** (Logitech HID++ driver). Criticality:
**IMPORTANT** — common consumer peripherals (mice, touchpads).
**Step 7.2 — Activity**
Record: Actively maintained; multiple recent fixes in `hid-logitech-
hidpp.c`.
---
## Phase 8: Impact and Risk Assessment
**Step 8.1 — Who is affected**
Record: Users of Logitech HID++ devices with delayed input registration
— wireless touchpads (T650/T651/4011) and M560 mouse on Unifying
receivers.
**Step 8.2 — Trigger conditions**
Record:
- Device connects with `HIDPP_QUIRK_DELAYED_INIT`.
- `input_register_device()` fails (uncommon but possible under resource
pressure).
- Device continues operating at the HID layer; subsequent input events
hit stale `hidpp->input`.
- **Unprivileged users** can trigger by connecting affected hardware.
**Step 8.3 — Failure mode**
Record: **Use-after-free** on `struct input_dev` via `input_report_*()`
/ `input_event()` / `input_sync()`. Severity: **HIGH** (kernel memory
corruption; potential security impact given ZDI disclosure).
**Step 8.4 — Risk vs benefit**
Record:
- **Benefit:** HIGH — prevents UAF on a reachable path for common
hardware.
- **Risk:** VERY LOW — one-line NULL assignment on error path only.
- **Ratio:** Strongly favors backport.
---
## Phase 9: Final Synthesis
**Step 9.1 — Evidence summary**
**FOR:**
- Real UAF with clear mechanism (stale pointer after free).
- ZDI security disclosure.
- Small, obviously correct fix.
- Buggy code confirmed in 6.18.44 tree.
- Patch applies cleanly.
- Affects common Logitech peripherals.
- HID maintainer-authored fix.
**AGAINST:**
- `input_register_device()` failure is uncommon.
- No public crash reproducer verified in this analysis.
- Lore thread content unverified (bot protection).
**UNRESOLVED:**
- Full ZDI advisory details and exploitability assessment not retrieved.
- No reviewer Ack/Tested-by in commit message.
**Step 9.2 — Stable rules checklist**
1. Obviously correct and tested? **PASS** (logic is trivial; no Tested-
by)
2. Fixes a real bug? **PASS**
3. Important issue? **PASS** — UAF / potential security (ZDI)
4. Small and contained? **PASS** — 1 line, 1 file
5. No new features/APIs? **PASS**
6. Can apply to local tree? **PASS** — verified with `git apply --check`
**Step 9.3 — Exception category**
Record: **N/A** — standard bug fix, not a quirk/ID/DT exception.
**Step 9.4 — Decision rationale**
For the **6.18.44** tree checked out here, the buggy code exists and the
fix is absent. The commit closes a real UAF on an error path where
`hidpp->input` becomes a dangling pointer. Existing NULL checks do not
protect against this. The fix is minimal, maintainer-authored, security-
disclosed, and applies cleanly. This meets all stable kernel criteria.
---
## Verification
- [Phase 1] Parsed commit `6df6b1f2c4967`: subject, body, Reported-by
ZDI
- [Phase 2] Read diff: +1 line `hidpp->input = NULL` in error path
- [Phase 2] Read `hidpp_populate_input()`: sets `hidpp->input = input`
at line 3810
- [Phase 3] `git blame` on lines 4269–4287: bug path dates to 2014–2019
code
- [Phase 3] `git log -1 -S "hidpp->input = input"`: introduced in
`0610430e3dea` (2019)
- [Phase 3] `git show 98d67f250472cd`: fixed `delayed_input` on failure,
missed `hidpp->input`
- [Phase 3] `git merge-base --is-ancestor 6df6b1f2c4967 HEAD`: exit 1 —
fix NOT in tree
- [Phase 4] `b4 dig -c 6df6b1f2c4967`: lore URL found
- [Phase 4] `b4 dig -w`: CC to HID maintainers
- [Phase 4] `b4 dig -a`: v1 only
- [Phase 4] UNVERIFIED: Lore thread replies (Anubis blocked fetch)
- [Phase 5] Grep `hidpp->input`: multiple uses in raw event paths; NULL
checks insufficient for dangling pointer
- [Phase 5] Read `hidpp_raw_event()`: dispatches to `wtp_raw_event` /
`m560_raw_event` for affected quirks
- [Phase 5] Grep `HIDPP_QUIRK_DELAYED_INIT`: touchpads + M560 mouse
- [Phase 6] `git describe HEAD`: v6.18.44-1-g2736c32da98b9 / kernel
6.18.44
- [Phase 6] Read lines 4279–4287: buggy code present
- [Phase 6] `git apply --check` on upstream patch: applies cleanly
- [Phase 8] ZDI Reported-by: security-relevant disclosure channel
**YES**
drivers/hid/hid-logitech-hidpp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 4ba652ae54765..83d625f361f49 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -4280,6 +4280,7 @@ static void hidpp_connect_event(struct work_struct *work)
ret = input_register_device(input);
if (ret) {
+ hidpp->input = NULL;
input_free_device(input);
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH AUTOSEL 6.18-6.1] HID: hidpp: fix potential UAF in hidpp_connect_event()
2026-08-31 13:31 ` [PATCH AUTOSEL 6.18-6.1] HID: hidpp: fix potential UAF in hidpp_connect_event() Sasha Levin
@ 2026-08-31 17:39 ` sashiko-bot
0 siblings, 0 replies; 5+ messages in thread
From: sashiko-bot @ 2026-08-31 17:39 UTC (permalink / raw)
To: Sasha Levin; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:
Pre-existing issues:
- [Critical] Force feedback initialization in `hidpp_ff_init()` creates a TOCTOU race that leads to a guaranteed NULL pointer dereference in `input_ff_upload()`.
