[PATCH 1/2] input: fix typos in comments

[PATCH 1/2] input: fix typos in comments

[Hemanth Selam]

Fix typos in comments, reported by scripts/checkpatch.pl using the
misspelling list in scripts/spelling.txt.  Only touches comments, no code
changes.

Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
---
 drivers/input/keyboard/imx_keypad.c        | 2 +-
 drivers/input/keyboard/pxa27x_keypad.c     | 2 +-
 drivers/input/mouse/elantech.h             | 2 +-
 drivers/input/rmi4/rmi_f54.c               | 2 +-
 drivers/input/touchscreen/exc3000.c        | 2 +-
 drivers/input/touchscreen/usbtouchscreen.c | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/input/keyboard/imx_keypad.c b/drivers/input/keyboard/imx_keypad.c
index ccde60cd6bb3..9e0898588e06 100644
--- a/drivers/input/keyboard/imx_keypad.c
+++ b/drivers/input/keyboard/imx_keypad.c
@@ -396,7 +396,7 @@ static int imx_keypad_open(struct input_dev *dev)
 
 	imx_keypad_config(keypad);
 
-	/* Sanity control, not all the rows must be actived now. */
+	/* Sanity control, not all the rows must be activated now. */
 	if ((readw(keypad->mmio_base + KPDR) & keypad->rows_en_mask) == 0) {
 		dev_err(&dev->dev,
 			"too many keys pressed, control pins initialisation\n");
diff --git a/drivers/input/keyboard/pxa27x_keypad.c b/drivers/input/keyboard/pxa27x_keypad.c
index 4519eecb317b..320021e9d81b 100644
--- a/drivers/input/keyboard/pxa27x_keypad.c
+++ b/drivers/input/keyboard/pxa27x_keypad.c
@@ -522,7 +522,7 @@ static void pxa27x_keypad_config(struct pxa27x_keypad *keypad)
 		direct_key_num = keypad->direct_key_num;
 
 	/*
-	 * Direct keys usage may not start from KP_DKIN0, check the platfrom
+	 * Direct keys usage may not start from KP_DKIN0, check the platform
 	 * mask data to config the specific.
 	 */
 	if (!keypad->direct_key_mask)
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index 571e6ca11d33..a2ab57a11b64 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -57,7 +57,7 @@
 
 /*
  * One hard to find application note states that X axis range is 0 to 576
- * and Y axis range is 0 to 384 for harware version 1.
+ * and Y axis range is 0 to 384 for hardware version 1.
  * Edge fuzz might be necessary because of bezel around the touchpad
  */
 #define ETP_EDGE_FUZZ_V1		32
diff --git a/drivers/input/rmi4/rmi_f54.c b/drivers/input/rmi4/rmi_f54.c
index 6c6cdec7da9e..43a4e262cd2b 100644
--- a/drivers/input/rmi4/rmi_f54.c
+++ b/drivers/input/rmi4/rmi_f54.c
@@ -193,7 +193,7 @@ static int rmi_f54_request_report(struct rmi_function *fn, u8 report_type)
 
 	/*
 	 * Small delay after disabling interrupts to avoid race condition
-	 * in firmare. This value is a bit higher than absolutely necessary.
+	 * in firmware. This value is a bit higher than absolutely necessary.
 	 * Should be removed once issue is resolved in firmware.
 	 */
 	usleep_range(2000, 3000);
diff --git a/drivers/input/touchscreen/exc3000.c b/drivers/input/touchscreen/exc3000.c
index 037bb35238a3..e18e74781c58 100644
--- a/drivers/input/touchscreen/exc3000.c
+++ b/drivers/input/touchscreen/exc3000.c
@@ -406,7 +406,7 @@ static int exc3000_probe(struct i2c_client *client)
 	 * ensures, that the device probe will not fail for temporary issues
 	 * on the bus.  This is not needed for the sysfs calls (userspace
 	 * will receive the error code and can start another query) and
-	 * cannot be done for touch events (but that only means loosing one
+	 * cannot be done for touch events (but that only means losing one
 	 * or two touch events anyways).
 	 */
 	for (retry = 0; retry < 3; retry++) {
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index 0bbacb517c28..81d24f5fbcc4 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -51,7 +51,7 @@ static bool hwcalib_xy;
 module_param(hwcalib_xy, bool, 0644);
 MODULE_PARM_DESC(hwcalib_xy, "If set hw-calibrated X/Y are used if available");
 
-/* device specifc data/functions */
+/* device specific data/functions */
 struct usbtouch_usb;
 struct usbtouch_device_info {
 	int min_xc, max_xc;
-- 
2.48.1

[PATCH 2/2] input: fix repeated words in comments

[Hemanth Selam]

Drop words accidentally written twice, reported by checkpatch.pl as a
possible repeated word.  Only touches comments, no code changes.

Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
---
 drivers/input/mouse/cyapa.c  | 2 +-
 drivers/input/serio/q40kbd.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/input/mouse/cyapa.c b/drivers/input/mouse/cyapa.c
index 47000c30e4d8..96b79796864a 100644
--- a/drivers/input/mouse/cyapa.c
+++ b/drivers/input/mouse/cyapa.c
@@ -1322,7 +1322,7 @@ static int cyapa_probe(struct i2c_client *client)
 
 	/*
 	 * Register the device in the input subsystem when it's operational.
-	 * Otherwise, keep in this driver, so it can be be recovered or updated
+	 * Otherwise, keep in this driver, so it can be recovered or updated
 	 * through the sysfs mode and update_fw interfaces by user or apps.
 	 */
 	if (cyapa->operational) {
diff --git a/drivers/input/serio/q40kbd.c b/drivers/input/serio/q40kbd.c
index 2f553efbe649..7ab4db61e46f 100644
--- a/drivers/input/serio/q40kbd.c
+++ b/drivers/input/serio/q40kbd.c
@@ -72,7 +72,7 @@ static void q40kbd_stop(void)
 
 /*
  * q40kbd_open() is called when a port is open by the higher layer.
- * It allocates the interrupt and enables in in the chip.
+ * It allocates the interrupt and enables in the chip.
  */
 
 static int q40kbd_open(struct serio *port)
-- 
2.48.1

Re: [PATCH 2/2] input: fix repeated words in comments

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:

New issues:
- [Low] The patch incorrectly fixes a typo, resulting in a grammatically incomplete sentence.

Pre-existing issues:
- [High] Repeated firmware updates via sysfs leak `input_dev` structures and devres nodes due to manual unregistration of a devm-managed device without freeing it.
- [High] The `serio->lock` spinlock is accessed uninitialized if an interrupt fires before `serio_register_port()` completes.
- [High] A Use-After-Free can occur on `q40kbd->port` during device removal if a pending interrupt fires before `free_irq()`.
--

commit 45b867db64f6ee078771ef7b8cf723b44cd0fd23
Author: Hemanth Selam <hemanth.selam@gmail.com>

    input: fix repeated words in comments
    
    Drop words accidentally written twice, reported by checkpatch.pl as a
    possible repeated word.  Only touches comments, no code changes.
    
    Assisted-by: Cursor:claude-opus-5
    Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>

[ ... ]

> diff --git a/drivers/input/serio/q40kbd.c b/drivers/input/serio/q40kbd.c
> index 2f553efbe649d..7ab4db61e46fe 100644
> --- a/drivers/input/serio/q40kbd.c
> +++ b/drivers/input/serio/q40kbd.c
> @@ -72,7 +72,7 @@ static void q40kbd_stop(void)
>  
>  /*
>   * q40kbd_open() is called when a port is open by the higher layer.
> - * It allocates the interrupt and enables in in the chip.
> + * It allocates the interrupt and enables in the chip.

[Severity: Low]
Does this typo fix leave the sentence grammatically incomplete? The original
text "enables in in the chip" appears to be a typo for "enables it in the
chip".

>   */
>  
>  static int q40kbd_open(struct serio *port)

[Severity: High]
This is a pre-existing issue, but does cyapa_update_fw_store() leak memory and
devres tracking nodes on every firmware update?

drivers/input/mouse/cyapa.c:cyapa_update_fw_store() {
    ...
    input_unregister_device(cyapa->input);
    cyapa->input = NULL;
    ...
}

Manual unregistration of a devm-allocated device without freeing it leaves the
devres tracking node and memory orphaned. When cyapa_reinitialize() is called,
it allocates a new input device, creating a new devres node.


[Severity: High]
This is a pre-existing issue, but can the serio port spinlock be accessed
uninitialized if an interrupt fires before q40kbd_probe() completes?

drivers/input/serio/q40kbd.c:q40kbd_probe() {
    ...
    error = request_irq(Q40_IRQ_KEYBOARD, q40kbd_interrupt, 0,
                        DRV_NAME, q40kbd);
    ...
    serio_register_port(q40kbd->port);
    ...
}

If an interrupt fires when request_irq() is called, q40kbd_interrupt() will
call serio_interrupt(), which acquires serio->lock. However, the spinlock
isn't initialized until serio_register_port() is called.


[Severity: High]
This is a pre-existing issue, but is there a use-after-free race during
device removal if a pending interrupt fires before the IRQ is freed?

drivers/input/serio/q40kbd.c:q40kbd_remove() {
    ...
    serio_unregister_port(q40kbd->port);
    free_irq(Q40_IRQ_KEYBOARD, q40kbd);
    ...
}

While serio_unregister_port() calls the close method to mask the hardware
interrupt, it does not wait for already-running handlers. If
q40kbd_interrupt() is executing on another CPU, it can dereference
q40kbd->port after it has been freed by serio_unregister_port().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904111911.32224-1-hemanth.selam@gmail.com?part=2