[PATCH v2 1/2] HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard

[PATCH v2 1/2] HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard

[Oleg Keri]

The ITE controller behind the keyboard of the Lenovo Yoga Slim 7x Gen 11
(048d:83db) carries out a reset but never raises the interrupt that
acknowledges it. i2c_hid_finish_hwreset() therefore waits out its full
one second timeout and logs "device did not ack reset within 1000 ms" on
every probe and every resume, before the keyboard comes up regardless.

Set I2C_HID_QUIRK_NO_IRQ_AFTER_RESET for it, as is already done for
several other ITE parts, so the reset is followed by a fixed 100 ms sleep
instead.

Signed-off-by: Oleg Keri <okerixx@gmail.com>
---
 drivers/hid/hid-ids.h              | 1 +
 drivers/hid/i2c-hid/i2c-hid-core.c | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b3aca5aa9176..2e9d0fc41ed0 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -765,6 +765,7 @@
 #define I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720	0x837a
 #define USB_DEVICE_ID_ITE_LENOVO_YOGA900	0x8396
 #define I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_KEYBOARD	0x8987
+#define I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD	0x83db
 #define USB_DEVICE_ID_ITE8595		0x8595
 #define USB_DEVICE_ID_ITE_MEDION_E1239T	0xce50
 
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 0ff07fdab442..ad8d9f329404 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -126,6 +126,8 @@ static const struct i2c_hid_quirks {
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
 	{ I2C_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_VOYO_WINPAD_A15,
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
+	{ USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD,
+		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
 	{ I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118,
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
 	{ USB_VENDOR_ID_ALPS_JP, HID_ANY_ID,
-- 
2.55.0

[PATCH v2 0/2] HID: quiet the keyboard on the Lenovo Yoga Slim 7x Gen 11

[Oleg Keri]

Two small fixes for the ITE keyboard controller (048d:83db) on the
Lenovo Yoga Slim 7x Gen 11, a Snapdragon X2 Elite (Glymur) laptop.

Patch 1 stops i2c-hid waiting a full second for a reset acknowledgement
this controller never sends, on every probe and every resume.

Patch 2 drops the Wireless Radio Controls collection the same
controller declares but never reports through.  The airplane mode key
is wired to the embedded controller instead, so userspace currently
sees two KEY_RFKILL sources of which only one ever fires.

The two are independent in effect but not in ordering: patch 2 uses the
device ID that patch 1 adds to hid-ids.h.

Changes in v2:
- Send both patches as an ordered series.  v1 was patch 2 alone, which
  does not build on its own -- it references
  I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD, and the #define
  for it lives in patch 1.  The kernel test robot reported this twice:
    https://lore.kernel.org/oe-kbuild-all/202609092332.pk1AmDaL-lkp@intel.com/
    https://lore.kernel.org/oe-kbuild-all/202609100719.bu2saXPQ-lkp@intel.com/
  No code changed; only the split and the ordering.
- Link to v1: https://lore.kernel.org/all/20260908091907.5653-1-okerixx@gmail.com/

Oleg Keri (2):
  HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard
  HID: lenovo: suppress phantom radio control input on Yoga Slim 7x Gen 11

 drivers/hid/hid-ids.h              |  1 +
 drivers/hid/hid-lenovo.c           | 14 ++++++++++++++
 drivers/hid/i2c-hid/i2c-hid-core.c |  2 ++
 3 files changed, 17 insertions(+)

-- 
2.55.0


base-commit: df2908090cda368b01ff43709f51890076c56157

[PATCH v2 1/2] HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard

[Oleg Keri]

The ITE controller behind the keyboard of the Lenovo Yoga Slim 7x Gen 11
(048d:83db) carries out a reset but never raises the interrupt that
acknowledges it. i2c_hid_finish_hwreset() therefore waits out its full
one second timeout and logs "device did not ack reset within 1000 ms" on
every probe and every resume, before the keyboard comes up regardless.

Set I2C_HID_QUIRK_NO_IRQ_AFTER_RESET for it, as is already done for
several other ITE parts, so the reset is followed by a fixed 100 ms sleep
instead.

Signed-off-by: Oleg Keri <okerixx@gmail.com>
---
 drivers/hid/hid-ids.h              | 1 +
 drivers/hid/i2c-hid/i2c-hid-core.c | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 8b4f4b02aec0..79eb464ba2f7 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -765,6 +765,7 @@
 #define I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720	0x837a
 #define USB_DEVICE_ID_ITE_LENOVO_YOGA900	0x8396
 #define I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_KEYBOARD	0x8987
+#define I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD	0x83db
 #define USB_DEVICE_ID_ITE8595		0x8595
 #define USB_DEVICE_ID_ITE_MEDION_E1239T	0xce50
 
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 0ff07fdab442..ad8d9f329404 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -126,6 +126,8 @@ static const struct i2c_hid_quirks {
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
 	{ I2C_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_VOYO_WINPAD_A15,
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
+	{ USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD,
+		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
 	{ I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118,
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
 	{ USB_VENDOR_ID_ALPS_JP, HID_ANY_ID,
-- 
2.55.0

[PATCH v2 2/2] HID: lenovo: suppress phantom radio control input on Yoga Slim 7x Gen 11

[Oleg Keri]

The ITE keyboard controller (048d:83db) declares a Wireless Radio Controls
application collection, which hid-input registers as a second input device
advertising KEY_RFKILL. That collection never reports anything: the
airplane mode key is wired to the embedded controller and reaches the host
as EC event 0x19, where the platform driver emits the key.

