* [PATCH v3 3/3] Input: ili210x - add support for polling mode
From: Marek Vasut @ 2026-01-15 16:18 UTC (permalink / raw)
To: linux-input
Cc: Marek Vasut, Conor Dooley, Dmitry Torokhov, Frank Li, Job Noorman,
Krzysztof Kozlowski, Rob Herring, devicetree, linux-kernel,
linux-renesas-soc
In-Reply-To: <20260115161858.20226-1-marek.vasut+renesas@mailbox.org>
There are designs incorporating Ilitek ILI2xxx touch controller that
do not connect interrupt pin, for example Waveshare 13.3" DSI display.
To support such systems use polling mode for the input device when I2C
client does not have interrupt assigned to it.
Factor out ili210x_firmware_update_noirq() to allow conditional scoped
guard around this code. The scoped guard has to be applied only in case
the IRQ line is connected, and not applied otherwise.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
---
Cc: Conor Dooley <conor+dt@kernel.org>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Frank Li <Frank.Li@nxp.com>
Cc: Job Noorman <job@noorman.info>
Cc: Krzysztof Kozlowski <krzk+dt@kernel.org>
Cc: Rob Herring <robh@kernel.org>
Cc: devicetree@vger.kernel.org
Cc: linux-input@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-renesas-soc@vger.kernel.org
---
V2: Test client->irq > 0 for IRQ presence
V3: - Rebase on dev_err_probe() conversion
- Fix if (client->irq > 0) in ili210x_firmware_update_store()
---
drivers/input/touchscreen/ili210x.c | 76 +++++++++++++++++++++--------
1 file changed, 56 insertions(+), 20 deletions(-)
diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c
index a3c5321d34d7b..22917a5825778 100644
--- a/drivers/input/touchscreen/ili210x.c
+++ b/drivers/input/touchscreen/ili210x.c
@@ -327,9 +327,8 @@ static bool ili210x_report_events(struct ili210x *priv, u8 *touchdata)
return contact;
}
-static irqreturn_t ili210x_irq(int irq, void *irq_data)
+static void ili210x_process_events(struct ili210x *priv)
{
- struct ili210x *priv = irq_data;
struct i2c_client *client = priv->client;
const struct ili2xxx_chip *chip = priv->chip;
u8 touchdata[ILI210X_DATA_SIZE] = { 0 };
@@ -356,8 +355,22 @@ static irqreturn_t ili210x_irq(int irq, void *irq_data)
usleep_range(time_delta, time_delta + 1000);
}
} while (!priv->stop && keep_polling);
+}
+
+static irqreturn_t ili210x_irq(int irq, void *irq_data)
+{
+ struct ili210x *priv = irq_data;
+
+ ili210x_process_events(priv);
return IRQ_HANDLED;
+};
+
+static void ili210x_work_i2c_poll(struct input_dev *input)
+{
+ struct ili210x *priv = input_get_drvdata(input);
+
+ ili210x_process_events(priv);
}
static int ili251x_firmware_update_resolution(struct device *dev)
@@ -829,12 +842,32 @@ static int ili210x_do_firmware_update(struct ili210x *priv,
return 0;
}
+static ssize_t ili210x_firmware_update_noirq(struct device *dev,
+ const u8 *fwbuf, u16 ac_end, u16 df_end)
+{
+ struct i2c_client *client = to_i2c_client(dev);
+ struct ili210x *priv = i2c_get_clientdata(client);
+ const char *fwname = ILI251X_FW_FILENAME;
+ int error;
+
+ dev_dbg(dev, "Firmware update started, firmware=%s\n", fwname);
+
+ ili210x_hardware_reset(priv->reset_gpio);
+
+ error = ili210x_do_firmware_update(priv, fwbuf, ac_end, df_end);
+
+ ili210x_hardware_reset(priv->reset_gpio);
+
+ dev_dbg(dev, "Firmware update ended, error=%i\n", error);
+
+ return error;
+}
+
static ssize_t ili210x_firmware_update_store(struct device *dev,
struct device_attribute *attr,
const char *buf, size_t count)
{
struct i2c_client *client = to_i2c_client(dev);
- struct ili210x *priv = i2c_get_clientdata(client);
const char *fwname = ILI251X_FW_FILENAME;
u16 ac_end, df_end;
int error;
@@ -860,16 +893,12 @@ static ssize_t ili210x_firmware_update_store(struct device *dev,
* the touch controller to disable the IRQs during update, so we have
* to do it this way here.
*/
- scoped_guard(disable_irq, &client->irq) {
- dev_dbg(dev, "Firmware update started, firmware=%s\n", fwname);
-
- ili210x_hardware_reset(priv->reset_gpio);
-
- error = ili210x_do_firmware_update(priv, fwbuf, ac_end, df_end);
-
- ili210x_hardware_reset(priv->reset_gpio);
-
- dev_dbg(dev, "Firmware update ended, error=%i\n", error);
+ if (client->irq > 0) {
+ scoped_guard(disable_irq, &client->irq) {
+ error = ili210x_firmware_update_noirq(dev, fwbuf, ac_end, df_end);
+ }
+ } else {
+ error = ili210x_firmware_update_noirq(dev, fwbuf, ac_end, df_end);
}
return error ?: count;
@@ -945,9 +974,6 @@ static int ili210x_i2c_probe(struct i2c_client *client)
if (!chip)
return dev_err_probe(&client->dev, -ENODEV, "unknown device model\n");
- if (client->irq <= 0)
- dev_err_probe(dev, -EINVAL, "No IRQ!\n");
-
reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
if (IS_ERR(reset_gpio))
return PTR_ERR(reset_gpio);
@@ -997,10 +1023,20 @@ static int ili210x_i2c_probe(struct i2c_client *client)
if (error)
return dev_err_probe(dev, error, "Unable to set up slots\n");
- error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
- IRQF_ONESHOT, client->name, priv);
- if (error)
- return dev_err_probe(dev, error, "Unable to request touchscreen IRQ\n");
+ input_set_drvdata(input, priv);
+
+ if (client->irq > 0) {
+ error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
+ IRQF_ONESHOT, client->name, priv);
+ if (error)
+ return dev_err_probe(dev, error, "Unable to request touchscreen IRQ\n");
+ } else {
+ error = input_setup_polling(input, ili210x_work_i2c_poll);
+ if (error)
+ return dev_err_probe(dev, error, "Could not set up polling mode\n");
+
+ input_set_poll_interval(input, ILI2XXX_POLL_PERIOD);
+ }
error = devm_add_action_or_reset(dev, ili210x_stop, priv);
if (error)
--
2.51.0
^ permalink raw reply related
* [PATCH v3 2/3] Input: ili210x - convert to dev_err_probe()
From: Marek Vasut @ 2026-01-15 16:18 UTC (permalink / raw)
To: linux-input
Cc: Marek Vasut, Conor Dooley, Dmitry Torokhov, Frank Li, Job Noorman,
Krzysztof Kozlowski, Rob Herring, devicetree, linux-kernel,
linux-renesas-soc
In-Reply-To: <20260115161858.20226-1-marek.vasut+renesas@mailbox.org>
Simplify error return handling, use dev_err_probe() where possible.
No functional change.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
---
Cc: Conor Dooley <conor+dt@kernel.org>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Frank Li <Frank.Li@nxp.com>
Cc: Job Noorman <job@noorman.info>
Cc: Krzysztof Kozlowski <krzk+dt@kernel.org>
Cc: Rob Herring <robh@kernel.org>
Cc: devicetree@vger.kernel.org
Cc: linux-input@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-renesas-soc@vger.kernel.org
---
V3: New patch
---
drivers/input/touchscreen/ili210x.c | 31 ++++++++++-------------------
1 file changed, 10 insertions(+), 21 deletions(-)
diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c
index fa38d70aded7b..a3c5321d34d7b 100644
--- a/drivers/input/touchscreen/ili210x.c
+++ b/drivers/input/touchscreen/ili210x.c
@@ -942,15 +942,11 @@ static int ili210x_i2c_probe(struct i2c_client *client)
chip = device_get_match_data(dev);
if (!chip && id)
chip = (const struct ili2xxx_chip *)id->driver_data;
- if (!chip) {
- dev_err(&client->dev, "unknown device model\n");
- return -ENODEV;
- }
+ if (!chip)
+ return dev_err_probe(&client->dev, -ENODEV, "unknown device model\n");
- if (client->irq <= 0) {
- dev_err(dev, "No IRQ!\n");
- return -EINVAL;
- }
+ if (client->irq <= 0)
+ dev_err_probe(dev, -EINVAL, "No IRQ!\n");
reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
if (IS_ERR(reset_gpio))
@@ -998,28 +994,21 @@ static int ili210x_i2c_probe(struct i2c_client *client)
error = input_mt_init_slots(input, priv->chip->max_touches,
INPUT_MT_DIRECT);
- if (error) {
- dev_err(dev, "Unable to set up slots, err: %d\n", error);
- return error;
- }
+ if (error)
+ return dev_err_probe(dev, error, "Unable to set up slots\n");
error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
IRQF_ONESHOT, client->name, priv);
- if (error) {
- dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n",
- error);
- return error;
- }
+ if (error)
+ return dev_err_probe(dev, error, "Unable to request touchscreen IRQ\n");
error = devm_add_action_or_reset(dev, ili210x_stop, priv);
if (error)
return error;
error = input_register_device(priv->input);
- if (error) {
- dev_err(dev, "Cannot register input device, err: %d\n", error);
- return error;
- }
+ if (error)
+ return dev_err_probe(dev, error, "Cannot register input device\n");
return 0;
}
--
2.51.0
^ permalink raw reply related
* [PATCH v3 1/3] dt-bindings: touchscreen: trivial-touch: Drop 'interrupts' requirement for old Ilitek
From: Marek Vasut @ 2026-01-15 16:18 UTC (permalink / raw)
To: linux-input
Cc: Marek Vasut, Frank Li, Conor Dooley, Dmitry Torokhov, Job Noorman,
Krzysztof Kozlowski, Rob Herring, devicetree, linux-kernel,
linux-renesas-soc
The old Ilitek touch controllers V3 and V6 can operate without
interrupt line, in polling mode. Drop the 'interrupts' property
requirement for those four controllers. To avoid overloading the
trivial-touch, fork the old Ilitek V3/V6 touch controller binding
into separate document.
