* [PATCH 2/2] HID: input: Add HID_BATTERY_QUIRK_DYNAMIC for Elan touchscreens
From: Hans de Goede @ 2026-02-28 14:52 UTC (permalink / raw)
To: Jiri Kosina, Benjamin Tissoires
Cc: Hans de Goede, Dmitry Torokhov, linux-input, ggrundik
In-Reply-To: <20260228145258.76937-1-johannes.goede@oss.qualcomm.com>
Elan touchscreens have a HID-battery device for the stylus which is always
there even if there is no stylus.
This is causing upower to report an empty battery for the stylus and some
desktop-environments will show a notification about this, which is quite
annoying.
Because of this the HID-battery is being ignored on all Elan I2c and USB
touchscreens, but this causes there to be no battery reporting for
the stylus at all.
This adds a new HID_BATTERY_QUIRK_DYNAMIC and uses these for the Elan
touchscreens.
This new quirks causes the present value of the battery to start at 0,
which will make userspace ignore it and only sets present to 1 after
receiving a battery input report which only happens when the stylus
gets in range.
Reported-by: ggrundik@gmail.com
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221118
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
---
drivers/hid/hid-input.c | 14 +++++++++++---
include/linux/hid.h | 1 +
2 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 67ca1e88ce13..8fc20df99b97 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -354,6 +354,7 @@ static enum power_supply_property hidinput_battery_props[] = {
#define HID_BATTERY_QUIRK_FEATURE (1 << 1) /* ask for feature report */
#define HID_BATTERY_QUIRK_IGNORE (1 << 2) /* completely ignore the battery */
#define HID_BATTERY_QUIRK_AVOID_QUERY (1 << 3) /* do not query the battery */
+#define HID_BATTERY_QUIRK_DYNAMIC (1 << 4) /* report present only after life signs */
static const struct hid_device_id hid_battery_quirks[] = {
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
@@ -398,8 +399,8 @@ static const struct hid_device_id hid_battery_quirks[] = {
* Elan HID touchscreens seem to all report a non present battery,
* set HID_BATTERY_QUIRK_IGNORE for all Elan I2C and USB HID devices.
*/
- { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
- { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_DYNAMIC },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_DYNAMIC },
{}
};
@@ -456,11 +457,14 @@ static int hidinput_get_battery_property(struct power_supply *psy,
int ret = 0;
switch (prop) {
- case POWER_SUPPLY_PROP_PRESENT:
case POWER_SUPPLY_PROP_ONLINE:
val->intval = 1;
break;
+ case POWER_SUPPLY_PROP_PRESENT:
+ val->intval = dev->battery_present;
+ break;
+
case POWER_SUPPLY_PROP_CAPACITY:
if (dev->battery_status != HID_BATTERY_REPORTED &&
!dev->battery_avoid_query) {
@@ -573,6 +577,8 @@ static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type,
if (quirks & HID_BATTERY_QUIRK_AVOID_QUERY)
dev->battery_avoid_query = true;
+ dev->battery_present = (quirks & HID_BATTERY_QUIRK_DYNAMIC) ? false : true;
+
dev->battery = power_supply_register(&dev->dev, psy_desc, &psy_cfg);
if (IS_ERR(dev->battery)) {
error = PTR_ERR(dev->battery);
@@ -628,6 +634,7 @@ static void hidinput_update_battery(struct hid_device *dev, unsigned int usage,
return;
if (hidinput_update_battery_charge_status(dev, usage, value)) {
+ dev->battery_present = true;
power_supply_changed(dev->battery);
return;
}
@@ -643,6 +650,7 @@ static void hidinput_update_battery(struct hid_device *dev, unsigned int usage,
if (dev->battery_status != HID_BATTERY_REPORTED ||
capacity != dev->battery_capacity ||
ktime_after(ktime_get_coarse(), dev->battery_ratelimit_time)) {
+ dev->battery_present = true;
dev->battery_capacity = capacity;
dev->battery_status = HID_BATTERY_REPORTED;
dev->battery_ratelimit_time =
diff --git a/include/linux/hid.h b/include/linux/hid.h
index dce862cafbbd..d9b54f0e8671 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -682,6 +682,7 @@ struct hid_device {
__s32 battery_charge_status;
enum hid_battery_status battery_status;
bool battery_avoid_query;
+ bool battery_present;
ktime_t battery_ratelimit_time;
#endif
--
2.52.0
^ permalink raw reply related
* Re: [PATCH v6 4/7] iio: Rename 'sign' field to `format` in struct iio_scan_type
From: Jonathan Cameron @ 2026-02-28 17:59 UTC (permalink / raw)
To: David Lechner
Cc: Francesco Lavra, Jonathan Corbet, Shuah Khan, Lars-Peter Clausen,
Michael Hennerich, Lucas Stankus, Nuno Sá, Andy Shevchenko,
Puranjay Mohan, Cosmin Tanislav, Ramona Gradinariu,
Antoniu Miclaus, Petre Rodan, Dan Robertson, Benson Leung,
Guenter Roeck, Jiri Kosina, Srinivas Pandruvada, Matti Vaittinen,
Marcelo Schmitt, Esteban Blanc, Jorge Marques, Sergiu Cuciurean,
Dragos Bogdan, Alisa-Dariana Roman, Trevor Gamblin,
Renato Lui Geh, Eugen Hristev, Nicolas Ferre, Alexandre Belloni,
Claudiu Beznea, Andreas Klinger, Paul Cercueil, Ramona Bolboaca,
Marcus Folkesson, Kent Gustavsson, Matthias Brugger,
AngeloGioacchino Del Regno, Frank Li, Sascha Hauer,
Pengutronix Kernel Team, Fabio Estevam, Matteo Martelli,
Marius Cristea, Heiko Stuebner, Maxime Coquelin, Alexandre Torgue,
Kurt Borja, Francesco Dolcini, João Paulo Gonçalves,
Leonard Göhrs, Oleksij Rempel, Haibo Chen, Salih Erim,
Conall O'Griofa, Michal Simek, Gustavo Silva,
Tomasz Duszynski, Roan van Dijk, Jyoti Bhayana, Mariel Tinaco,
Nishant Malpani, Rui Miguel Silva, Linus Walleij,
Lorenzo Bianconi, Alex Lanzano, Jagath Jog J,
Jean-Baptiste Maneyrol, Remi Buisson, Christian Eggers,
Mudit Sharma, Javier Carrasco, Ondřej Jirman, Song Qiang,
Dixit Parmar, Gerald Loacker, linux-doc, linux-kernel, linux-iio,
chrome-platform, linux-input, linux-arm-kernel, linux-mips,
linux-mediatek, imx, linux-rockchip, linux-stm32
In-Reply-To: <120c7f33-4ca1-4d35-ac1b-b65362f1adfc@baylibre.com>
On Wed, 25 Feb 2026 15:27:01 -0600
David Lechner <dlechner@baylibre.com> wrote:
> On 2/25/26 4:17 AM, Francesco Lavra wrote:
> > This field is used to differentiate between signed and unsigned integers.