Map the collection to nothing so hidinput_has_been_populated() discards it
and userspace is left with a single, real KEY_RFKILL source.

Signed-off-by: Oleg Keri <okerixx@gmail.com>
---
 drivers/hid/hid-lenovo.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
index 3976d7b53b14..617bba662659 100644
--- a/drivers/hid/hid-lenovo.c
+++ b/drivers/hid/hid-lenovo.c
@@ -476,6 +476,16 @@ static int lenovo_input_mapping_x1_tab_kbd(struct hid_device *hdev,
 	return 0;
 }
 
+static int lenovo_input_mapping_yoga7x_g11_kbd(struct hid_device *hdev,
+		struct hid_input *hi, struct hid_field *field,
+		struct hid_usage *usage, unsigned long **bit, int *max)
+{
+	if (field->application == HID_GD_WIRELESS_RADIO_CTLS)
+		return -1;
+
+	return 0;
+}
+
 static int lenovo_input_mapping(struct hid_device *hdev,
 		struct hid_input *hi, struct hid_field *field,
 		struct hid_usage *usage, unsigned long **bit, int *max)
@@ -510,6 +520,8 @@ static int lenovo_input_mapping(struct hid_device *hdev,
 	case USB_DEVICE_ID_LENOVO_X1_TAB2:
 	case USB_DEVICE_ID_LENOVO_X1_TAB3:
 		return lenovo_input_mapping_x1_tab_kbd(hdev, hi, field, usage, bit, max);
+	case I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD:
+		return lenovo_input_mapping_yoga7x_g11_kbd(hdev, hi, field, usage, bit, max);
 	default:
 		return 0;
 	}
@@ -1568,6 +1580,8 @@ static const struct hid_device_id lenovo_devices[] = {
 		     USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X13_TAB) },
 	{ HID_DEVICE(BUS_I2C, HID_GROUP_GENERIC,
 		     USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_KEYBOARD) },
+	{ HID_DEVICE(BUS_I2C, HID_GROUP_GENERIC,
+		     USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD) },
 	{ }
 };
 
-- 
2.55.0

Re: [PATCH v2 2/2] HID: lenovo: suppress phantom radio control input on Yoga Slim 7x Gen 11

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Preexisting: `lenovo_remove()` incorrectly cancels asynchronous work before stopping the hardware, which can cause a Use-After-Free.
- [High] Preexisting: In `lenovo_probe_tpkbd()`, sysfs attributes are registered and exposed to userspace before the required private driver data is allocated.
--

commit 5bdafd669d3015385ef2a78a1df43a3a45427c70
Author: Oleg Keri <okerixx@gmail.com>

HID: lenovo: suppress phantom radio control input on Yoga Slim 7x Gen 11

This commit suppresses a phantom radio control input on the Yoga Slim 7x
Gen 11 by mapping the Wireless Radio Controls application collection to
nothing, avoiding an unnecessary KEY_RFKILL source.

> diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
> index 3976d7b53b14b..617bba6626592 100644
> --- a/drivers/hid/hid-lenovo.c
> +++ b/drivers/hid/hid-lenovo.c

[ ... ]

[Severity: High]
This isn't a bug introduced by this patch, but does lenovo_remove()
incorrectly cancel asynchronous work before stopping the hardware,
risking a use-after-free?

In lenovo_remove(), lenovo_remove_tp10ubkbd() is called before
hid_hw_stop():

drivers/hid/hid-lenovo.c:lenovo_remove() {
    ...
		lenovo_remove_tp10ubkbd(hdev);
		break;
	}

	hid_hw_stop(hdev);
    ...
}

This means hardware interrupts are still active when the work is cancelled:

drivers/hid/hid-lenovo.c:lenovo_remove_tp10ubkbd() {
    ...
	cancel_work_sync(&data->fn_lock_sync_work);
    ...
}

If an event like KEY_FN_ESC triggers lenovo_event_tp10ubkbd() in this window,
it will re-queue the work:

drivers/hid/hid-lenovo.c:lenovo_event_tp10ubkbd() {
    ...
		schedule_work(&data->fn_lock_sync_work);
    ...
}

Devres subsequently frees the data structure when remove() exits.
Will the re-queued work then run and access the freed data structure?


[Severity: High]
This is a pre-existing issue, but does lenovo_probe_tpkbd() expose sysfs
attributes before allocating required private driver data?

In lenovo_probe_tpkbd(), sysfs_create_group() exposes attributes like
sensitivity to userspace before driver data is allocated:

drivers/hid/hid-lenovo.c:lenovo_probe_tpkbd() {
    ...
	ret = sysfs_create_group(&hdev->dev.kobj, &lenovo_attr_group_tpkbd);
	if (ret)
		hid_warn(hdev, "Could not create sysfs group: %d\n", ret);

	data_pointer = devm_kzalloc(&hdev->dev,
				    sizeof(struct lenovo_drvdata),
				    GFP_KERNEL);
	if (data_pointer == NULL) {
    ...
}

If userspace reads a sysfs file immediately after it appears, the read
callback will blindly dereference a NULL pointer:

drivers/hid/hid-lenovo.c:attr_sensitivity_show_tpkbd() {
    ...
	struct hid_device *hdev = to_hid_device(dev);
	struct lenovo_drvdata *data_pointer = hid_get_drvdata(hdev);

	return sysfs_emit(buf, "%u\n", data_pointer->sensitivity);
}

Can this lead to a NULL pointer dereference if the files are accessed
during device probe?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910063051.4556-1-okerixx@gmail.com?part=2