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
---
Cc: Conor Dooley <conor+dt@kernel.org>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Frank Li <Frank.Li@nxp.com>
Cc: Job Noorman <job@noorman.info>
Cc: Krzysztof Kozlowski <krzk+dt@kernel.org>
Cc: Rob Herring <robh@kernel.org>
Cc: devicetree@vger.kernel.org
Cc: linux-input@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-renesas-soc@vger.kernel.org
---
V2: Fork the Ilitek V3/V6 bindings into separate document
V3: Add RB from Frank
---
.../input/touchscreen/ilitek,ili210x.yaml | 51 +++++++++++++++++++
.../input/touchscreen/trivial-touch.yaml | 4 --
2 files changed, 51 insertions(+), 4 deletions(-)
create mode 100644 Documentation/devicetree/bindings/input/touchscreen/ilitek,ili210x.yaml
diff --git a/Documentation/devicetree/bindings/input/touchscreen/ilitek,ili210x.yaml b/Documentation/devicetree/bindings/input/touchscreen/ilitek,ili210x.yaml
new file mode 100644
index 0000000000000..1d02aaba64f97
--- /dev/null
+++ b/Documentation/devicetree/bindings/input/touchscreen/ilitek,ili210x.yaml
@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/input/touchscreen/ilitek,ili210x.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Ilitek ILI21xx/ILI251x V3/V6 touch screen controller with i2c interface
+
+maintainers:
+ - Frank Li <Frank.Li@nxp.com>
+ - Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+properties:
+ compatible:
+ enum:
+ - ilitek,ili210x
+ - ilitek,ili2117
+ - ilitek,ili2120
+ - ilitek,ili251x
+
+ reg:
+ maxItems: 1
+
+ interrupts:
+ maxItems: 1
+
+ reset-gpios:
+ maxItems: 1
+
+ wakeup-source: true
+
+allOf:
+ - $ref: touchscreen.yaml
+
+required:
+ - compatible
+ - reg
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ i2c {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ touchscreen@41 {
+ compatible = "ilitek,ili2120";
+ reg = <0x41>;
+ };
+ };
diff --git a/Documentation/devicetree/bindings/input/touchscreen/trivial-touch.yaml b/Documentation/devicetree/bindings/input/touchscreen/trivial-touch.yaml
index fa27c6754ca4e..6441d21223caf 100644
--- a/Documentation/devicetree/bindings/input/touchscreen/trivial-touch.yaml
+++ b/Documentation/devicetree/bindings/input/touchscreen/trivial-touch.yaml
@@ -23,9 +23,6 @@ properties:
# Hynitron cstxxx series touchscreen controller
- hynitron,cst340
# Ilitek I2C Touchscreen Controller
- - ilitek,ili210x
- - ilitek,ili2117
- - ilitek,ili2120
- ilitek,ili2130
- ilitek,ili2131
- ilitek,ili2132
@@ -33,7 +30,6 @@ properties:
- ilitek,ili2322
- ilitek,ili2323
- ilitek,ili2326
- - ilitek,ili251x
- ilitek,ili2520
- ilitek,ili2521
# MAXI MAX11801 Resistive touch screen controller with i2c interface
--
2.51.0
^ permalink raw reply related
* Re: [PATCH v2 2/2] Input: ili210x - add support for polling mode
From: Frank Li @ 2026-01-15 15:29 UTC (permalink / raw)
To: Marek Vasut
Cc: linux-input, Conor Dooley, Dmitry Torokhov, Job Noorman,
Krzysztof Kozlowski, Rob Herring, devicetree, linux-kernel,
linux-renesas-soc
In-Reply-To: <20260115023530.656645-2-marek.vasut+renesas@mailbox.org>
On Thu, Jan 15, 2026 at 03:34:59AM +0100, Marek Vasut wrote:
> There are designs incorporating Ilitek ILI2xxx touch controller that
> do not connect interrupt pin, for example Waveshare 13.3" DSI display.
> To support such systems use polling mode for the input device when I2C
> client does not have interrupt assigned to it.
>
> Factor out ili210x_firmware_update_noirq() to allow conditional scoped
> guard around this code. The scoped guard has to be applied only in case
> the IRQ line is connected, and not applied otherwise.
>
> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
> ---
> Cc: Conor Dooley <conor+dt@kernel.org>
> Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Cc: Frank Li <Frank.Li@nxp.com>
> Cc: Job Noorman <job@noorman.info>
> Cc: Krzysztof Kozlowski <krzk+dt@kernel.org>
> Cc: Rob Herring <robh@kernel.org>
> Cc: devicetree@vger.kernel.org
> Cc: linux-input@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: linux-renesas-soc@vger.kernel.org
> ---
> V2: Test client->irq > 0 for IRQ presence
> ---
> drivers/input/touchscreen/ili210x.c | 84 ++++++++++++++++++++---------
> 1 file changed, 60 insertions(+), 24 deletions(-)
>
> diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c
> index fa38d70aded7b..0574f2e86580f 100644
> --- a/drivers/input/touchscreen/ili210x.c
> +++ b/drivers/input/touchscreen/ili210x.c
> @@ -327,9 +327,8 @@ static bool ili210x_report_events(struct ili210x *priv, u8 *touchdata)
> return contact;
> }
>
...
>
> - error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
> - IRQF_ONESHOT, client->name, priv);
> - if (error) {
> - dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n",
> - error);
> - return error;
> + input_set_drvdata(input, priv);
> +
> + if (client->irq > 0) {
> + error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
> + IRQF_ONESHOT, client->name, priv);
> + if (error) {
> + dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n",
> + error);
> + return error;
return dev_err_probe()
Frank
> + }
> + } else {
> + error = input_setup_polling(input, ili210x_work_i2c_poll);
> + if (error) {
> + dev_err(dev, "Could not set up polling mode, err: %d\n",
> + error);
> + return error;
> + }
> + input_set_poll_interval(input, ILI2XXX_POLL_PERIOD);
> }
>
> error = devm_add_action_or_reset(dev, ili210x_stop, priv);
> --
> 2.51.0
>
^ permalink raw reply
* Re: [PATCH v2 1/2] dt-bindings: touchscreen: trivial-touch: Drop 'interrupts' requirement for old Ilitek
From: Frank Li @ 2026-01-15 15:25 UTC (permalink / raw)
To: Marek Vasut
Cc: linux-input, Conor Dooley, Dmitry Torokhov, Job Noorman,
Krzysztof Kozlowski, Rob Herring, devicetree, linux-kernel,
linux-renesas-soc
In-Reply-To: <20260115023530.656645-1-marek.vasut+renesas@mailbox.org>
On Thu, Jan 15, 2026 at 03:34:58AM +0100, Marek Vasut wrote:
> The old Ilitek touch controllers V3 and V6 can operate without
> interrupt line, in polling mode. Drop the 'interrupts' property
> requirement for those four controllers. To avoid overloading the
> trivial-touch, fork the old Ilitek V3/V6 touch controller binding
> into separate document.