> > A following commit will extend its use to in order to add support for non-
> > integer scan elements; therefore, change its name from 'sign' to a more
> > generic 'format'.
> >
>
> Maybe Jonathan is OK with doing this all at once, but another alternative
> could be to introduce a union to allow both names at the same time, then
> we could make the change more gradually.
Please do the union for v7. Not so much because I mind a global change, but
more because the chances of merge conflicts are too high.
Perhaps for this series just introduce the union and use it in the driver
here. We can then chase it through the rest of the tree as a separate step.
Alternatively leave it with a misleading name for now (so allow 'f' to be a
magic sign value) and we can do the rename as a follow up.
Jonathan
^ permalink raw reply
* [PATCH v2 0/7] HID: asus: increase robustness of the driver
From: Denis Benato @ 2026-02-28 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: linux-input, Benjamin Tissoires, Jiri Kosina, Luke D . Jones,
Mateusz Schyboll, Denis Benato, Denis Benato
Hi all,
Previous asus-wmi maintainer and asus-linux developer has become less
active in the project and left me in charge of advancing the support
for ASUS equipement on Linux.
I am preparing to send a patchset of his revised work to support ASUS
ROG Ally handhelds devices and since that work is also useful in
expanding support for 2025 models it is important to improve the
hid-asus driver as future patches will build on top of these changes.
Cheers,
Denis
Changelog:
- v1
- Initial submission
- v2
- Remove another warning about a now unused int ret.
- Fix a regression (already in for-next) about leds not working anymore.
Denis Benato (7):
HID: asus: fix code style of comments and brackets
HID: asus: add xg mobile 2022 external hardware support
HID: asus: fix compiler warning about unused variables
HID: asus: make asus_resume adhere to linux kernel coding standards
HID: asus: simplify and improve asus_kbd_set_report()
HID: asus: do not abort probe when not necessary
HID: asus: do not try to initialize the backlight if the enpoint
doesn't support it
drivers/hid/hid-asus.c | 74 +++++++++++++++++-------------------------
drivers/hid/hid-ids.h | 1 +
2 files changed, 30 insertions(+), 45 deletions(-)
--
2.53.0
^ permalink raw reply
* [PATCH v2 1/7] HID: asus: fix code style of comments and brackets
From: Denis Benato @ 2026-02-28 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: linux-input, Benjamin Tissoires, Jiri Kosina, Luke D . Jones,
Mateusz Schyboll, Denis Benato, Denis Benato
In-Reply-To: <20260228191010.3830758-1-denis.benato@linux.dev>
In asus_raw_event there is code that would violate checkpatch script
such as unaligned closing comments and superfluous graph parenthesis:
fix these stylistic issues.
Also remove an empty comment spanning two lines.
This commit does not change runtime behavior.
Signed-off-by: Denis Benato <denis.benato@linux.dev>
---
drivers/hid/hid-asus.c | 16 +++++-----------
1 file changed, 5 insertions(+), 11 deletions(-)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index ffbfaff9f117..5fcb06b16167 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -20,9 +20,6 @@
* Copyright (c) 2016 Frederik Wenigwieser <frederik.wenigwieser@gmail.com>
*/
-/*
- */
-
#include <linux/acpi.h>
#include <linux/dmi.h>
#include <linux/hid.h>
@@ -359,7 +356,7 @@ static int asus_event(struct hid_device *hdev, struct hid_field *field,
struct hid_usage *usage, __s32 value)
{
struct asus_drvdata *drvdata = hid_get_drvdata(hdev);
-
+
if ((usage->hid & HID_USAGE_PAGE) == HID_UP_ASUSVENDOR &&
(usage->hid & HID_USAGE) != 0x00 &&
(usage->hid & HID_USAGE) != 0xff && !usage->type) {
@@ -448,21 +445,18 @@ static int asus_raw_event(struct hid_device *hdev,
/*
* G713 and G733 send these codes on some keypresses, depending on
* the key pressed it can trigger a shutdown event if not caught.
- */
- if (data[0] == 0x02 && data[1] == 0x30) {
+ */
+ if (data[0] == 0x02 && data[1] == 0x30)
return -1;
- }
}
if (drvdata->quirks & QUIRK_ROG_CLAYMORE_II_KEYBOARD) {
/*
* CLAYMORE II keyboard sends this packet when it goes to sleep
* this causes the whole system to go into suspend.
- */
-
- if(size == 2 && data[0] == 0x02 && data[1] == 0x00) {
+ */
+ if (size == 2 && data[0] == 0x02 && data[1] == 0x00)
return -1;
- }
}
return 0;
--
2.53.0
^ permalink raw reply related
* [PATCH v2 3/7] HID: asus: fix compiler warning about unused variables
From: Denis Benato @ 2026-02-28 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: linux-input, Benjamin Tissoires, Jiri Kosina, Luke D . Jones,
Mateusz Schyboll, Denis Benato, Denis Benato
In-Reply-To: <20260228191010.3830758-1-denis.benato@linux.dev>
In the function asus_has_report_id there are 3 unused variables clang
warns about: remove them.
Fixes:0919db9f3583 ("HID: asus: always fully initialize devices")
Signed-off-by: Denis Benato <denis.benato@linux.dev>
---
drivers/hid/hid-asus.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index fbcf38b15290..2b4411399571 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -723,10 +723,9 @@ static void validate_mcu_fw_version(struct hid_device *hdev, int idProduct)
static bool asus_has_report_id(struct hid_device *hdev, u16 report_id)
{
- int t, f, u, err = 0;
struct hid_report *report;
- for (t = HID_INPUT_REPORT; t <= HID_FEATURE_REPORT; t++) {
+ for (int t = HID_INPUT_REPORT; t <= HID_FEATURE_REPORT; t++) {
list_for_each_entry(report, &hdev->report_enum[t].report_list, list) {
if (report->id == report_id)
return true;
--
2.53.0
^ permalink raw reply related
* [PATCH v2 2/7] HID: asus: add xg mobile 2022 external hardware support
From: Denis Benato @ 2026-02-28 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: linux-input, Benjamin Tissoires, Jiri Kosina, Luke D . Jones,
Mateusz Schyboll, Denis Benato, Denis Benato
In-Reply-To: <20260228191010.3830758-1-denis.benato@linux.dev>
XG mobile station 2022 has a different PID than the 2023 model: add it
that model to hid-asus.
