Re: [PATCH v5 08/12] Input: xbox_gip - Add arcade stick support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing `input_sync()` when discarding too-short reports, leaving events stuck in the input core buffers.
--

commit 11239c49a7f8de98682a983be88f926f7595b94d
Author: Vicki Pfau <vi@endrift.com>

Input: xbox_gip - Add arcade stick support
    
This adds support for the arcade stick device type to the xbox_gip driver.
Currently only the Razer Atrox controller is known to use this type.

> diff --git a/drivers/input/joystick/gip/gip-arcade-stick.c b/drivers/input/joystick/gip/gip-arcade-stick.c
> new file mode 100644
> index 0000000000000..11ededfab8555
> --- /dev/null
> +++ b/drivers/input/joystick/gip/gip-arcade-stick.c

[ ... ]

> +static int gip_handle_arcade_stick_report(struct gip_attachment *attachment,
> +	struct input_dev *input, const uint8_t *bytes, int num_bytes)
> +{
> +	struct gip_arcade_stick_info *info = attachment->driver_data;
> +	int rc;
> +
> +	if (!info)
> +		return -ENODEV;
> +
> +	rc = gip_driver_navigation.handle_input_report(attachment, input, bytes, num_bytes);
> +	if (rc < 0)
> +		return rc;
> +
> +	if (num_bytes < 6) {
> +		gip_dbg(attachment, "Discarding too-short input report\n");
> +		return -EINVAL;
> +	}

[Severity: Medium]
When an input report is received with a length between 2 and 5 bytes,
gip_driver_navigation.handle_input_report() successfully parses the first
two bytes and calls input_report_key() and input_report_abs() to update the
device state.

If num_bytes < 6, this error path in gip_handle_arcade_stick_report() returns
-EINVAL before the device state can be synchronized. This error code is
propagated back to the caller in drivers/input/joystick/gip/gip-core.c
(gip_handle_ll_input_report()), which then immediately returns without calling
input_sync(input).

Because of this early return, does the driver leave the reported key and axis
events buffered in the input core without flushing them to userspace? Could
this result in missed or delayed events if the hardware sends unexpectedly
short event packets?

> +
> +	if (info->actuator_bias > 0) {
> +		input_report_abs(input, ABS_X, get_unaligned_le16(&bytes[2]) - info->actuator_bias);
> +		input_report_abs(input, ABS_Y, get_unaligned_le16(&bytes[4]) - info->actuator_bias);
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902010237.865772-1-vi@endrift.com?part=8