- [Critical] Missing `hid_hw_stop()` and resource cleanup in the `probe()` error path for G920 devices leads to a catastrophic Use-After-Free.
- [High] Concurrent access to `hidpp->input` between `hidpp_connect_event()` error path and `hidpp_raw_event()` leaves a race window leading to a Use-After-Free.
- [High] Unhandled permanent Use-After-Free for non-delayed initialization devices if `hidinput_connect()` fails.
- [High] Missing `cancel_work_sync(&hidpp->reset_hi_res_work)` in the `hidpp_probe()` error path leads to a Use-After-Free if the work was scheduled.
--
commit 4c51abc31c5c6d9a8be9e395178ab70d3b017d36
Author: Jiri Kosina <jikos@kernel.org>
Subject: HID: hidpp: fix potential UAF in hidpp_connect_event()
This commit attempts to fix a potential use-after-free (UAF) by setting
hidpp->input to NULL before calling input_free_device() in the error
path of hidpp_connect_event().
> diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
> index 5e763de4b94fd..bc8761ed41a1c 100644
> --- a/drivers/hid/hid-logitech-hidpp.c
> +++ b/drivers/hid/hid-logitech-hidpp.c
> @@ -4276,6 +4276,7 @@ static void hidpp_connect_event(struct work_struct *work)
>
> ret = input_register_device(input);
> if (ret) {
> + hidpp->input = NULL;
[Severity: High]
This is a pre-existing issue, but does this still leave a TOCTOU race window?
hidpp_populate_input() assigns the allocated input to hidpp->input before
calling input_register_device(), exposing it to concurrent raw hardware
events processed in SoftIRQ (like wtp_raw_event()).
If a concurrent SoftIRQ thread evaluates !hidpp->input just before it is
set to NULL here, will it subsequently dereference the freed pointer?
> input_free_device(input);
> return;
> }
[Severity: High]
This isn't a bug introduced by this patch, but does this leave a permanent
dangling pointer if registration fails?
drivers/hid/hid-logitech-hidpp.c:hidpp_input_configured() {
...
if (!hidpp)
return 0;
hidpp_populate_input(hidpp, input);
...
}
hidinput_connect() allocates input_dev and calls .input_configured, which
unconditionally sets hidpp->input = input here.
If input_register_device() then fails inside hidinput_connect(), the core
branches to out_unwind and frees the input device.
However, hid_connect() may still return success (e.g., if hidraw binds
successfully), allowing probe to finish. hidpp->input is never cleared and
remains a dangling pointer, accessed on the next hardware event.
[Severity: Critical]
This is a pre-existing issue, but does this FF initialization create a TOCTOU
race leading to a NULL pointer dereference?
drivers/hid/hid-logitech-hidpp.c:hidpp_probe() {
...
if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {
struct hidpp_ff_private_data data;
ret = g920_get_config(hidpp, &data);
if (!ret)
ret = hidpp_ff_init(hidpp, &data);
...
}
hid_connect() registers the input device, making it exposed to userspace.
Then hidpp_ff_init() is called, which calls input_ff_create() setting the
EV_FF bit.
If a subsequent memory allocation in hidpp_ff_init() fails, it returns
-ENOMEM leaving ff->upload as NULL. Because the device is already
registered, userspace can open it and issue the EVIOCSFF ioctl, which
will blindly execute ff->upload(dev, effect, old).
[Severity: Critical]
This is a pre-existing issue, but does this bypass the error cleanup labels
and skip hid_hw_stop() when G920 initialization fails?
drivers/hid/hid-logitech-hidpp.c:hidpp_probe() {
...
if (ret)
hid_warn(hidpp->hid_dev,
"Unable to initialize force feedback support, errno %d\n",
ret);
}
/*
* This relies on logi_dj_ll_close() being a no-op so that DJ connection
* events will still be received.
*/
hid_hw_close(hdev);
return ret;
...
}
When ret is non-zero, it returns directly here. This leaves the device
active in the HID subsystem, processing hardware interrupts, while the
driver's devm resources are freed by the core, leading to a Use-After-Free.
[Severity: High]
This is a pre-existing issue, but does this error path fail to cancel
reset_hi_res_work?
drivers/hid/hid-logitech-hidpp.c:hidpp_probe() {
...
hid_hw_start_fail:
sysfs_remove_group(&hdev->dev.kobj, &ps_attribute_group);
cancel_work_sync(&hidpp->work);
mutex_destroy(&hidpp->send_mutex);
return ret;
}
hidpp_probe() calls hid_device_io_start(), enabling incoming hardware events.
A battery online event can trigger hidpp_raw_hidpp_event() to schedule
reset_hi_res_work.
If a subsequent step in probe (like hid_connect()) fails, the error cleanup
path cancels hidpp->work but misses hidpp->reset_hi_res_work. The hidpp
struct is then freed by devres, leaving the scheduled work item pointing to
freed memory.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831133314.4125787-633-sashal@kernel.org?part=1
^ permalink raw reply [flat|nested] 5+ messages in thread