Signed-off-by: Denis Benato <denis.benato@linux.dev>
---
drivers/hid/hid-asus.c | 3 +++
drivers/hid/hid-ids.h | 1 +
2 files changed, 4 insertions(+)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 5fcb06b16167..fbcf38b15290 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -1515,6 +1515,9 @@ static const struct hid_device_id asus_devices[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X),
QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD | QUIRK_ROG_ALLY_XPAD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ USB_DEVICE_ID_ASUSTEK_XGM_2022),
+ },
{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
USB_DEVICE_ID_ASUSTEK_XGM_2023),
},
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 4ab7640b119a..5e85921049e0 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -229,6 +229,7 @@
#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X 0x1b4c
#define USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD 0x196b
#define USB_DEVICE_ID_ASUSTEK_FX503VD_KEYBOARD 0x1869
+#define USB_DEVICE_ID_ASUSTEK_XGM_2022 0x1970
#define USB_DEVICE_ID_ASUSTEK_XGM_2023 0x1a9a
#define USB_VENDOR_ID_ATEN 0x0557
--
2.53.0
^ permalink raw reply related
* [PATCH v2 4/7] HID: asus: make asus_resume adhere to linux kernel coding standards
From: Denis Benato @ 2026-02-28 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: linux-input, Benjamin Tissoires, Jiri Kosina, Luke D . Jones,
Mateusz Schyboll, Denis Benato, Denis Benato
In-Reply-To: <20260228191010.3830758-1-denis.benato@linux.dev>
Linux kernel coding standars requires functions opening brackets to be in
a newline: move the opening bracket of asus_resume in its own line.
Fixes: 546edbd26cff ("HID: hid-asus: reset the backlight brightness level on resume")
Signed-off-by: Denis Benato <denis.benato@linux.dev>
---
drivers/hid/hid-asus.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 2b4411399571..48731b48523d 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -1171,7 +1171,8 @@ static int asus_start_multitouch(struct hid_device *hdev)
return 0;
}
-static int __maybe_unused asus_resume(struct hid_device *hdev) {
+static int __maybe_unused asus_resume(struct hid_device *hdev)
+{
struct asus_drvdata *drvdata = hid_get_drvdata(hdev);
int ret = 0;
--
2.53.0
^ permalink raw reply related
* [PATCH v2 5/7] HID: asus: simplify and improve asus_kbd_set_report()
From: Denis Benato @ 2026-02-28 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: linux-input, Benjamin Tissoires, Jiri Kosina, Luke D . Jones,
Mateusz Schyboll, Denis Benato, Denis Benato
In-Reply-To: <20260228191010.3830758-1-denis.benato@linux.dev>
Make the function shorter and easier to read using __free, and also fix a
misaligned comment closing tag.
The __free macro from cleanup.h is already used in the driver, but its
include is missing: add it.
Signed-off-by: Denis Benato <denis.benato@linux.dev>
---
drivers/hid/hid-asus.c | 16 +++++-----------
1 file changed, 5 insertions(+), 11 deletions(-)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 48731b48523d..4fa8e72c6855 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -21,6 +21,7 @@
*/
#include <linux/acpi.h>
+#include <linux/cleanup.h>
#include <linux/dmi.h>
#include <linux/hid.h>
#include <linux/module.h>
@@ -464,23 +465,16 @@ static int asus_raw_event(struct hid_device *hdev,
static int asus_kbd_set_report(struct hid_device *hdev, const u8 *buf, size_t buf_size)
{
- unsigned char *dmabuf;
- int ret;
-
- dmabuf = kmemdup(buf, buf_size, GFP_KERNEL);
+ u8 *dmabuf __free(kfree) = kmemdup(buf, buf_size, GFP_KERNEL);
if (!dmabuf)
return -ENOMEM;
/*
* The report ID should be set from the incoming buffer due to LED and key
* interfaces having different pages
- */
- ret = hid_hw_raw_request(hdev, buf[0], dmabuf,
- buf_size, HID_FEATURE_REPORT,
- HID_REQ_SET_REPORT);
- kfree(dmabuf);
-
- return ret;
+ */
+ return hid_hw_raw_request(hdev, buf[0], dmabuf, buf_size, HID_FEATURE_REPORT,
+ HID_REQ_SET_REPORT);
}
static int asus_kbd_init(struct hid_device *hdev, u8 report_id)
--
2.53.0
^ permalink raw reply related
* [PATCH v2 6/7] HID: asus: do not abort probe when not necessary
From: Denis Benato @ 2026-02-28 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: linux-input, Benjamin Tissoires, Jiri Kosina, Luke D . Jones,
Mateusz Schyboll, Denis Benato, Denis Benato
In-Reply-To: <20260228191010.3830758-1-denis.benato@linux.dev>
In order to avoid dereferencing a NULL pointer asus_probe is aborted early
and control of some asus devices is transferred over hid-generic after
erroring out even when such NULL dereference cannot happen: only early
abort when the NULL dereference can happen.
Also make the code shorter and more adherent to coding standards
removing square brackets enclosing single-line if-else statements.
Fixes: d3af6ca9a8c3 ("HID: asus: fix UAF via HID_CLAIMED_INPUT validation")
Signed-off-by: Denis Benato <denis.benato@linux.dev>
---
drivers/hid/hid-asus.c | 25 ++++++++++---------------
1 file changed, 10 insertions(+), 15 deletions(-)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 4fa8e72c6855..5780e70aebd5 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -1323,22 +1323,17 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id)
* were freed during registration due to no usages being mapped,
* leaving drvdata->input pointing to freed memory.
*/
- if (!drvdata->input || !(hdev->claimed & HID_CLAIMED_INPUT)) {
- hid_err(hdev, "Asus input not registered\n");
- ret = -ENOMEM;
- goto err_stop_hw;
- }
-
- if (drvdata->tp) {
- drvdata->input->name = "Asus TouchPad";
- } else {
- drvdata->input->name = "Asus Keyboard";
- }
+ if (drvdata->input && (hdev->claimed & HID_CLAIMED_INPUT)) {
+ if (drvdata->tp)
+ drvdata->input->name = "Asus TouchPad";
+ else
+ drvdata->input->name = "Asus Keyboard";
- if (drvdata->tp) {
- ret = asus_start_multitouch(hdev);
- if (ret)
- goto err_stop_hw;
+ if (drvdata->tp) {
+ ret = asus_start_multitouch(hdev);
+ if (ret)
+ goto err_stop_hw;
+ }
}
return 0;
--
2.53.0
^ permalink raw reply related
* [PATCH v2 7/7] HID: asus: do not try to initialize the backlight if the enpoint doesn't support it
From: Denis Benato @ 2026-02-28 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: linux-input, Benjamin Tissoires, Jiri Kosina, Luke D . Jones,
Mateusz Schyboll, Denis Benato, Denis Benato
In-Reply-To: <20260228191010.3830758-1-denis.benato@linux.dev>
Avoid possibly printing a warning about the inability to initialize the
backlight if the hid endpoint doesn't support it.
Also fix and move an incorrect check in asus_kbd_register_leds(): that
same check is now used as a precondition to call that function.
Fixes: 0919db9f3583 ("HID: asus: always fully initialize devices")
Signed-off-by: Denis Benato <denis.benato@linux.dev>
---
drivers/hid/hid-asus.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 5780e70aebd5..9291f23c10b7 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -737,10 +737,6 @@ static int asus_kbd_register_leds(struct hid_device *hdev)
unsigned char kbd_func;
int ret;
- /* Laptops keyboard backlight is always at 0x5a */
- if (asus_has_report_id(hdev, FEATURE_KBD_REPORT_ID))
- return -ENODEV;
-
/* Get keyboard functions */
ret = asus_kbd_get_functions(hdev, &kbd_func, FEATURE_KBD_REPORT_ID);
if (ret < 0)
@@ -1306,8 +1302,10 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id)
}
}
+ /* Laptops keyboard backlight is always at 0x5a */
if (is_vendor && (drvdata->quirks & QUIRK_USE_KBD_BACKLIGHT) &&
- asus_kbd_register_leds(hdev))
+ (asus_has_report_id(hdev, FEATURE_KBD_REPORT_ID)) &&
+ (asus_kbd_register_leds(hdev)))
hid_warn(hdev, "Failed to initialize backlight.\n");
/*
--
2.53.0
^ permalink raw reply related
* [PATCH 0/2] iio: hid-sensor-gyro-3d: fix typo and probe race condition
From: Bhargav Joshi @ 2026-02-28 19:13 UTC (permalink / raw)
To: jikos, srinivas.pandruvada, jic23
Cc: dlechner, nuno.sa, andy, linux-iio, linux-kernel, rougueprince47,
linux-input
This patch series introduces two changes to the hid-sensor-gyro-3d
driver:
- Patch 1: Move iio_device_register() to the end of the probe()
function and updates the error handling and remove() sequences to
strictly follow the LIFO teardown order.
- Patch 2: Fixes a trivial spelling mistake in a array name ('gryo' to
'gyro').
Bhargav Joshi (2):
iio: hid-sensor-gyro-3d: move iio_device_register() to end of probe()
iio: hid-sensor-gyro-3d: fix typo in array name
drivers/iio/gyro/hid-sensor-gyro-3d.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
--
2.53.0
^ permalink raw reply
* [PATCH 1/2] iio: hid-sensor-gyro-3d: move iio_device_register() to end of probe()
From: Bhargav Joshi @ 2026-02-28 19:13 UTC (permalink / raw)
To: jikos, srinivas.pandruvada, jic23
Cc: dlechner, nuno.sa, andy, linux-iio, linux-kernel, rougueprince47,
linux-input
In-Reply-To: <20260228191400.19244-1-rougueprince47@gmail.com>
Currently, calling iio_device_register() before
sensor_hub_register_callback() may create a race condition where the
device is exposed to userspace before callbacks are wired.
Move iio_device_register() to the end of the probe() function to prevent
race condition.
Consequently, update the error handling path in probe() and in remove()
ensuring that iio_device_unregister() is called first to cut off
userspace access before the hardware callbacks are removed.
Signed-off-by: Bhargav Joshi <rougueprince47@gmail.com>
---
drivers/iio/gyro/hid-sensor-gyro-3d.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c
index c43990c518f7..8e3628cd8529 100644
--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c
+++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c
@@ -333,12 +333,6 @@ static int hid_gyro_3d_probe(struct platform_device *pdev)
return ret;
}
- ret = iio_device_register(indio_dev);
- if (ret) {
- dev_err(&pdev->dev, "device register failed\n");
- goto error_remove_trigger;
- }
-
gyro_state->callbacks.send_event = gyro_3d_proc_event;
gyro_state->callbacks.capture_sample = gyro_3d_capture_sample;
gyro_state->callbacks.pdev = pdev;
@@ -346,13 +340,19 @@ static int hid_gyro_3d_probe(struct platform_device *pdev)
&gyro_state->callbacks);
if (ret < 0) {
dev_err(&pdev->dev, "callback reg failed\n");
- goto error_iio_unreg;
+ goto error_remove_trigger;
+ }
+
+ ret = iio_device_register(indio_dev);
+ if (ret) {
+ dev_err(&pdev->dev, "device register failed\n");
+ goto error_remove_callback;
}
return ret;
-error_iio_unreg:
- iio_device_unregister(indio_dev);
+error_remove_callback:
+ sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_GYRO_3D);
error_remove_trigger:
hid_sensor_remove_trigger(indio_dev, &gyro_state->common_attributes);
return ret;
@@ -365,8 +365,8 @@ static void hid_gyro_3d_remove(struct platform_device *pdev)
struct iio_dev *indio_dev = platform_get_drvdata(pdev);
struct gyro_3d_state *gyro_state = iio_priv(indio_dev);
- sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_GYRO_3D);
iio_device_unregister(indio_dev);
+ sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_GYRO_3D);
hid_sensor_remove_trigger(indio_dev, &gyro_state->common_attributes);
}
--
2.53.0
^ permalink raw reply related
* [PATCH 2/2] iio: hid-sensor-gyro-3d: fix typo in array name
From: Bhargav Joshi @ 2026-02-28 19:14 UTC (permalink / raw)
To: jikos, srinivas.pandruvada, jic23
Cc: dlechner, nuno.sa, andy, linux-iio, linux-kernel, rougueprince47,
linux-input
In-Reply-To: <20260228191400.19244-1-rougueprince47@gmail.com>
The array 'gryo_3d_sensitivity_addresses' has a clear spelling mistake
in its prefix. Rename it to 'gyro_3d_sensitivity_addresses' to correctly
match the naming convention.
Signed-off-by: Bhargav Joshi <rougueprince47@gmail.com>
---
drivers/iio/gyro/hid-sensor-gyro-3d.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c
index 8e3628cd8529..4f88fe478d84 100644
--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c
+++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c
@@ -42,7 +42,7 @@ static const u32 gyro_3d_addresses[GYRO_3D_CHANNEL_MAX] = {
HID_USAGE_SENSOR_ANGL_VELOCITY_Z_AXIS
};
-static const u32 gryo_3d_sensitivity_addresses[] = {
+static const u32 gyro_3d_sensitivity_addresses[] = {
HID_USAGE_SENSOR_DATA_ANGL_VELOCITY,
};
@@ -297,8 +297,8 @@ static int hid_gyro_3d_probe(struct platform_device *pdev)
ret = hid_sensor_parse_common_attributes(hsdev,
HID_USAGE_SENSOR_GYRO_3D,
&gyro_state->common_attributes,
- gryo_3d_sensitivity_addresses,
- ARRAY_SIZE(gryo_3d_sensitivity_addresses));
+ gyro_3d_sensitivity_addresses,
+ ARRAY_SIZE(gyro_3d_sensitivity_addresses));
if (ret) {
dev_err(&pdev->dev, "failed to setup common attributes\n");
return ret;
--
2.53.0
^ permalink raw reply related
* [PATCH] Input: elo - fix style issues
From: techyguyperplexable @ 2026-02-28 19:32 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input, linux-kernel, techyguyperplexable
Fix array constness and spacing issues reported by checkpatch.
Signed-off-by: techyguyperplexable <objecting@objecting.org>
---
drivers/input/touchscreen/elo.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/input/touchscreen/elo.c b/drivers/input/touchscreen/elo.c
index 434b9b47e964..40ae132cde21 100644
--- a/drivers/input/touchscreen/elo.c
+++ b/drivers/input/touchscreen/elo.c
@@ -257,7 +257,7 @@ static int elo_command_10(struct elo *elo, unsigned char *packet)
static int elo_setup_10(struct elo *elo)
{
- static const char *elo_types[] = { "Accu", "Dura", "Intelli", "Carroll" };
+ static const char * const elo_types[] = { "Accu", "Dura", "Intelli", "Carroll" };
struct input_dev *dev = elo->dev;
unsigned char packet[ELO10_PACKET_LEN] = { ELO10_ID_CMD };
@@ -273,7 +273,7 @@ static int elo_setup_10(struct elo *elo)
dev_info(&elo->serio->dev,
"%sTouch touchscreen, fw: %02x.%02x, features: 0x%02x, controller: 0x%02x\n",
- elo_types[(packet[1] -'0') & 0x03],
+ elo_types[(packet[1] - '0') & 0x03],
packet[5], packet[4], packet[3], packet[7]);
return 0;
--
2.43.0
^ permalink raw reply related
* [PATCH v2 1/4] Input: elo - fix style issues
From: Josh Law @ 2026-02-28 19:52 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input, linux-kernel, Josh Law
Fix array constness and spacing issues reported by checkpatch.
Signed-off-by: Josh Law <objecting@objecting.org>
---
drivers/input/touchscreen/elo.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/input/touchscreen/elo.c b/drivers/input/touchscreen/elo.c
index 434b9b47e964..40ae132cde21 100644
--- a/drivers/input/touchscreen/elo.c
+++ b/drivers/input/touchscreen/elo.c
@@ -257,7 +257,7 @@ static int elo_command_10(struct elo *elo, unsigned char *packet)
static int elo_setup_10(struct elo *elo)
{
- static const char *elo_types[] = { "Accu", "Dura", "Intelli", "Carroll" };
+ static const char * const elo_types[] = { "Accu", "Dura", "Intelli", "Carroll" };
struct input_dev *dev = elo->dev;
unsigned char packet[ELO10_PACKET_LEN] = { ELO10_ID_CMD };
@@ -273,7 +273,7 @@ static int elo_setup_10(struct elo *elo)
dev_info(&elo->serio->dev,
"%sTouch touchscreen, fw: %02x.%02x, features: 0x%02x, controller: 0x%02x\n",
- elo_types[(packet[1] -'0') & 0x03],
+ elo_types[(packet[1] - '0') & 0x03],
packet[5], packet[4], packet[3], packet[7]);
return 0;
--
2.43.0
^ permalink raw reply related
* [PATCH v2 0/2] iio: orientation: hid-sensor-rotation: fix quaternion alignment
From: David Lechner @ 2026-02-28 20:02 UTC (permalink / raw)
To: Jonathan Cameron, Nuno Sá, Andy Shevchenko, Jiri Kosina,
Srinivas Pandruvada
Cc: linux-iio, linux-kernel, Jonathan Cameron, linux-input,
David Lechner, Lixu Zhang
The main point of this series is to fix a regression reported in
hid-sensor-rotation where the alignment of the quaternion field in the
data was inadvertently changed from 16 bytes to 8 bytes. This is an
unusually case (one of only 2 in the kernel) where the .repeat field of
struct iio_scan_type is used and we have such a requirement. (The other
case uses u16 instead of u32, so it wasn't affected.)
To make the reason for the alignment more explicit to future readers,
we introduce a new macro, IIO_DECLARE_QUATERNION(), to declare the
array with proper alignment. This is meant to follow the pattern of
the similar IIO_DECLARE_BUFFER_WITH_TS() macro.
Signed-off-by: David Lechner <dlechner@baylibre.com>
---
Changes in v2:
- Rename IIO_DECLARE_REPEATED_ELEMENT() to IIO_DECLARE_QUATERNION().
- Link to v1: https://lore.kernel.org/r/20260214-iio-fix-repeat-alignment-v1-0-47f01288c803@baylibre.com
---
David Lechner (2):
iio: add IIO_DECLARE_QUATERNION() macro
iio: orientation: hid-sensor-rotation: fix quaternion alignment
drivers/iio/orientation/hid-sensor-rotation.c | 2 +-
include/linux/iio/iio.h | 12 ++++++++++++
2 files changed, 13 insertions(+), 1 deletion(-)
---
base-commit: 3fa5e5702a82d259897bd7e209469bc06368bf31
change-id: 20260214-iio-fix-repeat-alignment-575b2c009e25
Best regards,
--
David Lechner <dlechner@baylibre.com>
^ permalink raw reply
* [PATCH v2 1/2] iio: add IIO_DECLARE_QUATERNION() macro
From: David Lechner @ 2026-02-28 20:02 UTC (permalink / raw)
To: Jonathan Cameron, Nuno Sá, Andy Shevchenko, Jiri Kosina,
Srinivas Pandruvada
Cc: linux-iio, linux-kernel, Jonathan Cameron, linux-input,
David Lechner
In-Reply-To: <20260228-iio-fix-repeat-alignment-v2-0-d58bfaa2920d@baylibre.com>
Add a new IIO_DECLARE_QUATERNION() macro that is used to declare the
field in an IIO buffer struct that contains a quaternion vector.
Quaternions are currently the only IIO data type that uses the .repeat
feature of struct iio_scan_type. This has an implicit rule that the
element in the buffer must be aligned to the entire size of the repeated
element. This macro will make that requirement explicit. Since this is
the only user, we just call the macro IIO_DECLARE_QUATERNION() instead
of something more generic.
Signed-off-by: David Lechner <dlechner@baylibre.com>
---
include/linux/iio/iio.h | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/include/linux/iio/iio.h b/include/linux/iio/iio.h
index a9ecff191bd9..2c91b7659ce9 100644
--- a/include/linux/iio/iio.h
+++ b/include/linux/iio/iio.h
@@ -931,6 +931,18 @@ static inline void *iio_device_get_drvdata(const struct iio_dev *indio_dev)
#define IIO_DECLARE_DMA_BUFFER_WITH_TS(type, name, count) \
__IIO_DECLARE_BUFFER_WITH_TS(type, name, count) __aligned(IIO_DMA_MINALIGN)
+/**
+ * IIO_DECLARE_QUATERNION() - Declare a quaternion element
+ * @type: element type of the individual vectors
+ * @name: identifier name
+ *
+ * Quaternions are a vector composed of 4 elements (W, X, Y, Z). Use this macro
+ * to declare a quaternion element in a struct to ensure proper alignment in
+ * an IIO buffer.
+ */
+#define IIO_DECLARE_QUATERNION(type, name) \
+ type name[4] __aligned(sizeof(type) * 4)
+
struct iio_dev *iio_device_alloc(struct device *parent, int sizeof_priv);
/* The information at the returned address is guaranteed to be cacheline aligned */
--
2.43.0
^ permalink raw reply related
* [PATCH v2 2/2] iio: orientation: hid-sensor-rotation: fix quaternion alignment
From: David Lechner @ 2026-02-28 20:02 UTC (permalink / raw)
To: Jonathan Cameron, Nuno Sá, Andy Shevchenko, Jiri Kosina,
Srinivas Pandruvada
Cc: linux-iio, linux-kernel, Jonathan Cameron, linux-input,
David Lechner, Lixu Zhang
In-Reply-To: <20260228-iio-fix-repeat-alignment-v2-0-d58bfaa2920d@baylibre.com>
Restore the alignment of sampled_vals to 16 bytes by using
IIO_DECLARE_QUATERNION(). This field contains a quaternion value which
has scan_type.repeat = 4 and storagebits = 32. So the alignment must
be 16 bytes to match the assumptions of iio_storage_bytes_for_si() and
also to not break userspace.
Reported-by: Lixu Zhang <lixu.zhang@intel.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221077
Fixes: b31a74075cb4 ("iio: orientation: hid-sensor-rotation: remove unnecessary alignment")
Tested-by: Lixu Zhang <lixu.zhang@intel.com>
Signed-off-by: David Lechner <dlechner@baylibre.com>
---
drivers/iio/orientation/hid-sensor-rotation.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/orientation/hid-sensor-rotation.c b/drivers/iio/orientation/hid-sensor-rotation.c
index e759f91a710a..6806481873be 100644
--- a/drivers/iio/orientation/hid-sensor-rotation.c
+++ b/drivers/iio/orientation/hid-sensor-rotation.c
@@ -19,7 +19,7 @@ struct dev_rot_state {
struct hid_sensor_common common_attributes;
struct hid_sensor_hub_attribute_info quaternion;
struct {
- s32 sampled_vals[4];
+ IIO_DECLARE_QUATERNION(s32, sampled_vals);
aligned_s64 timestamp;
} scan;
int scale_pre_decml;
--
2.43.0
^ permalink raw reply related
* [PATCH] Input: uinput - fix circular locking dependency with ff-core
From: Mikhail Gavrilov @ 2026-02-28 22:36 UTC (permalink / raw)
To: dmitry.torokhov; +Cc: linux-input, linux-kernel, Mikhail Gavrilov
A lockdep circular locking dependency warning can be triggered
reproducibly when using a force-feedback gamepad with uinput (for
example, playing ELDEN RING under Wine with a Flydigi Vader 5
controller):
ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex
The cycle is caused by four lock acquisition paths:
1. ff upload: input_ff_upload() holds ff->mutex and calls
uinput_dev_upload_effect() -> uinput_request_submit() ->
uinput_request_send(), which acquires udev->mutex.
2. device create: uinput_ioctl_handler() holds udev->mutex and calls
uinput_create_device() -> input_register_device(), which acquires
input_mutex.
3. device register: input_register_device() holds input_mutex and
calls kbd_connect() -> input_register_handle(), which acquires
dev->mutex.
4. evdev release: evdev_release() calls input_flush_device() under
dev->mutex, which calls input_ff_flush() acquiring ff->mutex.
Fix this by replacing udev->mutex with the existing
udev->requests_lock spinlock in uinput_request_send(). The function
only needs to atomically check device state and queue an input event
into the ring buffer via uinput_dev_event() -- both operations are safe
under a spinlock (ktime_get_ts64() and wake_up_interruptible() do not
sleep). This breaks the ff->mutex -> udev->mutex link since a spinlock
is a leaf in the lock ordering and cannot form cycles with mutexes.
To keep state transitions visible to uinput_request_send(), protect
writes to udev->state in uinput_create_device() and
uinput_destroy_device() with the same spinlock.
Additionally, move init_completion(&request->done) from
uinput_request_send() to uinput_request_submit() before
uinput_request_reserve_slot(). Once the slot is allocated,
uinput_flush_requests() may call complete() on it at any time from
the destroy path, so the completion must be initialised before the
request becomes visible.
Lock ordering after the fix:
ff->mutex -> requests_lock (spinlock, leaf)
udev->mutex -> requests_lock (spinlock, leaf)
udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge)
Link: https://lore.kernel.org/all/CABXGCsMoxag+kEwHhb7KqhuyxfmGGd0P=tHZyb1uKE0pLr8Hkg@mail.gmail.com/
Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
---
drivers/input/misc/uinput.c | 26 +++++++++++++++++++-------
1 file changed, 19 insertions(+), 7 deletions(-)
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index e589060db280..dcb855234049 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -146,19 +146,15 @@ static void uinput_request_release_slot(struct uinput_device *udev,
static int uinput_request_send(struct uinput_device *udev,
struct uinput_request *request)
{
- int retval;
+ int retval = 0;
- retval = mutex_lock_interruptible(&udev->mutex);
- if (retval)
- return retval;
+ spin_lock(&udev->requests_lock);
if (udev->state != UIST_CREATED) {
retval = -ENODEV;
goto out;
}
- init_completion(&request->done);
-
/*
* Tell our userspace application about this new request
* by queueing an input event.
@@ -166,7 +162,7 @@ static int uinput_request_send(struct uinput_device *udev,
uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id);
out:
- mutex_unlock(&udev->mutex);
+ spin_unlock(&udev->requests_lock);
return retval;
}
@@ -175,6 +171,13 @@ static int uinput_request_submit(struct uinput_device *udev,
{
int retval;
+ /*
+ * Initialize completion before allocating the request slot.
+ * Once the slot is allocated, uinput_flush_requests() may
+ * complete it at any time, so it must be initialized first.
+ */
+ init_completion(&request->done);
+
retval = uinput_request_reserve_slot(udev, request);
if (retval)
return retval;
@@ -289,7 +292,14 @@ static void uinput_destroy_device(struct uinput_device *udev)
struct input_dev *dev = udev->dev;
enum uinput_state old_state = udev->state;
+ /*
+ * Update state under requests_lock so that concurrent
+ * uinput_request_send() sees the state change before we
+ * flush pending requests and tear down the device.
+ */
+ spin_lock(&udev->requests_lock);
udev->state = UIST_NEW_DEVICE;
+ spin_unlock(&udev->requests_lock);
if (dev) {
name = dev->name;
@@ -366,7 +376,9 @@ static int uinput_create_device(struct uinput_device *udev)
if (error)
goto fail2;
+ spin_lock(&udev->requests_lock);
udev->state = UIST_CREATED;
+ spin_unlock(&udev->requests_lock);
return 0;
--
2.53.0
^ permalink raw reply related
* FAILED: Patch "Input: synaptics_i2c - guard polling restart in resume" failed to apply to 6.19-stable tree
From: Sasha Levin @ 2026-03-01 1:15 UTC (permalink / raw)
To: stable, ii4gsp; +Cc: Dmitry Torokhov, linux-input
The patch below does not apply to the 6.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
Thanks,
Sasha
------------------ original commit in Linus's tree ------------------
From 870c2e7cd881d7a10abb91f2b38135622d9f9f65 Mon Sep 17 00:00:00 2001
From: Minseong Kim <ii4gsp@gmail.com>
Date: Wed, 21 Jan 2026 10:02:02 -0800
Subject: [PATCH] Input: synaptics_i2c - guard polling restart in resume
synaptics_i2c_resume() restarts delayed work unconditionally, even when
the input device is not opened. Guard the polling restart by taking the
input device mutex and checking input_device_enabled() before re-queuing
the delayed work.
Fixes: eef3e4cab72ea ("Input: add driver for Synaptics I2C touchpad")
Signed-off-by: Minseong Kim <ii4gsp@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260121063738.799967-1-ii4gsp@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/input/mouse/synaptics_i2c.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/input/mouse/synaptics_i2c.c b/drivers/input/mouse/synaptics_i2c.c
index c8ddfff2605ff..29da66af36d74 100644
--- a/drivers/input/mouse/synaptics_i2c.c
+++ b/drivers/input/mouse/synaptics_i2c.c
@@ -615,13 +615,16 @@ static int synaptics_i2c_resume(struct device *dev)
int ret;
struct i2c_client *client = to_i2c_client(dev);
struct synaptics_i2c *touch = i2c_get_clientdata(client);
+ struct input_dev *input = touch->input;
ret = synaptics_i2c_reset_config(client);
if (ret)
return ret;
- mod_delayed_work(system_dfl_wq, &touch->dwork,
- msecs_to_jiffies(NO_DATA_SLEEP_MSECS));
+ guard(mutex)(&input->mutex);
+ if (input_device_enabled(input))
+ mod_delayed_work(system_dfl_wq, &touch->dwork,
+ msecs_to_jiffies(NO_DATA_SLEEP_MSECS));
return 0;
}
--
2.51.0
^ permalink raw reply related
* FAILED: Patch "Input: synaptics_i2c - guard polling restart in resume" failed to apply to 6.18-stable tree
From: Sasha Levin @ 2026-03-01 1:17 UTC (permalink / raw)
To: stable, ii4gsp; +Cc: Dmitry Torokhov, linux-input
The patch below does not apply to the 6.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
Thanks,
Sasha
------------------ original commit in Linus's tree ------------------
From 870c2e7cd881d7a10abb91f2b38135622d9f9f65 Mon Sep 17 00:00:00 2001
From: Minseong Kim <ii4gsp@gmail.com>
Date: Wed, 21 Jan 2026 10:02:02 -0800
Subject: [PATCH] Input: synaptics_i2c - guard polling restart in resume
synaptics_i2c_resume() restarts delayed work unconditionally, even when
the input device is not opened. Guard the polling restart by taking the
input device mutex and checking input_device_enabled() before re-queuing
the delayed work.
Fixes: eef3e4cab72ea ("Input: add driver for Synaptics I2C touchpad")
Signed-off-by: Minseong Kim <ii4gsp@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260121063738.799967-1-ii4gsp@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/input/mouse/synaptics_i2c.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/input/mouse/synaptics_i2c.c b/drivers/input/mouse/synaptics_i2c.c
index c8ddfff2605ff..29da66af36d74 100644
--- a/drivers/input/mouse/synaptics_i2c.c
+++ b/drivers/input/mouse/synaptics_i2c.c
@@ -615,13 +615,16 @@ static int synaptics_i2c_resume(struct device *dev)
int ret;
struct i2c_client *client = to_i2c_client(dev);
struct synaptics_i2c *touch = i2c_get_clientdata(client);
+ struct input_dev *input = touch->input;
ret = synaptics_i2c_reset_config(client);
if (ret)
return ret;
- mod_delayed_work(system_dfl_wq, &touch->dwork,
- msecs_to_jiffies(NO_DATA_SLEEP_MSECS));
+ guard(mutex)(&input->mutex);
+ if (input_device_enabled(input))
+ mod_delayed_work(system_dfl_wq, &touch->dwork,
+ msecs_to_jiffies(NO_DATA_SLEEP_MSECS));
return 0;
}
--
2.51.0
^ permalink raw reply related
* FAILED: Patch "HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()" failed to apply to 6.12-stable tree
From: Sasha Levin @ 2026-03-01 1:19 UTC (permalink / raw)
To: stable, gnoack; +Cc: Jiri Kosina, linux-input
The patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
Thanks,
Sasha
------------------ original commit in Linus's tree ------------------
From 1547d41f9f19d691c2c9ce4c29f746297baef9e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Noack?= <gnoack@google.com>
Date: Fri, 9 Jan 2026 13:25:58 +0100
Subject: [PATCH] HID: logitech-hidpp: Check maxfield in
hidpp_get_report_length()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Do not crash when a report has no fields.
Fake USB gadgets can send their own HID report descriptors and can define report
structures without valid fields. This can be used to crash the kernel over USB.
Cc: stable@vger.kernel.org
Signed-off-by: Günther Noack <gnoack@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
---
drivers/hid/hid-logitech-hidpp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index e871f1729d4b3..d0a38eff9cfa8 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -4314,7 +4314,7 @@ static int hidpp_get_report_length(struct hid_device *hdev, int id)
re = &(hdev->report_enum[HID_OUTPUT_REPORT]);
report = re->report_id_hash[id];
- if (!report)
+ if (!report || !report->maxfield)
return 0;
return report->field[0]->report_count + 1;
--
2.51.0
^ permalink raw reply related
* FAILED: Patch "HID: magicmouse: Do not crash on missing msc->input" failed to apply to 6.12-stable tree
From: Sasha Levin @ 2026-03-01 1:19 UTC (permalink / raw)
To: stable, gnoack; +Cc: Jiri Kosina, linux-input
The patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
Thanks,
Sasha
------------------ original commit in Linus's tree ------------------
From 17abd396548035fbd6179ee1a431bd75d49676a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Noack?= <gnoack@google.com>
Date: Fri, 9 Jan 2026 11:57:14 +0100
Subject: [PATCH] HID: magicmouse: Do not crash on missing msc->input
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fake USB devices can send their own report descriptors for which the
input_mapping() hook does not get called. In this case, msc->input stays NULL,
leading to a crash at a later time.
Detect this condition in the input_configured() hook and reject the device.
This is not supposed to happen with actual magic mouse devices, but can be
provoked by imposing as a magic mouse USB device.
Cc: stable@vger.kernel.org
Signed-off-by: Günther Noack <gnoack@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
---
drivers/hid/hid-magicmouse.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index 7d4a25c6de0eb..91f621ceb924b 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -725,6 +725,11 @@ static int magicmouse_input_configured(struct hid_device *hdev,
struct magicmouse_sc *msc = hid_get_drvdata(hdev);
int ret;
+ if (!msc->input) {
+ hid_err(hdev, "magicmouse setup input failed (no input)");
+ return -EINVAL;
+ }
+
ret = magicmouse_setup_input(msc->input, hdev);
if (ret) {
hid_err(hdev, "magicmouse setup input failed (%d)\n", ret);
--
2.51.0
^ permalink raw reply related
* FAILED: Patch "HID: prodikeys: Check presence of pm->input_ep82" failed to apply to 6.12-stable tree
From: Sasha Levin @ 2026-03-01 1:19 UTC (permalink / raw)
To: stable, gnoack; +Cc: Jiri Kosina, linux-input
The patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
Thanks,
Sasha
------------------ original commit in Linus's tree ------------------
From cee8337e1bad168136aecfe6416ecd7d3aa7529a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Noack?= <gnoack@google.com>
Date: Fri, 9 Jan 2026 11:58:08 +0100
Subject: [PATCH] HID: prodikeys: Check presence of pm->input_ep82
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fake USB devices can send their own report descriptors for which the
input_mapping() hook does not get called. In this case, pm->input_ep82 stays
NULL, which leads to a crash later.
This does not happen with the real device, but can be provoked by imposing as
one.
Cc: stable@vger.kernel.org
Signed-off-by: Günther Noack <gnoack@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
---
drivers/hid/hid-prodikeys.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/hid/hid-prodikeys.c b/drivers/hid/hid-prodikeys.c
index 74bddb2c3e82e..6e413df38358a 100644
--- a/drivers/hid/hid-prodikeys.c
+++ b/drivers/hid/hid-prodikeys.c
@@ -378,6 +378,10 @@ static int pcmidi_handle_report4(struct pcmidi_snd *pm, u8 *data)
bit_mask = (bit_mask << 8) | data[2];
bit_mask = (bit_mask << 8) | data[3];
+ /* robustness in case input_mapping hook does not get called */
+ if (!pm->input_ep82)
+ return 0;
+
/* break keys */
for (bit_index = 0; bit_index < 24; bit_index++) {
if (!((0x01 << bit_index) & bit_mask)) {
--
2.51.0
^ permalink raw reply related
* FAILED: Patch "HID: hid-pl: handle probe errors" failed to apply to 6.12-stable tree
From: Sasha Levin @ 2026-03-01 1:19 UTC (permalink / raw)
To: stable, oneukum; +Cc: Jiri Kosina, linux-input
The patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
Thanks,
Sasha
------------------ original commit in Linus's tree ------------------
From 3756a272d2cf356d2203da8474d173257f5f8521 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Wed, 19 Nov 2025 10:09:57 +0100
Subject: [PATCH] HID: hid-pl: handle probe errors
Errors in init must be reported back or we'll
follow a NULL pointer the first time FF is used.
Fixes: 20eb127906709 ("hid: force feedback driver for PantherLord USB/PS2 2in1 Adapter")
Cc: stable@vger.kernel.org
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
---
drivers/hid/hid-pl.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-pl.c b/drivers/hid/hid-pl.c
index 3c8827081deae..dc11d5322fc0f 100644
--- a/drivers/hid/hid-pl.c
+++ b/drivers/hid/hid-pl.c
@@ -194,9 +194,14 @@ static int pl_probe(struct hid_device *hdev, const struct hid_device_id *id)
goto err;
}
- plff_init(hdev);
+ ret = plff_init(hdev);
+ if (ret)
+ goto stop;
return 0;
+
+stop:
+ hid_hw_stop(hdev);
err:
return ret;
}
--
2.51.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox