[PATCH] HID: multitouch: keep MT_IO_FLAGS_RUNNING inside the flags word

[PATCH] HID: multitouch: keep MT_IO_FLAGS_RUNNING inside the flags word

[Aldo Ariel Panzardo]

MT_IO_FLAGS_RUNNING is bit 32 of td->mt_io_flags, which is a single
unsigned long. On 32-bit architectures a long is 32 bits wide, so the
valid bit indices are 0-31 and bit 32 falls in the next word. Both users
take and release the flag with atomic bitops:

    test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
    clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);

so on a 32-bit build every report and every sticky-finger timer expiry
reads and writes the four bytes that follow mt_io_flags in struct
mt_device -- inputmode_value, maxcontacts and the is_* flags -- instead
of the flags word itself.

Before commit 46f781e0d151 ("HID: multitouch: fix sticky fingers") the
flag was bit 0 and the word only had to hold three flags. That commit
reserved the low eight bits for per-slot state (MT_IO_SLOTS_MASK) and
moved the flag out to bit 32, one word too far on 32-bit builds.

Put it at MT_IO_SLOTS_BITS, the first bit above the reserved slot range.
The value is only ever used as a bit index, so nothing else has to
change.

Fixes: 46f781e0d151 ("HID: multitouch: fix sticky fingers")
Cc: stable@vger.kernel.org
Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260723224211.613112-1-you@example.com?part=1
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
This applies on top of "HID: multitouch: bound the slot index before
touching mt_io_flags", which introduces MT_IO_SLOTS_BITS. The two are
separate defects with the same Fixes: tag, so they should backport
together.

 drivers/hid/hid-multitouch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index a75c821f7758..e7d811ed4123 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -99,7 +99,7 @@ enum report_mode {
 
 #define MT_IO_SLOTS_MASK		GENMASK(7, 0) /* reserve first 8 bits for slot tracking */
 #define MT_IO_SLOTS_BITS		8 /* bits covered by MT_IO_SLOTS_MASK */
-#define MT_IO_FLAGS_RUNNING		32
+#define MT_IO_FLAGS_RUNNING		MT_IO_SLOTS_BITS
 
 static const bool mtrue = true;		/* default for true */
 static const bool mfalse;		/* default for false */
-- 
2.43.0

Re: [PATCH] HID: multitouch: keep MT_IO_FLAGS_RUNNING inside the flags word

[Benjamin Tissoires]

On Jul 23 2026, Aldo Ariel Panzardo wrote:
> MT_IO_FLAGS_RUNNING is bit 32 of td->mt_io_flags, which is a single
> unsigned long. On 32-bit architectures a long is 32 bits wide, so the
> valid bit indices are 0-31 and bit 32 falls in the next word. Both users
> take and release the flag with atomic bitops:
> 
>     test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
>     clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
> 
> so on a 32-bit build every report and every sticky-finger timer expiry
> reads and writes the four bytes that follow mt_io_flags in struct
> mt_device -- inputmode_value, maxcontacts and the is_* flags -- instead
> of the flags word itself.
> 
> Before commit 46f781e0d151 ("HID: multitouch: fix sticky fingers") the
> flag was bit 0 and the word only had to hold three flags. That commit
> reserved the low eight bits for per-slot state (MT_IO_SLOTS_MASK) and
> moved the flag out to bit 32, one word too far on 32-bit builds.
> 
> Put it at MT_IO_SLOTS_BITS, the first bit above the reserved slot range.
> The value is only ever used as a bit index, so nothing else has to
> change.
> 
> Fixes: 46f781e0d151 ("HID: multitouch: fix sticky fingers")
> Cc: stable@vger.kernel.org
> Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260723224211.613112-1-you@example.com?part=1
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
> ---

Same result than the previous patch of this non-series: already
superseeded by an already applied patch, which I just checked was
already in 7.2-rc3 at the time of the submission.

Cheers,
Benjamin

> This applies on top of "HID: multitouch: bound the slot index before
> touching mt_io_flags", which introduces MT_IO_SLOTS_BITS. The two are
> separate defects with the same Fixes: tag, so they should backport
> together.
> 
>  drivers/hid/hid-multitouch.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
> index a75c821f7758..e7d811ed4123 100644
> --- a/drivers/hid/hid-multitouch.c
> +++ b/drivers/hid/hid-multitouch.c
> @@ -99,7 +99,7 @@ enum report_mode {
>  
>  #define MT_IO_SLOTS_MASK		GENMASK(7, 0) /* reserve first 8 bits for slot tracking */
>  #define MT_IO_SLOTS_BITS		8 /* bits covered by MT_IO_SLOTS_MASK */
> -#define MT_IO_FLAGS_RUNNING		32
> +#define MT_IO_FLAGS_RUNNING		MT_IO_SLOTS_BITS
>  
>  static const bool mtrue = true;		/* default for true */
>  static const bool mfalse;		/* default for false */
> -- 
> 2.43.0
> 
>