>
> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
> ---
Reviewed-by: Frank Li <Frank.Li@nxp.com>
> Cc: Conor Dooley <conor+dt@kernel.org>
> Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Cc: Frank Li <Frank.Li@nxp.com>
> Cc: Job Noorman <job@noorman.info>
> Cc: Krzysztof Kozlowski <krzk+dt@kernel.org>
> Cc: Rob Herring <robh@kernel.org>
> Cc: devicetree@vger.kernel.org
> Cc: linux-input@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: linux-renesas-soc@vger.kernel.org
> ---
> V2: Fork the Ilitek V3/V6 bindings into separate document
> ---
> .../input/touchscreen/ilitek,ili210x.yaml | 51 +++++++++++++++++++
> .../input/touchscreen/trivial-touch.yaml | 4 --
> 2 files changed, 51 insertions(+), 4 deletions(-)
> create mode 100644 Documentation/devicetree/bindings/input/touchscreen/ilitek,ili210x.yaml
>
> diff --git a/Documentation/devicetree/bindings/input/touchscreen/ilitek,ili210x.yaml b/Documentation/devicetree/bindings/input/touchscreen/ilitek,ili210x.yaml
> new file mode 100644
> index 0000000000000..1d02aaba64f97
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/input/touchscreen/ilitek,ili210x.yaml
> @@ -0,0 +1,51 @@
> +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +%YAML 1.2
> +---
> +$id: http://devicetree.org/schemas/input/touchscreen/ilitek,ili210x.yaml#
> +$schema: http://devicetree.org/meta-schemas/core.yaml#
> +
> +title: Ilitek ILI21xx/ILI251x V3/V6 touch screen controller with i2c interface
> +
> +maintainers:
> + - Frank Li <Frank.Li@nxp.com>
> + - Marek Vasut <marek.vasut+renesas@mailbox.org>
> +
> +properties:
> + compatible:
> + enum:
> + - ilitek,ili210x
> + - ilitek,ili2117
> + - ilitek,ili2120
> + - ilitek,ili251x
> +
> + reg:
> + maxItems: 1
> +
> + interrupts:
> + maxItems: 1
> +
> + reset-gpios:
> + maxItems: 1
> +
> + wakeup-source: true
> +
> +allOf:
> + - $ref: touchscreen.yaml
> +
> +required:
> + - compatible
> + - reg
> +
> +unevaluatedProperties: false
> +
> +examples:
> + - |
> + i2c {
> + #address-cells = <1>;
> + #size-cells = <0>;
> +
> + touchscreen@41 {
> + compatible = "ilitek,ili2120";
> + reg = <0x41>;
> + };
> + };
> diff --git a/Documentation/devicetree/bindings/input/touchscreen/trivial-touch.yaml b/Documentation/devicetree/bindings/input/touchscreen/trivial-touch.yaml
> index fa27c6754ca4e..6441d21223caf 100644
> --- a/Documentation/devicetree/bindings/input/touchscreen/trivial-touch.yaml
> +++ b/Documentation/devicetree/bindings/input/touchscreen/trivial-touch.yaml
> @@ -23,9 +23,6 @@ properties:
> # Hynitron cstxxx series touchscreen controller
> - hynitron,cst340
> # Ilitek I2C Touchscreen Controller
> - - ilitek,ili210x
> - - ilitek,ili2117
> - - ilitek,ili2120
> - ilitek,ili2130
> - ilitek,ili2131
> - ilitek,ili2132
> @@ -33,7 +30,6 @@ properties:
> - ilitek,ili2322
> - ilitek,ili2323
> - ilitek,ili2326
> - - ilitek,ili251x
> - ilitek,ili2520
> - ilitek,ili2521
> # MAXI MAX11801 Resistive touch screen controller with i2c interface
> --
> 2.51.0
>
^ permalink raw reply
* Re: [PATCH] HID: logitech-hidpp: fix NULL pointer dereference in hidpp_get_report_length()
From: 齐柯宇 @ 2026-01-15 15:20 UTC (permalink / raw)
To: jikos, bentiss; +Cc: Bastien Nocera, lains, linux-input, linux-kernel, hansg
In-Reply-To: <20260115142417.243-1-qikeyu2017@gmail.com>
Hello,
Thanks for the feedback.
Best regards
Kery
Kery Qi <qikeyu2017@gmail.com> 于2026年1月15日周四 22:24写道：
>
> Add validation for report->maxfield and report->field[0] before
> dereferencing to prevent NULL pointer dereference.
>
> The HID report descriptor is provided by the USB device firmware via
> USB control transfer (GET_DESCRIPTOR). A malicious device can craft
> a descriptor that defines an OUTPUT report without any usages
> (padding fields). When the HID subsystem parses such a descriptor:
>
> 1. hid_add_field() calls hid_register_report() to create the report
> object and stores it in report_id_hash[id]
> 2. Since parser->local.usage_index is 0, hid_add_field() returns early
> without calling hid_register_field() to add any fields
> 3. Result: report exists with maxfield=0 and field[0]=NULL
>
> When hidpp_probe() is called for a device matching this driver:
> - hidpp_validate_device() calls hidpp_get_report_length()
> - hidpp_get_report_length() retrieves the report from hash (not NULL)
> - It then dereferences report->field[0]->report_count
> - Since field[0] is NULL, this triggers a kernel NULL pointer
> dereference
>
> Data flow from attacker to crash:
> Malicious USB Device
> |
> v (USB GET_DESCRIPTOR control transfer)
> hid_get_class_descriptor() -- reads HID report descriptor from device
> |
> v
> hid_parse_report() -- stores descriptor in hid->dev_rdesc
> |
> v
> hid_open_report() -> hid_add_field()
> | |
> | v
> | hid_register_report() -- creates report, maxfield=0
> | |
> | v
> | returns early if usage_index==0, no field added
> |
> v
> hidpp_validate_device() -> hidpp_get_report_length()
> |
> v
> report->field[0]->report_count -- NULL pointer dereference!
>
> This is triggerable by an attacker with physical access using a
> malicious USB device (e.g., BadUSB, programmable USB development
> boards).
>
> Fixes: d71b18f7c7999 ("HID: logitech-hidpp: do not hardcode very long report length")
> Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
> ---
> drivers/hid/hid-logitech-hidpp.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
> index d5011a5d0890..02ddbd658e89 100644
> --- a/drivers/hid/hid-logitech-hidpp.c
> +++ b/drivers/hid/hid-logitech-hidpp.c
> @@ -4314,7 +4314,7 @@ static int hidpp_get_report_length(struct hid_device *hdev, int id)
>
> re = &(hdev->report_enum[HID_OUTPUT_REPORT]);
> report = re->report_id_hash[id];
> - if (!report)
> + if (!report || report->maxfield < 1 || !report->field[0])
> return 0;
>
> return report->field[0]->report_count + 1;
> --
> 2.34.1
>
^ permalink raw reply
* Re: [PATCH] HID: logitech-hidpp: fix NULL pointer dereference in hidpp_get_report_length()
From: Bastien Nocera @ 2026-01-15 14:42 UTC (permalink / raw)
To: Kery Qi, jikos, bentiss; +Cc: lains, hansg, linux-input, linux-kernel
In-Reply-To: <20260115142417.243-1-qikeyu2017@gmail.com>
On Thu, 2026-01-15 at 22:24 +0800, Kery Qi wrote:
<snip>
> - if (!report)
> + if (!report || report->maxfield < 1 || !report->field[0])
A partial fix already exists in the for-next branch:
https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git/commit/?h=for-next&id=1547d41f9f19d691c2c9ce4c29f746297baef9e9
You'll probably want to rebase and adapt your fix. See also this review
by GregKH for v1:
https://patchwork.kernel.org/project/linux-input/patch/20260109105912.3141960-2-gnoack@google.com/
Cheers
> return 0;
>
> return report->field[0]->report_count + 1;
^ permalink raw reply
* [PATCH] HID: logitech-hidpp: fix NULL pointer dereference in hidpp_get_report_length()
From: Kery Qi @ 2026-01-15 14:24 UTC (permalink / raw)
To: jikos, bentiss; +Cc: lains, hadess, hansg, linux-input, linux-kernel, Kery Qi
Add validation for report->maxfield and report->field[0] before
dereferencing to prevent NULL pointer dereference.
The HID report descriptor is provided by the USB device firmware via
USB control transfer (GET_DESCRIPTOR). A malicious device can craft
a descriptor that defines an OUTPUT report without any usages
(padding fields). When the HID subsystem parses such a descriptor:
1. hid_add_field() calls hid_register_report() to create the report
object and stores it in report_id_hash[id]
2. Since parser->local.usage_index is 0, hid_add_field() returns early
without calling hid_register_field() to add any fields
3. Result: report exists with maxfield=0 and field[0]=NULL
When hidpp_probe() is called for a device matching this driver:
- hidpp_validate_device() calls hidpp_get_report_length()
- hidpp_get_report_length() retrieves the report from hash (not NULL)
- It then dereferences report->field[0]->report_count
- Since field[0] is NULL, this triggers a kernel NULL pointer
dereference
Data flow from attacker to crash:
Malicious USB Device
|
v (USB GET_DESCRIPTOR control transfer)
hid_get_class_descriptor() -- reads HID report descriptor from device
|
v
hid_parse_report() -- stores descriptor in hid->dev_rdesc
|
v
hid_open_report() -> hid_add_field()
| |
| v
| hid_register_report() -- creates report, maxfield=0
| |
| v
| returns early if usage_index==0, no field added
|
v
hidpp_validate_device() -> hidpp_get_report_length()
|
v
report->field[0]->report_count -- NULL pointer dereference!
This is triggerable by an attacker with physical access using a
malicious USB device (e.g., BadUSB, programmable USB development
boards).
Fixes: d71b18f7c7999 ("HID: logitech-hidpp: do not hardcode very long report length")
Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
---
drivers/hid/hid-logitech-hidpp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index d5011a5d0890..02ddbd658e89 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -4314,7 +4314,7 @@ static int hidpp_get_report_length(struct hid_device *hdev, int id)
re = &(hdev->report_enum[HID_OUTPUT_REPORT]);
report = re->report_id_hash[id];
- if (!report)
+ if (!report || report->maxfield < 1 || !report->field[0])
return 0;
return report->field[0]->report_count + 1;
--
2.34.1
^ permalink raw reply related
* Re: [PATCH] HID: logitech-hidpp: fix NULL pointer dereference in hidpp_get_report_length()
From: 齐柯宇 @ 2026-01-15 14:17 UTC (permalink / raw)
To: Bastien Nocera; +Cc: jikos, bentiss, lains, hansg, linux-input, linux-kernel
In-Reply-To: <09efd83ea70771f8ce1feaf7d7172b72970d8d55.camel@hadess.net>
Hello,
Thank you for the review. I apologize for the format issue and will
resend the patch as plain text following the documentation guidelines.
Best regards,
Kery
Bastien Nocera <hadess@hadess.net> 于2026年1月15日周四 20:03写道：
>
> Hello,
>
> Patch looks good, but you will need to resend it as plain text, as per
> the submitting patches documentation:
> https://www.kernel.org/doc/html/v6.17/process/submitting-patches.html#no-mime-no-links-no-compression-no-attachments-just-plain-text
>
> Regards
>
> On Thu, 2026-01-15 at 01:48 +0800, 齐柯宇 wrote:
> > Add validation for report->maxfield and report->field[0] before
> > dereferencing to prevent NULL pointer dereference.
> >
> > The HID report descriptor is provided by the USB device firmware via
> > USB control transfer (GET_DESCRIPTOR). A malicious device can craft
> > a descriptor that defines an OUTPUT report without any usages
> > (padding fields). When the HID subsystem parses such a descriptor:
> >
> > 1. hid_add_field() calls hid_register_report() to create the report
> > object and stores it in report_id_hash[id]
> > 2. Since parser->local.usage_index is 0, hid_add_field() returns
> > early
> > without calling hid_register_field() to add any fields
> > 3. Result: report exists with maxfield=0 and field[0]=NULL
> >
> > When hidpp_probe() is called for a device matching this driver:
> > - hidpp_validate_device() calls hidpp_get_report_length()
> > - hidpp_get_report_length() retrieves the report from hash (not
> > NULL)
> > - It then dereferences report->field[0]->report_count
> > - Since field[0] is NULL, this triggers a kernel NULL pointer
> > dereference
> >
> > Data flow from attacker to crash:
> > Malicious USB Device
> > |
> > v (USB GET_DESCRIPTOR control transfer)
> > hid_get_class_descriptor() -- reads HID report descriptor from
> > device
> > |
> > v
> > hid_parse_report() -- stores descriptor in hid->dev_rdesc
> > |
> > v
> > hid_open_report() -> hid_add_field()
> > | |
> > | v
> > | hid_register_report() -- creates report,
> > maxfield=0
> > | |
> > | v
> > | returns early if usage_index==0, no field added
> > |
> > v
> > hidpp_validate_device() -> hidpp_get_report_length()
> > |
> > v
> > report->field[0]->report_count -- NULL pointer dereference!
> >
> > This is triggerable by an attacker with physical access using a
> > malicious USB device (e.g., BadUSB, programmable USB development
> > boards).
> >
> > Fixes: d71b18f7c7999 ("HID: logitech-hidpp: do not hardcode very long
> > report length")
> > Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
> > ---
> > drivers/hid/hid-logitech-hidpp.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-
> > logitech-hidpp.c
> > index d5011a5d0890..02ddbd658e89 100644
> > --- a/drivers/hid/hid-logitech-hidpp.c
> > +++ b/drivers/hid/hid-logitech-hidpp.c
> > @@ -4314,7 +4314,7 @@ static int hidpp_get_report_length(struct
> > hid_device *hdev, int id)
> >
> > re = &(hdev->report_enum[HID_OUTPUT_REPORT]);
> > report = re->report_id_hash[id];
> > - if (!report)
> > + if (!report || report->maxfield < 1 || !report->field[0])
> > return 0;
> >
> > return report->field[0]->report_count + 1;
> > --
> > 2.34.1
^ permalink raw reply
* Re: [PATCH] HID: logitech-hidpp: fix NULL pointer dereference in hidpp_get_report_length()
From: Bastien Nocera @ 2026-01-15 12:03 UTC (permalink / raw)
To: 齐柯宇, jikos, bentiss
Cc: lains, hansg, linux-input, linux-kernel
In-Reply-To: <CALEuBa=E1YSo1oVxd67rBf+6bC28zQZi5HBghMmcPFHKQn2+UA@mail.gmail.com>
Hello,
Patch looks good, but you will need to resend it as plain text, as per
the submitting patches documentation:
https://www.kernel.org/doc/html/v6.17/process/submitting-patches.html#no-mime-no-links-no-compression-no-attachments-just-plain-text
Regards
On Thu, 2026-01-15 at 01:48 +0800, 齐柯宇 wrote:
> Add validation for report->maxfield and report->field[0] before
> dereferencing to prevent NULL pointer dereference.
>
> The HID report descriptor is provided by the USB device firmware via
> USB control transfer (GET_DESCRIPTOR). A malicious device can craft
> a descriptor that defines an OUTPUT report without any usages
> (padding fields). When the HID subsystem parses such a descriptor:
>
> 1. hid_add_field() calls hid_register_report() to create the report
> object and stores it in report_id_hash[id]
> 2. Since parser->local.usage_index is 0, hid_add_field() returns
> early
> without calling hid_register_field() to add any fields
> 3. Result: report exists with maxfield=0 and field[0]=NULL
>
> When hidpp_probe() is called for a device matching this driver:
> - hidpp_validate_device() calls hidpp_get_report_length()
> - hidpp_get_report_length() retrieves the report from hash (not
> NULL)
> - It then dereferences report->field[0]->report_count
> - Since field[0] is NULL, this triggers a kernel NULL pointer
> dereference
>
> Data flow from attacker to crash:
> Malicious USB Device
> |
> v (USB GET_DESCRIPTOR control transfer)
> hid_get_class_descriptor() -- reads HID report descriptor from
> device
> |
> v
> hid_parse_report() -- stores descriptor in hid->dev_rdesc
> |
> v
> hid_open_report() -> hid_add_field()
> | |
> | v
> | hid_register_report() -- creates report,
> maxfield=0
> | |
> | v
> | returns early if usage_index==0, no field added
> |
> v
> hidpp_validate_device() -> hidpp_get_report_length()
> |
> v
> report->field[0]->report_count -- NULL pointer dereference!
>
> This is triggerable by an attacker with physical access using a
> malicious USB device (e.g., BadUSB, programmable USB development
> boards).
>
> Fixes: d71b18f7c7999 ("HID: logitech-hidpp: do not hardcode very long
> report length")
> Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
> ---
> drivers/hid/hid-logitech-hidpp.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-
> logitech-hidpp.c
> index d5011a5d0890..02ddbd658e89 100644
> --- a/drivers/hid/hid-logitech-hidpp.c
> +++ b/drivers/hid/hid-logitech-hidpp.c
> @@ -4314,7 +4314,7 @@ static int hidpp_get_report_length(struct
> hid_device *hdev, int id)
>
> re = &(hdev->report_enum[HID_OUTPUT_REPORT]);
> report = re->report_id_hash[id];
> - if (!report)
> + if (!report || report->maxfield < 1 || !report->field[0])
> return 0;
>
> return report->field[0]->report_count + 1;
> --
> 2.34.1
^ permalink raw reply
* Re: [PATCH v2 1/3] dt-bindings: input: touchscreen: edt-ft5x06: Add FocalTech FT3518
From: Krzysztof Kozlowski @ 2026-01-15 9:31 UTC (permalink / raw)
To: Yedaya Katsman
Cc: SzczurekYT, Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Bjorn Andersson, Konrad Dybcio, linux-input,
devicetree, linux-kernel, linux-arm-msm, Kamil Gołda
In-Reply-To: <20260114-touchscreen-patches-v2-1-4215f94c8aba@gmail.com>
On Wed, Jan 14, 2026 at 11:31:06AM +0200, Yedaya Katsman wrote:
> Document FocalTech FT3518 support by adding the compatible.
>
> Co-developed-by: Kamil Gołda <kamil.golda@protonmail.com>
> Signed-off-by: Kamil Gołda <kamil.golda@protonmail.com>
> Signed-off-by: Yedaya Katsman <yedaya.ka@gmail.com>
> ---
> Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.yaml | 1 +
> 1 file changed, 1 insertion(+)
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Best regards,
Krzysztof
^ permalink raw reply
* Re: [PATCH 2/2] Input: ili210x - add support for polling mode
From: Marek Vasut @ 2026-01-15 2:10 UTC (permalink / raw)
To: Frank Li
Cc: linux-input, Conor Dooley, Dmitry Torokhov, Job Noorman,
Krzysztof Kozlowski, Rob Herring, devicetree, linux-kernel,
linux-renesas-soc
In-Reply-To: <aWZ1pG5RRWlDSCwC@lizhi-Precision-Tower-5810>
On 1/13/26 5:41 PM, Frank Li wrote:
[...]
>> @@ -1003,12 +1027,24 @@ static int ili210x_i2c_probe(struct i2c_client *client)
>> return error;
>> }
>>
>> - error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
>> - IRQF_ONESHOT, client->name, priv);
>> - if (error) {
>> - dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n",
>> - error);
>> - return error;
>> + input_set_drvdata(input, priv);
>> +
>> + if (client->irq) {
>
> 0 is validated irq number
>
> https://elixir.bootlin.com/linux/v6.19-rc4/source/drivers/base/platform.c#L284
>
> if (irq < 0)
>
> But it is strange that touch don't connect irq line althougth it works,
> touch generally is wakeup source of system.
Raspi is like that, they poll the touch controllers. It is unfortunate.
^ permalink raw reply
* Re: [PATCH 1/2] dt-bindings: touchscreen: trivial-touch: Drop 'interrupts' requirement for old Ilitek
From: Marek Vasut @ 2026-01-15 2:09 UTC (permalink / raw)
To: Frank Li, Marek Vasut
Cc: linux-input, Conor Dooley, Dmitry Torokhov, Job Noorman,
Krzysztof Kozlowski, Rob Herring, devicetree, linux-kernel,
linux-renesas-soc
In-Reply-To: <aWZ0OQpQw814smri@lizhi-Precision-Tower-5810>
On 1/13/26 5:35 PM, Frank Li wrote:
Hello Frank,
>> +++ b/Documentation/devicetree/bindings/input/touchscreen/trivial-touch.yaml
>> @@ -57,13 +57,25 @@ properties:
>>
>> wakeup-source: true
>>
>> -allOf:
>> - - $ref: touchscreen.yaml
>> -
>> required:
>> - compatible
>> - reg
>> - - interrupts
>> +
>> +allOf:
>> + - $ref: touchscreen.yaml
>> + - if:
>> + not:
>> + properties:
>> + compatible:
>> + contains:
>> + enum:
>> + - ilitek,ili210x
>> + - ilitek,ili2117
>> + - ilitek,ili2120
>> + - ilitek,ili251x
>> + then:
>> + required:
>> + - interrupts
>
> Generally, if there are special requirements, move these to dedicated
> yaml file to avoid complex if-else in trivial-touch.yaml.
Done in V2, thanks.
^ permalink raw reply
* [PATCH v2 2/2] Input: ili210x - add support for polling mode
From: Marek Vasut @ 2026-01-15 2:34 UTC (permalink / raw)
To: linux-input
Cc: Marek Vasut, Conor Dooley, Dmitry Torokhov, Frank Li, Job Noorman,
Krzysztof Kozlowski, Rob Herring, devicetree, linux-kernel,
linux-renesas-soc
In-Reply-To: <20260115023530.656645-1-marek.vasut+renesas@mailbox.org>
There are designs incorporating Ilitek ILI2xxx touch controller that
do not connect interrupt pin, for example Waveshare 13.3" DSI display.
To support such systems use polling mode for the input device when I2C
client does not have interrupt assigned to it.
Factor out ili210x_firmware_update_noirq() to allow conditional scoped
guard around this code. The scoped guard has to be applied only in case
the IRQ line is connected, and not applied otherwise.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
---
Cc: Conor Dooley <conor+dt@kernel.org>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Frank Li <Frank.Li@nxp.com>
Cc: Job Noorman <job@noorman.info>
Cc: Krzysztof Kozlowski <krzk+dt@kernel.org>
Cc: Rob Herring <robh@kernel.org>
Cc: devicetree@vger.kernel.org
Cc: linux-input@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-renesas-soc@vger.kernel.org
---
V2: Test client->irq > 0 for IRQ presence
---
drivers/input/touchscreen/ili210x.c | 84 ++++++++++++++++++++---------
1 file changed, 60 insertions(+), 24 deletions(-)
diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c
index fa38d70aded7b..0574f2e86580f 100644
--- a/drivers/input/touchscreen/ili210x.c
+++ b/drivers/input/touchscreen/ili210x.c
@@ -327,9 +327,8 @@ static bool ili210x_report_events(struct ili210x *priv, u8 *touchdata)
return contact;
}
-static irqreturn_t ili210x_irq(int irq, void *irq_data)
+static void ili210x_process_events(struct ili210x *priv)
{
- struct ili210x *priv = irq_data;
struct i2c_client *client = priv->client;
const struct ili2xxx_chip *chip = priv->chip;
u8 touchdata[ILI210X_DATA_SIZE] = { 0 };
@@ -356,8 +355,22 @@ static irqreturn_t ili210x_irq(int irq, void *irq_data)
usleep_range(time_delta, time_delta + 1000);
}
} while (!priv->stop && keep_polling);
+}
+
+static irqreturn_t ili210x_irq(int irq, void *irq_data)
+{
+ struct ili210x *priv = irq_data;
+
+ ili210x_process_events(priv);
return IRQ_HANDLED;
+};
+
+static void ili210x_work_i2c_poll(struct input_dev *input)
+{
+ struct ili210x *priv = input_get_drvdata(input);
+
+ ili210x_process_events(priv);
}
static int ili251x_firmware_update_resolution(struct device *dev)
@@ -829,12 +842,32 @@ static int ili210x_do_firmware_update(struct ili210x *priv,
return 0;
}
+static ssize_t ili210x_firmware_update_noirq(struct device *dev,
+ const u8 *fwbuf, u16 ac_end, u16 df_end)
+{
+ struct i2c_client *client = to_i2c_client(dev);
+ struct ili210x *priv = i2c_get_clientdata(client);
+ const char *fwname = ILI251X_FW_FILENAME;
+ int error;
+
+ dev_dbg(dev, "Firmware update started, firmware=%s\n", fwname);
+
+ ili210x_hardware_reset(priv->reset_gpio);
+
+ error = ili210x_do_firmware_update(priv, fwbuf, ac_end, df_end);
+
+ ili210x_hardware_reset(priv->reset_gpio);
+
+ dev_dbg(dev, "Firmware update ended, error=%i\n", error);
+
+ return error;
+}
+
static ssize_t ili210x_firmware_update_store(struct device *dev,
struct device_attribute *attr,
const char *buf, size_t count)
{
struct i2c_client *client = to_i2c_client(dev);
- struct ili210x *priv = i2c_get_clientdata(client);
const char *fwname = ILI251X_FW_FILENAME;
u16 ac_end, df_end;
int error;
@@ -860,16 +893,12 @@ static ssize_t ili210x_firmware_update_store(struct device *dev,
* the touch controller to disable the IRQs during update, so we have
* to do it this way here.
*/
- scoped_guard(disable_irq, &client->irq) {
- dev_dbg(dev, "Firmware update started, firmware=%s\n", fwname);
-
- ili210x_hardware_reset(priv->reset_gpio);
-
- error = ili210x_do_firmware_update(priv, fwbuf, ac_end, df_end);
-
- ili210x_hardware_reset(priv->reset_gpio);
-
- dev_dbg(dev, "Firmware update ended, error=%i\n", error);
+ if (!client->irq) {
+ scoped_guard(disable_irq, &client->irq) {
+ error = ili210x_firmware_update_noirq(dev, fwbuf, ac_end, df_end);
+ }
+ } else {
+ error = ili210x_firmware_update_noirq(dev, fwbuf, ac_end, df_end);
}
return error ?: count;
@@ -947,11 +976,6 @@ static int ili210x_i2c_probe(struct i2c_client *client)
return -ENODEV;
}
- if (client->irq <= 0) {
- dev_err(dev, "No IRQ!\n");
- return -EINVAL;
- }
-
reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
if (IS_ERR(reset_gpio))
return PTR_ERR(reset_gpio);
@@ -1003,12 +1027,24 @@ static int ili210x_i2c_probe(struct i2c_client *client)
return error;
}
- error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
- IRQF_ONESHOT, client->name, priv);
- if (error) {
- dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n",
- error);
- return error;
+ input_set_drvdata(input, priv);
+
+ if (client->irq > 0) {
+ error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
+ IRQF_ONESHOT, client->name, priv);
+ if (error) {
+ dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n",
+ error);
+ return error;
+ }
+ } else {
+ error = input_setup_polling(input, ili210x_work_i2c_poll);
+ if (error) {
+ dev_err(dev, "Could not set up polling mode, err: %d\n",
+ error);
+ return error;
+ }
+ input_set_poll_interval(input, ILI2XXX_POLL_PERIOD);
}
error = devm_add_action_or_reset(dev, ili210x_stop, priv);
--
2.51.0
^ permalink raw reply related
* [PATCH v2 1/2] dt-bindings: touchscreen: trivial-touch: Drop 'interrupts' requirement for old Ilitek
From: Marek Vasut @ 2026-01-15 2:34 UTC (permalink / raw)
To: linux-input
Cc: Marek Vasut, Conor Dooley, Dmitry Torokhov, Frank Li, Job Noorman,
Krzysztof Kozlowski, Rob Herring, devicetree, linux-kernel,
linux-renesas-soc
The old Ilitek touch controllers V3 and V6 can operate without
interrupt line, in polling mode. Drop the 'interrupts' property
requirement for those four controllers. To avoid overloading the
trivial-touch, fork the old Ilitek V3/V6 touch controller binding
into separate document.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
---
Cc: Conor Dooley <conor+dt@kernel.org>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Frank Li <Frank.Li@nxp.com>
Cc: Job Noorman <job@noorman.info>
Cc: Krzysztof Kozlowski <krzk+dt@kernel.org>
Cc: Rob Herring <robh@kernel.org>
Cc: devicetree@vger.kernel.org
Cc: linux-input@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-renesas-soc@vger.kernel.org
---
V2: Fork the Ilitek V3/V6 bindings into separate document
---
.../input/touchscreen/ilitek,ili210x.yaml | 51 +++++++++++++++++++
.../input/touchscreen/trivial-touch.yaml | 4 --
2 files changed, 51 insertions(+), 4 deletions(-)
create mode 100644 Documentation/devicetree/bindings/input/touchscreen/ilitek,ili210x.yaml
diff --git a/Documentation/devicetree/bindings/input/touchscreen/ilitek,ili210x.yaml b/Documentation/devicetree/bindings/input/touchscreen/ilitek,ili210x.yaml
new file mode 100644
index 0000000000000..1d02aaba64f97
--- /dev/null
+++ b/Documentation/devicetree/bindings/input/touchscreen/ilitek,ili210x.yaml
@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/input/touchscreen/ilitek,ili210x.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Ilitek ILI21xx/ILI251x V3/V6 touch screen controller with i2c interface
+
+maintainers:
+ - Frank Li <Frank.Li@nxp.com>
+ - Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+properties:
+ compatible:
+ enum:
+ - ilitek,ili210x
+ - ilitek,ili2117
+ - ilitek,ili2120
+ - ilitek,ili251x
+
+ reg:
+ maxItems: 1
+
+ interrupts:
+ maxItems: 1
+
+ reset-gpios:
+ maxItems: 1
+
+ wakeup-source: true
+
+allOf:
+ - $ref: touchscreen.yaml
+
+required:
+ - compatible
+ - reg
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ i2c {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ touchscreen@41 {
+ compatible = "ilitek,ili2120";
+ reg = <0x41>;
+ };
+ };
diff --git a/Documentation/devicetree/bindings/input/touchscreen/trivial-touch.yaml b/Documentation/devicetree/bindings/input/touchscreen/trivial-touch.yaml
index fa27c6754ca4e..6441d21223caf 100644
--- a/Documentation/devicetree/bindings/input/touchscreen/trivial-touch.yaml
+++ b/Documentation/devicetree/bindings/input/touchscreen/trivial-touch.yaml
@@ -23,9 +23,6 @@ properties:
# Hynitron cstxxx series touchscreen controller
- hynitron,cst340
# Ilitek I2C Touchscreen Controller
- - ilitek,ili210x
- - ilitek,ili2117
- - ilitek,ili2120
- ilitek,ili2130
- ilitek,ili2131
- ilitek,ili2132
@@ -33,7 +30,6 @@ properties:
- ilitek,ili2322
- ilitek,ili2323
- ilitek,ili2326
- - ilitek,ili251x
- ilitek,ili2520
- ilitek,ili2521
# MAXI MAX11801 Resistive touch screen controller with i2c interface
--
2.51.0
^ permalink raw reply related
* Re: (subset) [PATCH v4 0/6] dt-bindings: goldfish: Convert to DT schema
From: Mark Brown @ 2026-01-14 21:36 UTC (permalink / raw)
To: airlied, simona, maarten.lankhorst, mripard, tzimmermann, robh,
krzk+dt, conor+dt, dmitry.torokhov, sre, gregkh, jirislaby,
lgirdwood, Kuan-Wei Chiu
Cc: jserv, dri-devel, devicetree, linux-kernel, linux-input, linux-pm,
linux-serial, linux-sound, Yu-Chun Lin
In-Reply-To: <20260113092602.3197681-1-visitorckw@gmail.com>
On Tue, 13 Jan 2026 09:25:56 +0000, Kuan-Wei Chiu wrote:
> Convert the Android Goldfish emulator platform bindings from text
> format to DT schema.
>
> Most of these bindings are currently located in
> Documentation/devicetree/bindings/goldfish/. Move them to the
> appropriate subsystem directories (serial, input, power, sound, misc)
> to align with the kernel directory structure.
>
> [...]
Applied to
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next
Thanks!
[5/6] dt-bindings: sound: google,goldfish-audio: Convert to DT schema
commit: 10303b32519f52a5afd40593a507543143c8ec6a
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
^ permalink raw reply
* Re: [PATCH v4 2/6] dt-bindings: misc: google,android-pipe: Convert to DT schema
From: Rob Herring (Arm) @ 2026-01-14 20:27 UTC (permalink / raw)
To: Kuan-Wei Chiu
Cc: broonie, lgirdwood, conor+dt, linux-serial, simona,
maarten.lankhorst, eleanor15x, airlied, linux-pm, tzimmermann,
dri-devel, mripard, Krzysztof Kozlowski, linux-sound, gregkh,
jserv, krzk+dt, dmitry.torokhov, devicetree, jirislaby,
linux-input, linux-kernel, sre
In-Reply-To: <20260113092602.3197681-3-visitorckw@gmail.com>
On Tue, 13 Jan 2026 09:25:58 +0000, Kuan-Wei Chiu wrote:
> Convert the Android Goldfish QEMU Pipe binding to DT schema format.
> Move the file to the misc directory as it represents a miscellaneous
> communication device.
> Update the example node name to 'pipe' to comply with generic node
> naming standards and fix the mismatch between unit address and reg
> property in the original example.
>
> Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> ---
> Changes in v4:
> - Use decimal format for interrupts in the example.
>
> .../devicetree/bindings/goldfish/pipe.txt | 17 ---------
> .../bindings/misc/google,android-pipe.yaml | 38 +++++++++++++++++++
> 2 files changed, 38 insertions(+), 17 deletions(-)
> delete mode 100644 Documentation/devicetree/bindings/goldfish/pipe.txt
> create mode 100644 Documentation/devicetree/bindings/misc/google,android-pipe.yaml
>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
^ permalink raw reply
* [dtor-input:next] BUILD SUCCESS f8a6e5eac701369afb5d69aba875dc5fec93003d
From: kernel test robot @ 2026-01-14 20:15 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git next
branch HEAD: f8a6e5eac701369afb5d69aba875dc5fec93003d Input: adp5589 - remove a leftover header file
elapsed time: 804m
configs tested: 197
configs skipped: 2
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-15.2.0
alpha allyesconfig gcc-15.2.0
alpha defconfig gcc-15.2.0
arc allmodconfig clang-16
arc allnoconfig gcc-15.2.0
arc allyesconfig clang-22
arc defconfig gcc-15.2.0
arc hsdk_defconfig gcc-15.2.0
arc nsimosci_hs_smp_defconfig gcc-15.2.0
arc randconfig-001-20260114 gcc-10.5.0
arc randconfig-002-20260114 gcc-10.5.0
arm allnoconfig gcc-15.2.0
arm allyesconfig clang-16
arm at91_dt_defconfig clang-22
arm defconfig gcc-15.2.0
arm ep93xx_defconfig gcc-15.2.0
arm hisi_defconfig gcc-15.2.0
arm ixp4xx_defconfig clang-22
arm moxart_defconfig clang-22
arm randconfig-001-20260114 gcc-10.5.0
arm randconfig-002-20260114 gcc-10.5.0
arm randconfig-003-20260114 gcc-10.5.0
arm randconfig-004-20260114 gcc-10.5.0
arm s5pv210_defconfig gcc-15.2.0
arm sama7_defconfig clang-22
arm shmobile_defconfig gcc-15.2.0
arm spear13xx_defconfig gcc-15.2.0
arm64 allmodconfig clang-22
arm64 allnoconfig gcc-15.2.0
arm64 defconfig gcc-15.2.0
arm64 randconfig-001-20260114 clang-22
arm64 randconfig-002-20260114 clang-22
arm64 randconfig-003-20260114 clang-22
arm64 randconfig-004-20260114 clang-22
csky allmodconfig gcc-15.2.0
csky allnoconfig gcc-15.2.0
csky defconfig gcc-15.2.0
csky randconfig-001-20260114 clang-22
csky randconfig-002-20260114 clang-22
hexagon allmodconfig gcc-15.2.0
hexagon allnoconfig gcc-15.2.0
hexagon defconfig gcc-15.2.0
hexagon randconfig-001-20260114 clang-22
hexagon randconfig-002-20260114 clang-22
i386 allmodconfig clang-20
i386 allnoconfig gcc-15.2.0
i386 allyesconfig clang-20
i386 buildonly-randconfig-001-20260114 gcc-14
i386 buildonly-randconfig-002-20260114 gcc-14
i386 buildonly-randconfig-003-20260114 gcc-14
i386 buildonly-randconfig-004-20260114 gcc-14
i386 buildonly-randconfig-005-20260114 gcc-14
i386 buildonly-randconfig-006-20260114 gcc-14
i386 defconfig gcc-15.2.0
i386 randconfig-001-20260114 gcc-14
i386 randconfig-002-20260114 gcc-14
i386 randconfig-003-20260114 gcc-14
i386 randconfig-004-20260114 gcc-14
i386 randconfig-005-20260114 gcc-14
i386 randconfig-006-20260114 gcc-14
i386 randconfig-007-20260114 gcc-14
i386 randconfig-011-20260114 gcc-14
i386 randconfig-012-20260114 gcc-14
i386 randconfig-013-20260114 gcc-14
i386 randconfig-014-20260114 gcc-14
i386 randconfig-015-20260114 gcc-14
i386 randconfig-016-20260114 gcc-14
i386 randconfig-017-20260114 gcc-14
loongarch allmodconfig clang-22
loongarch allnoconfig gcc-15.2.0
loongarch defconfig clang-19
loongarch randconfig-001-20260114 clang-22
loongarch randconfig-002-20260114 clang-22
m68k allmodconfig gcc-15.2.0
m68k allnoconfig gcc-15.2.0
m68k allyesconfig clang-16
m68k defconfig clang-19
microblaze allnoconfig gcc-15.2.0
microblaze allyesconfig gcc-15.2.0
microblaze defconfig clang-19
mips allmodconfig gcc-15.2.0
mips allnoconfig gcc-15.2.0
mips allyesconfig gcc-15.2.0
mips ip28_defconfig gcc-15.2.0
mips mtx1_defconfig gcc-15.2.0
mips pic32mzda_defconfig clang-22
mips rb532_defconfig clang-22
nios2 allmodconfig clang-22
nios2 allnoconfig clang-22
nios2 defconfig clang-19
nios2 randconfig-001-20260114 clang-22
nios2 randconfig-002-20260114 clang-22
openrisc alldefconfig gcc-15.2.0
openrisc allmodconfig clang-22
openrisc allnoconfig clang-22
openrisc defconfig gcc-15.2.0
parisc allmodconfig gcc-15.2.0
parisc allnoconfig clang-22
parisc allyesconfig clang-19
parisc defconfig gcc-15.2.0
parisc randconfig-001-20260114 gcc-14.3.0
parisc randconfig-001-20260115 clang-22
parisc randconfig-002-20260114 gcc-14.3.0
parisc randconfig-002-20260115 clang-22
parisc64 defconfig clang-19
powerpc allmodconfig gcc-15.2.0
powerpc allnoconfig clang-22
powerpc linkstation_defconfig clang-22
powerpc linkstation_defconfig gcc-15.2.0
powerpc lite5200b_defconfig gcc-15.2.0
powerpc mpc832x_rdb_defconfig gcc-15.2.0
powerpc randconfig-001-20260114 gcc-14.3.0
powerpc randconfig-001-20260115 clang-22
powerpc randconfig-002-20260114 gcc-14.3.0
powerpc randconfig-002-20260115 clang-22
powerpc tqm8555_defconfig gcc-15.2.0
powerpc64 randconfig-001-20260114 gcc-14.3.0
powerpc64 randconfig-001-20260115 clang-22
powerpc64 randconfig-002-20260114 gcc-14.3.0
powerpc64 randconfig-002-20260115 clang-22
riscv allmodconfig clang-22
riscv allnoconfig clang-22
riscv allyesconfig clang-16
riscv defconfig clang-22
riscv defconfig gcc-15.2.0
riscv randconfig-001-20260114 gcc-15.2.0
riscv randconfig-002-20260114 gcc-15.2.0
s390 allmodconfig clang-19
s390 allnoconfig clang-22
s390 allyesconfig gcc-15.2.0
s390 defconfig gcc-15.2.0
s390 randconfig-001-20260114 gcc-15.2.0
s390 randconfig-002-20260114 gcc-15.2.0
sh allmodconfig gcc-15.2.0
sh allnoconfig clang-22
sh allyesconfig clang-19
sh defconfig gcc-14
sh kfr2r09_defconfig gcc-15.2.0
sh randconfig-001-20260114 gcc-15.2.0
sh randconfig-002-20260114 gcc-15.2.0
sh shx3_defconfig gcc-15.2.0
sparc allnoconfig clang-22
sparc defconfig gcc-15.2.0
sparc randconfig-001-20260114 clang-20
sparc randconfig-002-20260114 clang-20
sparc64 allmodconfig clang-22
sparc64 defconfig gcc-14
sparc64 randconfig-001-20260114 clang-20
sparc64 randconfig-002-20260114 clang-20
um allmodconfig clang-19
um allnoconfig clang-22
um allyesconfig gcc-15.2.0
um defconfig gcc-14
um i386_defconfig gcc-14
um randconfig-001-20260114 clang-20
um randconfig-002-20260114 clang-20
um x86_64_defconfig gcc-14
x86_64 allmodconfig clang-20
x86_64 allnoconfig clang-22
x86_64 allyesconfig clang-20
x86_64 buildonly-randconfig-001-20260114 clang-20
x86_64 buildonly-randconfig-002-20260114 clang-20
x86_64 buildonly-randconfig-003-20260114 clang-20
x86_64 buildonly-randconfig-004-20260114 clang-20
x86_64 buildonly-randconfig-005-20260114 clang-20
x86_64 buildonly-randconfig-006-20260114 clang-20
x86_64 defconfig gcc-14
x86_64 kexec clang-20
x86_64 randconfig-001-20260114 gcc-14
x86_64 randconfig-002-20260114 gcc-14
x86_64 randconfig-003-20260114 gcc-14
x86_64 randconfig-004-20260114 gcc-14
x86_64 randconfig-005-20260114 gcc-14
x86_64 randconfig-006-20260114 gcc-14
x86_64 randconfig-011-20260114 gcc-14
x86_64 randconfig-012-20260114 gcc-14
x86_64 randconfig-013-20260114 gcc-14
x86_64 randconfig-014-20260114 gcc-14
x86_64 randconfig-015-20260114 gcc-14
x86_64 randconfig-016-20260114 gcc-14
x86_64 randconfig-071-20260114 clang-20
x86_64 randconfig-072-20260114 clang-20
x86_64 randconfig-073-20260114 clang-20
x86_64 randconfig-074-20260114 clang-20
x86_64 randconfig-075-20260114 clang-20
x86_64 randconfig-076-20260114 clang-20
x86_64 rhel-9.4 clang-20
x86_64 rhel-9.4-bpf gcc-14
x86_64 rhel-9.4-func clang-20
x86_64 rhel-9.4-kselftests clang-20
x86_64 rhel-9.4-kunit gcc-14
x86_64 rhel-9.4-ltp gcc-14
x86_64 rhel-9.4-rust clang-20
xtensa allnoconfig clang-22
xtensa allyesconfig clang-22
xtensa randconfig-001-20260114 clang-20
xtensa randconfig-002-20260114 clang-20
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* [PATCH] input: Add marine keycodes for radar control.
From: Hunter Moore @ 2026-01-14 19:16 UTC (permalink / raw)
To: hunter.moore; +Cc: dmitry.torokhov, linux-input, linux-kernel
In-Reply-To: <20251230145707.810-1-Hunter.Moore@garmin.com>
Please let me know your thoughts and if you think that any additional
changes are needed on this patch.
Thank you.
________________________________
CONFIDENTIALITY NOTICE: This email and any attachments are for the sole use of the intended recipient(s) and contain information that may be Garmin confidential and/or Garmin legally privileged. If you have received this email in error, please notify the sender by reply email and delete the message. Any disclosure, copying, distribution or use of this communication (including attachments) by someone other than the intended recipient is prohibited. Thank you.
^ permalink raw reply
* [PATCH] Input: atmel_mxt_ts - fix NULL pointer dereference in mxt_object_show
From: 齐柯宇 @ 2026-01-14 19:43 UTC (permalink / raw)
To: nick, dmitry.torokhov
Cc: rydberg, jy0922.shim, bleung, ezequiel, linux-input, linux-kernel,
齐柯宇
This fix was discovered through static code analysis.
In mxt_object_show(), the code directly dereferences data->info and
data->object_table without checking if they are NULL. This can lead to
a NULL pointer dereference kernel crash when the sysfs file is accessed
during firmware update or device removal.
[Call Chain Analysis]
The vulnerable sysfs handler is exposed through the following registration:
Driver registration:
mxt_driver.driver.dev_groups = mxt_groups
-> mxt_attrs[] contains:
- dev_attr_object.attr -> mxt_object_show() [VULNERABLE]
- dev_attr_update_fw.attr -> mxt_update_fw_store()
[TRIGGERS FREE]
Initialization path:
mxt_probe()
-> mxt_initialize()
-> mxt_read_info_block()
-> data->info = (struct mxt_info *)id_buf [line 1918]
-> data->object_table = (struct mxt_object *)... [line 1934]
Resource release path (called during firmware update or device removal):
mxt_update_fw_store() OR mxt_remove()
-> mxt_free_object_table()
-> data->object_table = NULL [line 1713]
-> data->info = NULL [line 1714]
[Data Flow Analysis]
The critical data flow is:
data->info:
- Allocated and set in mxt_read_info_block() from id_buf
- Released and set to NULL in mxt_free_object_table()
- Accessed in mxt_object_show() at line 2868: data->info->object_num
data->object_table:
- Set in mxt_read_info_block() as pointer into id_buf
- Set to NULL in mxt_free_object_table()
- Accessed in mxt_object_show() at line 2869: data->object_table + i
[Race Condition Scenario]
The vulnerability can be triggered by the following race condition:
Thread A (reading sysfs) Thread B (firmware update)
-------------------------- --------------------------
T1: open /sys/.../object
T2: mxt_object_show()
T3: data = dev_get_drvdata(dev)
T4: obuf = kmalloc(...)
T5: echo fw > /sys/.../update_fw
T6: mxt_update_fw_store()
T7: mxt_free_object_table()
T8: data->info = NULL
T9: for (i < data->info->object_num)
-> NULL pointer dereference!
[User-Triggerable Paths]
Users can trigger this vulnerability through:
1. Firmware update race condition (requires root):
Terminal A: # cat /sys/bus/i2c/devices/<dev>/object
Terminal B: # echo firmware.bin > /sys/bus/i2c/devices/<dev>/update_fw
2. Device unbind race condition (requires root):
Terminal A: # cat /sys/bus/i2c/devices/<dev>/object
Terminal B: # echo "<dev>" > /sys/bus/i2c/drivers/atmel_mxt_ts/unbind
3. Physical device removal:
Reading sysfs while physically removing the touchscreen device
How to fix:
Add NULL checks for data->info and data->object_table at the beginning
of mxt_object_show() to prevent NULL pointer dereference when these
resources are freed during concurrent firmware update or device removal.
Fixes: 4cf51c383d7a ("Input: Add ATMEL QT602240 touchscreen driver")
Fixes: 068bdb67ef74 ("Input: atmel_mxt_ts - fix the firmware update")
Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
---
drivers/input/touchscreen/atmel_mxt_ts.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c
b/drivers/input/touchscreen/atmel_mxt_ts.c
index dd0544cc1bc1..401fcae2264d 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -2859,6 +2859,10 @@ static ssize_t mxt_object_show(struct device *dev,
int error;
u8 *obuf;
+ /* Check for NULL to prevent race condition during firmware update */
+ if (!data->info || !data->object_table)
+ return -ENODEV;
+
/* Pre-allocate buffer large enough to hold max sized object. */
obuf = kmalloc(256, GFP_KERNEL);
if (!obuf)
--
2.34.1
^ permalink raw reply related
* [PATCH] HID: logitech-hidpp: fix NULL pointer dereference in hidpp_get_report_length()
From: 齐柯宇 @ 2026-01-14 17:54 UTC (permalink / raw)
To: linux-kernel, linux-input
In-Reply-To: <CALEuBa=E1YSo1oVxd67rBf+6bC28zQZi5HBghMmcPFHKQn2+UA@mail.gmail.com>
Add validation for report->maxfield and report->field[0] before
dereferencing to prevent NULL pointer dereference.
The HID report descriptor is provided by the USB device firmware via
USB control transfer (GET_DESCRIPTOR). A malicious device can craft
a descriptor that defines an OUTPUT report without any usages
(padding fields). When the HID subsystem parses such a descriptor:
1. hid_add_field() calls hid_register_report() to create the report
object and stores it in report_id_hash[id]
2. Since parser->local.usage_index is 0, hid_add_field() returns early
without calling hid_register_field() to add any fields
3. Result: report exists with maxfield=0 and field[0]=NULL
When hidpp_probe() is called for a device matching this driver:
- hidpp_validate_device() calls hidpp_get_report_length()
- hidpp_get_report_length() retrieves the report from hash (not NULL)
- It then dereferences report->field[0]->report_count
- Since field[0] is NULL, this triggers a kernel NULL pointer
dereference
Data flow from attacker to crash:
Malicious USB Device
|
v (USB GET_DESCRIPTOR control transfer)
hid_get_class_descriptor() -- reads HID report descriptor from device
|
v
hid_parse_report() -- stores descriptor in hid->dev_rdesc
|
v
hid_open_report() -> hid_add_field()
| |
| v
| hid_register_report() -- creates report, maxfield=0
| |
| v
| returns early if usage_index==0, no field added
|
v
hidpp_validate_device() -> hidpp_get_report_length()
|
v
report->field[0]->report_count -- NULL pointer dereference!
This is triggerable by an attacker with physical access using a
malicious USB device (e.g., BadUSB, programmable USB development
boards).
Fixes: d71b18f7c7999 ("HID: logitech-hidpp: do not hardcode very long
report length")
Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
---
drivers/hid/hid-logitech-hidpp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index d5011a5d0890..02ddbd658e89 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -4314,7 +4314,7 @@ static int hidpp_get_report_length(struct
hid_device *hdev, int id)
re = &(hdev->report_enum[HID_OUTPUT_REPORT]);
report = re->report_id_hash[id];
- if (!report)
+ if (!report || report->maxfield < 1 || !report->field[0])
return 0;
return report->field[0]->report_count + 1;
--
2.34.1
^ permalink raw reply related
* Re: [PATCH 2/2] Input: ili210x - add support for polling mode
From: Frank Li @ 2026-01-14 15:12 UTC (permalink / raw)
To: Geert Uytterhoeven
Cc: Marek Vasut, linux-input, Conor Dooley, Dmitry Torokhov,
Job Noorman, Krzysztof Kozlowski, Rob Herring, devicetree,
linux-kernel, linux-renesas-soc
In-Reply-To: <CAMuHMdXb3-EFy8WA9FTAqvyYHaF4nGch60bUQ6bbKu6Dzbh6YQ@mail.gmail.com>
On Wed, Jan 14, 2026 at 10:37:15AM +0100, Geert Uytterhoeven wrote:
> Hi Frank,
>
> On Tue, 13 Jan 2026 at 17:41, Frank Li <Frank.li@nxp.com> wrote:
> > On Tue, Jan 13, 2026 at 12:44:57AM +0100, Marek Vasut wrote:
> > > There are designs incorporating Ilitek ILI2xxx touch controller that
> > > do not connect interrupt pin, for example Waveshare 13.3" DSI display.
> > > To support such systems use polling mode for the input device when I2C
> > > client does not have interrupt assigned to it.
> > >
> > > Factor out ili210x_firmware_update_noirq() to allow conditional scoped
> > > guard around this code. The scoped guard has to be applied only in case
> > > the IRQ line is connected, and not applied otherwise.
> > >
> > > Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
> > > --- a/drivers/input/touchscreen/ili210x.c
> > > +++ b/drivers/input/touchscreen/ili210x.c
>
> > > @@ -1003,12 +1027,24 @@ static int ili210x_i2c_probe(struct i2c_client *client)
> > > return error;
> > > }
> > >
> > > - error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
> > > - IRQF_ONESHOT, client->name, priv);
> > > - if (error) {
> > > - dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n",
> > > - error);
> > > - return error;
> > > + input_set_drvdata(input, priv);
> > > +
> > > + if (client->irq) {
> >
> > 0 is validated irq number
> >
> > https://elixir.bootlin.com/linux/v6.19-rc4/source/drivers/base/platform.c#L284
>
> Not anymore ;-)
>
> https://elixir.bootlin.com/linux/v6.19-rc4/source/drivers/base/platform.c#L299
>
> Gr{oetje,eeting}s,
Thanks, negative error number on failure
It should be
if (client->irq > 0)
Frank
>
> Geert
>
> --
> Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
>
> In personal conversations with technical people, I call myself a hacker. But
> when I'm talking to journalists I just say "programmer" or something like that.
> -- Linus Torvalds
^ permalink raw reply
* Report
From: minecraftend @ 2026-01-14 14:10 UTC (permalink / raw)
To: linux-input@vger.kernel.org
psmouse serio1: synaptics: Your touchpad (PNP: LEN2043 PNP0f13) says it can support a different bus. If i2c-hid and hid-rmi are not used, you might want to try setting psmouse.synaptics_intertouch to 1 and report this to linux-input@vger.kernel.org
^ permalink raw reply
* Re: [PATCH v2 3/3] arm64: dts: qcom: sm6125-xiaomi-laurel-sprout: Add Focaltech FT3518 touchscreen
From: Dmitry Baryshkov @ 2026-01-14 13:04 UTC (permalink / raw)
To: yedaya.ka
Cc: SzczurekYT, Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Bjorn Andersson, Konrad Dybcio, linux-input,
devicetree, linux-kernel, linux-arm-msm, Kamil Gołda
In-Reply-To: <20260114-touchscreen-patches-v2-3-4215f94c8aba@gmail.com>
On Wed, Jan 14, 2026 at 11:31:08AM +0200, Yedaya Katsman via B4 Relay wrote:
> From: Yedaya Katsman <yedaya.ka@gmail.com>
>
> Add device tree node for the Focaltech FT3518 touchscreen on
> Xiaomi Mi A3 (laurel-sprout).
>
> Enable qupv3_id_0 and i2c2 bus that the touchscreen is on.
>
> Co-developed-by: Kamil Gołda <kamil.golda@protonmail.com>
> Signed-off-by: Kamil Gołda <kamil.golda@protonmail.com>
> Signed-off-by: Yedaya Katsman <yedaya.ka@gmail.com>
> ---
> .../boot/dts/qcom/sm6125-xiaomi-laurel-sprout.dts | 34 ++++++++++++++++++++++
> 1 file changed, 34 insertions(+)
>
> diff --git a/arch/arm64/boot/dts/qcom/sm6125-xiaomi-laurel-sprout.dts b/arch/arm64/boot/dts/qcom/sm6125-xiaomi-laurel-sprout.dts
> index 994fb0412fcbdf5466f87a325c48b697a37b514b..97feed708d3b6483eab72cfb0ae39be6f5ae3a11 100644
> --- a/arch/arm64/boot/dts/qcom/sm6125-xiaomi-laurel-sprout.dts
> +++ b/arch/arm64/boot/dts/qcom/sm6125-xiaomi-laurel-sprout.dts
> @@ -119,6 +119,18 @@ active-config0 {
> };
> };
> };
> +
> + ts_vdd_supply: ts-vdd-supply {
ts_vdd_supply: vreg-ts-vdd
OR
ts_vdd_supply: regulator-ts-vdd
(It migth require to be moved up in the file according to the sorting
rules).
> + compatible = "regulator-fixed";
> + regulator-name = "ts_vdd_supply";
> + regulator-min-microvolt = <3300000>;
> + regulator-max-microvolt = <3300000>;
> +
> + gpio = <&tlmm 83 GPIO_ACTIVE_HIGH>;
> + enable-active-high;
> +
> + startup-delay-us = <70000>;
> + };
> };
>
--
With best wishes
Dmitry
^ permalink raw reply
* Re: [PATCH v2 2/3] drivers: input: touchscreen: edt-ft5x06: Add FocalTech FT3518
From: Dmitry Baryshkov @ 2026-01-14 13:02 UTC (permalink / raw)
To: yedaya.ka
Cc: SzczurekYT, Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Bjorn Andersson, Konrad Dybcio, linux-input,
devicetree, linux-kernel, linux-arm-msm, Kamil Gołda
In-Reply-To: <20260114-touchscreen-patches-v2-2-4215f94c8aba@gmail.com>
On Wed, Jan 14, 2026 at 11:31:07AM +0200, Yedaya Katsman via B4 Relay wrote:
> From: Yedaya Katsman <yedaya.ka@gmail.com>
>
> The driver also works with FT3518, which supports up to 10 touch points.
> Add compatible data for it.
>
> Co-developed-by: Kamil Gołda <kamil.golda@protonmail.com>
> Signed-off-by: Kamil Gołda <kamil.golda@protonmail.com>
> Signed-off-by: Yedaya Katsman <yedaya.ka@gmail.com>
> ---
> drivers/input/touchscreen/edt-ft5x06.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
--
With best wishes
Dmitry
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox