* Re: [PATCH v3] iio: magnetometer: hid-sensor-magn-3d: prefer 'u32' type
From: Jonathan Cameron @ 2026-04-21 9:41 UTC (permalink / raw)
To: Joshua Crofts
Cc: jikos, srinivas.pandruvada, dlechner, nuno.sa, andy, linux-input,
linux-iio, linux-kernel, Andy Shevchenko
In-Reply-To: <20260421065837.1290-1-joshua.crofts1@gmail.com>
On Tue, 21 Apr 2026 06:58:37 +0000
Joshua Crofts <joshua.crofts1@gmail.com> wrote:
> Use 'u32' instead of bare 'unsigned' to resolve checkpatch.pl warnings
> and correct type use as defined in the struct hid_sensor_hub_callbacks.
>
> No functional change.
>
> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
> Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
Applied.
Thanks,
J
^ permalink raw reply
* [PATCH] HID: u2fzero: fix general protection fault in u2fzero_recv
From: l1za0.sec @ 2026-04-21 13:48 UTC (permalink / raw)
To: jikos, benjamin.tissoires; +Cc: linux-input, linux-kernel
From: Haocheng Yu <l1za0.sec@gmail.com>
A general protection fault in u2fzero_recv is reported by a
modified Syzkaller-based kernel fuzzing tool we developed.
The cause is that u2fzero_probe() calls the u2fzero_fill_in_urb()
function but ignores its return value. When the urb setting fails,
dev->urb remains NULL, but u2fzero_probe() continues to run. When
`dev->urb->context = &ctx;` in u2fzero_recv() is executed, the
KASAN null pointer dereference crash will occur.
To fix this vulnerability, I added a check for the return value of
u2fzero_fill_in_urb() and aborted u2fzero_probe() on error. And I
added a NULL value check for dev->urb in u2fzero_recv() to further
ensure its integrity.
Signed-off-by: Haocheng Yu <l1za0.sec@gmail.com>
---
drivers/hid/hid-u2fzero.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-u2fzero.c b/drivers/hid/hid-u2fzero.c
index 744a91e6e78c..c51f6dd80635 100644
--- a/drivers/hid/hid-u2fzero.c
+++ b/drivers/hid/hid-u2fzero.c
@@ -134,6 +134,12 @@ static int u2fzero_recv(struct u2fzero_device *dev,
memcpy(dev->buf_out, req, sizeof(struct u2f_hid_report));
+ if (!dev->urb) {
+ hid_err(hdev, "recv called without initialized URB");
+ ret = -ENODEV;
+ goto err;
+ }
+
dev->urb->context = &ctx;
init_completion(&ctx.done);
@@ -341,7 +347,11 @@ static int u2fzero_probe(struct hid_device *hdev,
if (ret)
return ret;
- u2fzero_fill_in_urb(dev);
+ ret = u2fzero_fill_in_urb(dev);
+ if (ret) {
+ hid_hw_stop(hdev);
+ return ret;
+ }
dev->present = true;
base-commit: ffc253263a1375a65fa6c9f62a893e9767fbebfa
--
2.51.0
^ permalink raw reply related
* Re: [PATCH] dt-bindings: Remove the redundant 'type: boolean'
From: Rob Herring (Arm) @ 2026-04-21 18:41 UTC (permalink / raw)
To: phucduc.bui
Cc: linusw, zyw, zhangqing, devicetree, alexandre.belloni, heiko,
gene_chen, linux-input, nick, dmitry.torokhov, gregkh,
claudiu.beznea, linux-arm-kernel, linux-usb, nicolas.ferre,
conor+dt, krzk+dt, lee
In-Reply-To: <20260417021858.6582-1-phucduc.bui@gmail.com>
On Fri, 17 Apr 2026 09:18:58 +0700, phucduc.bui@gmail.com wrote:
> From: bui duc phuc <phucduc.bui@gmail.com>
>
> The 'wakeup-source' property already has its type defined in the core
> schema. Remove the redundant 'type: boolean' from the binding file to
> clean up the binding files.
>
> Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
> ---
> Documentation/devicetree/bindings/input/atmel,maxtouch.yaml | 3 +--
> Documentation/devicetree/bindings/mfd/rockchip,rk816.yaml | 3 +--
> Documentation/devicetree/bindings/usb/richtek,rt1711h.yaml | 3 +--
> 3 files changed, 3 insertions(+), 6 deletions(-)
>
Applied, thanks!
^ permalink raw reply
* [PATCH] HID: pidff: Fix integer overflow in pidff_rescale
From: Tomasz Pakuła @ 2026-04-21 19:49 UTC (permalink / raw)
To: jikos, bentiss; +Cc: oleg, linux-input, linux-kernel, tomasz.pakula.oficjalny
Rescaling values close to the max (U16_MAX) temporairly creates values
that exceed the s32 range. This caused value overflow in case when, for
example, a periodic effect phase was higher than 180 degrees. In turn,
rescale function could return values outside of the logical range of the
HID field (negative when logical minimum is 0).
Fix by using 64 bit signed integer to store the value during calculation
but still return only 32 bit integer.
Closes: https://github.com/JacKeTUs/universal-pidff/issues/116
Cc: <stable@vger.kernel.org>
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
---
For inclusion in the 7.1-RC period
drivers/hid/usbhid/hid-pidff.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
index aee8a4443305..fb9b4f292732 100644
--- a/drivers/hid/usbhid/hid-pidff.c
+++ b/drivers/hid/usbhid/hid-pidff.c
@@ -326,8 +326,9 @@ static s32 pidff_clamp(s32 i, struct hid_field *field)
*/
static int pidff_rescale(int i, int max, struct hid_field *field)
{
- return i * (field->logical_maximum - field->logical_minimum) / max +
- field->logical_minimum;
+ /* 64 bits needed for big values during rescale */
+ return (s64)i * (field->logical_maximum - field->logical_minimum) /
+ max + field->logical_minimum;
}
/*
--
2.53.0
^ permalink raw reply related
* [PATCH v2 0/7] Add helper method hid_sensor_adjust_channel_bit_mask()
From: Natália Salvino André @ 2026-04-21 22:20 UTC (permalink / raw)
To: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada
Cc: Natália Salvino André, linux-iio, linux-input
This patch series introduces a generic helper function to handle channel bit mask adjustments
for HID sensors. Currently, multiple drivers implement identical logic for this task
Natália Salvino André (7):
iio: HID: Add helper method hid_sensor_adjust_channel_bit_mask()
iio: accel: HID: Replace method accel_3d_adjust_channel_bit_mask()
iio: gyro: HID: Replace method gyro_3d_adjust_channel_bit_mask()
iio: light: HID: Replace method als_adjust_channel_bit_mask()
iio: light: HID: Replace method prox_adjust_channel_bit_mask()
iio: magnetometer: HID: Replace method
magn_3d_adjust_channel_bit_mask()
iio: pressure: HID: Replace method press_adjust_channel_bit_mask()
drivers/iio/accel/hid-sensor-accel-3d.c | 17 +++--------------
.../common/hid-sensors/hid-sensor-attributes.c | 12 ++++++++++++
drivers/iio/gyro/hid-sensor-gyro-3d.c | 17 +++--------------
drivers/iio/light/hid-sensor-als.c | 13 +------------
drivers/iio/light/hid-sensor-prox.c | 15 ++-------------
drivers/iio/magnetometer/hid-sensor-magn-3d.c | 17 +++--------------
drivers/iio/pressure/hid-sensor-press.c | 15 ++-------------
include/linux/hid-sensor-hub.h | 3 +++
8 files changed, 29 insertions(+), 80 deletions(-)
--
2.51.0
^ permalink raw reply
* [PATCH v2 1/7] iio: HID: Add helper method hid_sensor_adjust_channel_bit_mask()
From: Natália Salvino André @ 2026-04-21 22:20 UTC (permalink / raw)
To: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada
Cc: Natália Salvino André, Pietro Di Consolo Gregorio,
linux-iio, linux-input
In-Reply-To: <20260421222210.16016-1-natalia.andre@ime.usp.br>
Add helper method to deduplicate code in HID sensors.
Signed-off-by: Natália Salvino André <natalia.andre@ime.usp.br>
Co-developed-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
Signed-off-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
---
.../iio/common/hid-sensors/hid-sensor-attributes.c | 12 ++++++++++++
include/linux/hid-sensor-hub.h | 3 +++
2 files changed, 15 insertions(+)
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
index c115a72832b2..3ee6e83c6cac 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
@@ -3,6 +3,7 @@
* HID Sensors Driver
* Copyright (c) 2012, Intel Corporation.
*/
+#include <linux/bits.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/time.h>
@@ -589,6 +590,17 @@ int hid_sensor_parse_common_attributes(struct hid_sensor_hub_device *hsdev,
}
EXPORT_SYMBOL_NS(hid_sensor_parse_common_attributes, "IIO_HID");
+void hid_sensor_adjust_channel_bit_mask(struct iio_chan_spec *channels,
+ int channel, int size)
+{
+ channels[channel].scan_type.format = 's';
+ /* Real storage bits will change based on the report desc. */
+ channels[channel].scan_type.realbits = size * BITS_PER_BYTE;
+ /* Maximum size of a sample to capture is u32 */
+ channels[channel].scan_type.storagebits = sizeof(u32) * BITS_PER_BYTE;
+}
+EXPORT_SYMBOL_NS(hid_sensor_adjust_channel_bit_mask, "IIO_HID");
+
MODULE_AUTHOR("Srinivas Pandruvada <srinivas.pandruvada@intel.com>");
MODULE_DESCRIPTION("HID Sensor common attribute processing");
MODULE_LICENSE("GPL");
diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-sensor-hub.h
index e71056553108..6523d46c63e0 100644
--- a/include/linux/hid-sensor-hub.h
+++ b/include/linux/hid-sensor-hub.h
@@ -281,4 +281,7 @@ bool hid_sensor_batch_mode_supported(struct hid_sensor_common *st);
int hid_sensor_set_report_latency(struct hid_sensor_common *st, int latency);
int hid_sensor_get_report_latency(struct hid_sensor_common *st);
+void hid_sensor_adjust_channel_bit_mask(struct iio_chan_spec *channels,
+ int channel, int size);
+
#endif
--
2.51.0
^ permalink raw reply related
* [PATCH v2 2/7] iio: accel: HID: Replace method accel_3d_adjust_channel_bit_mask()
From: Natália Salvino André @ 2026-04-21 22:20 UTC (permalink / raw)
To: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada
Cc: Natália Salvino André, Pietro Di Consolo Gregorio,
linux-iio, linux-input
In-Reply-To: <20260421222210.16016-1-natalia.andre@ime.usp.br>
Replace method accel_3d_adjust_channel_bit_mask()
with helper method hid_sensor_adjust_channel_bit_mask().
Signed-off-by: Natália Salvino André <natalia.andre@ime.usp.br>
Co-developed-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
Signed-off-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
---
drivers/iio/accel/hid-sensor-accel-3d.c | 17 +++--------------
1 file changed, 3 insertions(+), 14 deletions(-)
diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
index 2ff591b3458f..ac4ab69f80b9 100644
--- a/drivers/iio/accel/hid-sensor-accel-3d.c
+++ b/drivers/iio/accel/hid-sensor-accel-3d.c
@@ -119,17 +119,6 @@ static const struct iio_chan_spec gravity_channels[] = {
IIO_CHAN_SOFT_TIMESTAMP(CHANNEL_SCAN_INDEX_TIMESTAMP),
};
-/* Adjust channel real bits based on report descriptor */
-static void accel_3d_adjust_channel_bit_mask(struct iio_chan_spec *channels,
- int channel, int size)
-{
- channels[channel].scan_type.sign = 's';
- /* Real storage bits will change based on the report desc. */
- channels[channel].scan_type.realbits = size * 8;
- /* Maximum size of a sample to capture is u32 */
- channels[channel].scan_type.storagebits = sizeof(u32) * 8;
-}
-
/* Channel read_raw handler */
static int accel_3d_read_raw(struct iio_dev *indio_dev,
struct iio_chan_spec const *chan,
@@ -307,9 +296,9 @@ static int accel_3d_parse_report(struct platform_device *pdev,
&st->accel[CHANNEL_SCAN_INDEX_X + i]);
if (ret < 0)
break;
- accel_3d_adjust_channel_bit_mask(channels,
- CHANNEL_SCAN_INDEX_X + i,
- st->accel[CHANNEL_SCAN_INDEX_X + i].size);
+ hid_sensor_adjust_channel_bit_mask(channels,
+ CHANNEL_SCAN_INDEX_X + i,
+ st->accel[CHANNEL_SCAN_INDEX_X + i].size);
}
dev_dbg(&pdev->dev, "accel_3d %x:%x, %x:%x, %x:%x\n",
st->accel[0].index,
--
2.51.0
^ permalink raw reply related
* [PATCH v2 3/7] iio: gyro: HID: Replace method gyro_3d_adjust_channel_bit_mask()
From: Natália Salvino André @ 2026-04-21 22:20 UTC (permalink / raw)
To: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada
Cc: Natália Salvino André, Pietro Di Consolo Gregorio,
linux-iio, linux-input
In-Reply-To: <20260421222210.16016-1-natalia.andre@ime.usp.br>
Replace method gyro_3d_adjust_channel_bit_mask()
with helper method hid_sensor_adjust_channel_bit_mask().
Signed-off-by: Natália Salvino André <natalia.andre@ime.usp.br>
Co-developed-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
Signed-off-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
---
drivers/iio/gyro/hid-sensor-gyro-3d.c | 17 +++--------------
1 file changed, 3 insertions(+), 14 deletions(-)
diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c
index c340cc899a7c..e8d8ad884fcb 100644
--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c
+++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c
@@ -82,17 +82,6 @@ static const struct iio_chan_spec gyro_3d_channels[] = {
IIO_CHAN_SOFT_TIMESTAMP(CHANNEL_SCAN_INDEX_TIMESTAMP)
};
-/* Adjust channel real bits based on report descriptor */
-static void gyro_3d_adjust_channel_bit_mask(struct iio_chan_spec *channels,
- int channel, int size)
-{
- channels[channel].scan_type.sign = 's';
- /* Real storage bits will change based on the report desc. */
- channels[channel].scan_type.realbits = size * 8;
- /* Maximum size of a sample to capture is u32 */
- channels[channel].scan_type.storagebits = sizeof(u32) * 8;
-}
-
/* Channel read_raw handler */
static int gyro_3d_read_raw(struct iio_dev *indio_dev,
struct iio_chan_spec const *chan,
@@ -258,9 +247,9 @@ static int gyro_3d_parse_report(struct platform_device *pdev,
&st->gyro[CHANNEL_SCAN_INDEX_X + i]);
if (ret < 0)
break;
- gyro_3d_adjust_channel_bit_mask(channels,
- CHANNEL_SCAN_INDEX_X + i,
- st->gyro[CHANNEL_SCAN_INDEX_X + i].size);
+ hid_sensor_adjust_channel_bit_mask(channels,
+ CHANNEL_SCAN_INDEX_X + i,
+ st->gyro[CHANNEL_SCAN_INDEX_X + i].size);
}
dev_dbg(&pdev->dev, "gyro_3d %x:%x, %x:%x, %x:%x\n",
st->gyro[0].index,
--
2.51.0
^ permalink raw reply related
* [PATCH v2 4/7] iio: light: HID: Replace method als_adjust_channel_bit_mask()
From: Natália Salvino André @ 2026-04-21 22:20 UTC (permalink / raw)
To: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada
Cc: Natália Salvino André, Pietro Di Consolo Gregorio,
linux-iio, linux-input
In-Reply-To: <20260421222210.16016-1-natalia.andre@ime.usp.br>
Replace method als_adjust_channel_bit_mask()
with helper method hid_sensor_adjust_channel_bit_mask().
Signed-off-by: Natália Salvino André <natalia.andre@ime.usp.br>
Co-developed-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
Signed-off-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
---
drivers/iio/light/hid-sensor-als.c | 13 +------------
1 file changed, 1 insertion(+), 12 deletions(-)
diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
index 384572844162..16ef9a37aeae 100644
--- a/drivers/iio/light/hid-sensor-als.c
+++ b/drivers/iio/light/hid-sensor-als.c
@@ -117,17 +117,6 @@ static const struct iio_chan_spec als_channels[] = {
IIO_CHAN_SOFT_TIMESTAMP(CHANNEL_SCAN_INDEX_TIMESTAMP)
};
-/* Adjust channel real bits based on report descriptor */
-static void als_adjust_channel_bit_mask(struct iio_chan_spec *channels,
- int channel, int size)
-{
- channels[channel].scan_type.sign = 's';
- /* Real storage bits will change based on the report desc. */
- channels[channel].scan_type.realbits = size * 8;
- /* Maximum size of a sample to capture is u32 */
- channels[channel].scan_type.storagebits = sizeof(u32) * 8;
-}
-
/* Channel read_raw handler */
static int als_read_raw(struct iio_dev *indio_dev,
struct iio_chan_spec const *chan,
@@ -335,7 +324,7 @@ static int als_parse_report(struct platform_device *pdev,
channels[index] = als_channels[i];
st->als_scan_mask[0] |= BIT(i);
- als_adjust_channel_bit_mask(channels, index, st->als[i].size);
+ hid_sensor_adjust_channel_bit_mask(channels, index, st->als[i].size);
++index;
dev_dbg(&pdev->dev, "als %x:%x\n", st->als[i].index,
--
2.51.0
^ permalink raw reply related
* [PATCH v2 5/7] iio: light: HID: Replace method prox_adjust_channel_bit_mask()
From: Natália Salvino André @ 2026-04-21 22:20 UTC (permalink / raw)
To: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada
Cc: Natália Salvino André, Pietro Di Consolo Gregorio,
linux-iio, linux-input
In-Reply-To: <20260421222210.16016-1-natalia.andre@ime.usp.br>
Replace method prox_adjust_channel_bit_mask()
with helper method hid_sensor_adjust_channel_bit_mask().
Signed-off-by: Natália Salvino André <natalia.andre@ime.usp.br>
Co-developed-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
Signed-off-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
---
drivers/iio/light/hid-sensor-prox.c | 15 ++-------------
1 file changed, 2 insertions(+), 13 deletions(-)
diff --git a/drivers/iio/light/hid-sensor-prox.c b/drivers/iio/light/hid-sensor-prox.c
index efa904a70d0e..edf76af76dfd 100644
--- a/drivers/iio/light/hid-sensor-prox.c
+++ b/drivers/iio/light/hid-sensor-prox.c
@@ -67,17 +67,6 @@ static const struct iio_chan_spec prox_channels[] = {
PROX_CHANNEL(false, 0),
};
-/* Adjust channel real bits based on report descriptor */
-static void prox_adjust_channel_bit_mask(struct iio_chan_spec *channels,
- int channel, int size)
-{
- channels[channel].scan_type.sign = 's';
- /* Real storage bits will change based on the report desc. */
- channels[channel].scan_type.realbits = size * 8;
- /* Maximum size of a sample to capture is u32 */
- channels[channel].scan_type.storagebits = sizeof(u32) * 8;
-}
-
/* Channel read_raw handler */
static int prox_read_raw(struct iio_dev *indio_dev,
struct iio_chan_spec const *chan,
@@ -250,8 +239,8 @@ static int prox_parse_report(struct platform_device *pdev,
st->scan_mask[0] |= BIT(index);
channels[index] = prox_channels[i];
channels[index].scan_index = index;
- prox_adjust_channel_bit_mask(channels, index,
- st->prox_attr[index].size);
+ hid_sensor_adjust_channel_bit_mask(channels, index,
+ st->prox_attr[index].size);
dev_dbg(&pdev->dev, "prox %x:%x\n", st->prox_attr[index].index,
st->prox_attr[index].report_id);
st->scale_precision[index] =
--
2.51.0
^ permalink raw reply related
* [PATCH v2 6/7] iio: magnetometer: HID: Replace method magn_3d_adjust_channel_bit_mask()
From: Natália Salvino André @ 2026-04-21 22:20 UTC (permalink / raw)
To: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada
Cc: Natália Salvino André, Pietro Di Consolo Gregorio,
linux-iio, linux-input
In-Reply-To: <20260421222210.16016-1-natalia.andre@ime.usp.br>
Replace method magn_3d_adjust_channel_bit_mask()
with helper method hid_sensor_adjust_channel_bit_mask().
Signed-off-by: Natália Salvino André <natalia.andre@ime.usp.br>
Co-developed-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
Signed-off-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
---
drivers/iio/magnetometer/hid-sensor-magn-3d.c | 17 +++--------------
1 file changed, 3 insertions(+), 14 deletions(-)
diff --git a/drivers/iio/magnetometer/hid-sensor-magn-3d.c b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
index c673f9323e47..f1939da22e0d 100644
--- a/drivers/iio/magnetometer/hid-sensor-magn-3d.c
+++ b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
@@ -132,17 +132,6 @@ static const struct iio_chan_spec magn_3d_channels[] = {
IIO_CHAN_SOFT_TIMESTAMP(7)
};
-/* Adjust channel real bits based on report descriptor */
-static void magn_3d_adjust_channel_bit_mask(struct iio_chan_spec *channels,
- int channel, int size)
-{
- channels[channel].scan_type.sign = 's';
- /* Real storage bits will change based on the report desc. */
- channels[channel].scan_type.realbits = size * 8;
- /* Maximum size of a sample to capture is u32 */
- channels[channel].scan_type.storagebits = sizeof(u32) * 8;
-}
-
/* Channel read_raw handler */
static int magn_3d_read_raw(struct iio_dev *indio_dev,
struct iio_chan_spec const *chan,
@@ -418,9 +407,9 @@ static int magn_3d_parse_report(struct platform_device *pdev,
if (i != CHANNEL_SCAN_INDEX_TIMESTAMP) {
/* Set magn_val_addr to iio value address */
st->magn_val_addr[i] = &st->iio_vals[*chan_count];
- magn_3d_adjust_channel_bit_mask(_channels,
- *chan_count,
- st->magn[i].size);
+ hid_sensor_adjust_channel_bit_mask(_channels,
+ *chan_count,
+ st->magn[i].size);
}
(*chan_count)++;
}
--
2.51.0
^ permalink raw reply related
* [PATCH v2 7/7] iio: pressure: HID: Replace method press_adjust_channel_bit_mask()
From: Natália Salvino André @ 2026-04-21 22:20 UTC (permalink / raw)
To: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada
Cc: Natália Salvino André, Pietro Di Consolo Gregorio,
linux-iio, linux-input
In-Reply-To: <20260421222210.16016-1-natalia.andre@ime.usp.br>
Replace method press_adjust_channel_bit_mask()
with helper method hid_sensor_adjust_channel_bit_mask().
Signed-off-by: Natália Salvino André <natalia.andre@ime.usp.br>
Co-developed-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
Signed-off-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
---
drivers/iio/pressure/hid-sensor-press.c | 15 ++-------------
1 file changed, 2 insertions(+), 13 deletions(-)
diff --git a/drivers/iio/pressure/hid-sensor-press.c b/drivers/iio/pressure/hid-sensor-press.c
index 5f1d6abda3e4..fd9dafe4945a 100644
--- a/drivers/iio/pressure/hid-sensor-press.c
+++ b/drivers/iio/pressure/hid-sensor-press.c
@@ -53,17 +53,6 @@ static const struct iio_chan_spec press_channels[] = {
};
-/* Adjust channel real bits based on report descriptor */
-static void press_adjust_channel_bit_mask(struct iio_chan_spec *channels,
- int channel, int size)
-{
- channels[channel].scan_type.sign = 's';
- /* Real storage bits will change based on the report desc. */
- channels[channel].scan_type.realbits = size * 8;
- /* Maximum size of a sample to capture is u32 */
- channels[channel].scan_type.storagebits = sizeof(u32) * 8;
-}
-
/* Channel read_raw handler */
static int press_read_raw(struct iio_dev *indio_dev,
struct iio_chan_spec const *chan,
@@ -225,8 +214,8 @@ static int press_parse_report(struct platform_device *pdev,
&st->press_attr);
if (ret < 0)
return ret;
- press_adjust_channel_bit_mask(channels, CHANNEL_SCAN_INDEX_PRESSURE,
- st->press_attr.size);
+ hid_sensor_adjust_channel_bit_mask(channels, CHANNEL_SCAN_INDEX_PRESSURE,
+ st->press_attr.size);
dev_dbg(&pdev->dev, "press %x:%x\n", st->press_attr.index,
st->press_attr.report_id);
--
2.51.0
^ permalink raw reply related
* Re: [moderation] KCSAN: data-race in evdev_pass_values / evdev_read (13)
From: syzbot @ 2026-04-22 1:04 UTC (permalink / raw)
To: dmitry.torokhov, linux-input, linux-kernel, osama.abdelkader,
syzkaller-upstream-moderation
In-Reply-To: <69727536.050a0220.706b.0029.GAE@google.com>
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
^ permalink raw reply
* RE: [PATCH v2] iio: orientation: hid-sensor-rotation: use ext_scan_type
From: Zhang, Lixu @ 2026-04-22 1:08 UTC (permalink / raw)
To: srinivas pandruvada, Jonathan Cameron, Lechner, David
Cc: Jiri Kosina, Nuno Sá, Andy Shevchenko,
linux-input@vger.kernel.org, linux-iio@vger.kernel.org,
linux-kernel@vger.kernel.org
In-Reply-To: <ff6d54f76139c43642f15ef21da6997145bca8e3.camel@linux.intel.com>
Tested-by: Lixu Zhang <lixu.zhang@intel.com>
>-----Original Message-----
>From: srinivas pandruvada <srinivas.pandruvada@linux.intel.com>
>Sent: Monday, April 20, 2026 11:46 PM
>To: Jonathan Cameron <jic23@kernel.org>; Lechner, David
><dlechner@baylibre.com>; Zhang, Lixu <lixu.zhang@intel.com>
>Cc: Jiri Kosina <jikos@kernel.org>; Nuno Sá <nuno.sa@analog.com>; Andy
>Shevchenko <andy@kernel.org>; linux-input@vger.kernel.org; linux-
>iio@vger.kernel.org; linux-kernel@vger.kernel.org
>Subject: Re: [PATCH v2] iio: orientation: hid-sensor-rotation: use ext_scan_type
>
>+Lixu
>
>On Sun, 2026-04-12 at 15:26 +0100, Jonathan Cameron wrote:
>> On Sun, 01 Mar 2026 17:46:48 -0600
>> David Lechner <dlechner@baylibre.com> wrote:
>>
>> > Make use of ext_scan_type to handle the dynamic realbits size of the
>> > quaternion data. This lets us implement it using static data rather
>> > than having to duplicate the channel info for each driver instance.
>> >
>> > Signed-off-by: David Lechner <dlechner@baylibre.com>
>> > ---
>> I'm going to apply this now, but would welcome any additional feedback
>> from Srinivas or others.
>>
>> Note, given this is next cycle material now I'll only push the tree
>> out as testing until I can rebase on rc1.
>>
>
>In real world I think report size is always 16 copying from spec.
Yes, it's always 16 for Intel ISH.
Thanks,
Lixu
>
> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
>
>Thanks,
>Srinivas
>
>
>> Thanks,
>>
>> Jonathan
>>
^ permalink raw reply
* Re: [PATCH 0/2] HID: appletb-kbd: fix UAF and mutex-in-atomic in inactivity timer
From: Sangyun Kim @ 2026-04-22 6:01 UTC (permalink / raw)
To: Aditya Garg; +Cc: jikos, bentiss, qasdev00, linux-input, linux-kernel
In-Reply-To: <MAUPR01MB115460F44776CC8E5E5EE7DC4B82F2@MAUPR01MB11546.INDPRD01.PROD.OUTLOOK.COM>
On Mon, Apr 20, 2026 at 06:17:36 PM +0530, Aditya Garg wrote:
>
>
>On 4/20/26 10:43, Sangyun Kim wrote:
>>This series addresses two defects in hid-appletb-kbd's inactivity
>>timer subsystem. The two patches target different bugs and are
>>logically independent; they are sent together because they touch the
>>same tear-down code and because the same maintainer will review both.
>>
>>Patch 1 fixes a slab use-after-free with two related tear-down windows
>>introduced by commit 38224c472a03 ("HID: appletb-kbd: fix slab
>>use-after-free bug in appletb_kbd_probe"):
>>
>> A) Within "if (kbd->backlight_dev)" the order was
>> put_device() then timer_delete_sync(). A concurrent
>> hid_appletb_bl unbind between those two calls can drop the last
>> devm reference and free the backlight_device; the still-armed
>> inactivity timer softirq then dereferences the freed object
>> through backlight_device_set_brightness() -> mutex_lock(&ops_lock).
>>
>> B) The "if (kbd->backlight_dev)" block ran before
>> hid_hw_close()/hid_hw_stop(), so even after window A is closed a
>> late ".event" callback from the HID core (USB URB completion on
>> real hardware) can arrive between timer_delete_sync() and
>> put_device(), reach reset_inactivity_timer(), re-arm the timer
>> via mod_timer(), and reopen the same UAF.
>>
>>Both windows produce the same KASAN slab-use-after-free on the object
>>allocated by devm_backlight_device_register(). Patch 1 closes them
>>together by moving hid_hw_close()/hid_hw_stop() before the backlight
>>cleanup and, inside that cleanup block, calling timer_delete_sync()
>>before put_device(). Shipping both as one commit avoids leaving
>>stable kernels in a half-fixed state where only window A is closed.
>>
>>Patch 2 fixes a separate "sleeping function called from invalid
>>context" bug in the same subsystem. The inactivity timer is a
>>struct timer_list, so the callback runs in softirq context and calls
>>backlight_device_set_brightness() -> mutex_lock() from atomic
>>context; reset_inactivity_timer() has the same issue on the
>>brightness-restore path (it is called from appletb_kbd_hid_event()
>>and appletb_kbd_inp_event(), which run in softirq/IRQ context on
>>real USB hardware). Convert the inactivity timer to a delayed_work
>>and defer the brightness-restore call to a dedicated work_struct so
>>both sleeping calls run in process context.
>>
>>Sangyun Kim (2):
>> HID: appletb-kbd: fix UAF in inactivity-timer cleanup path
>> HID: appletb-kbd: run inactivity autodim from workqueues
>>
>> drivers/hid/hid-appletb-kbd.c | 56 ++++++++++++++++++++++-------------
>> 1 file changed, 36 insertions(+), 20 deletions(-)
>>
>
>I had a very weird bug just once. And that was when I pressed fn key,
>upon releasing, the touchbar mode did not restore to normal.
>
>Although it was just once, and I was never able to reproduce it again.
>
>Have you tested it on your Machine btw?
>
>
Hi,
I have not tested this series on actual Apple Touch Bar hardware on my
side, as I do not have access to such a machine locally. All testing on
my side was done under QEMU with a uhid-based setup.
Because of that, I cannot say much about the one-off case where the
Touch Bar did not restore the normal mode after releasing Fn. I have not
been able to reproduce that specific behavior in my setup.
For patch 1, however, I was able to reproduce the teardown UAF in the
uhid/QEMU setup and got the following KASAN report.
[ 56.040407] ==================================================================
[ 56.042444] BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x861/0x910
[ 56.044962] Write of size 8 at addr ffff88801b7e8958 by task swapper/0/0
[ 56.049092] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G N 7.0.0-dirty #2 PREEMPT(full)
[ 56.049967] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 56.050843] Call Trace:
[ 56.051146] <IRQ>
[ 56.052394] __run_timer_base.part.0+0x861/0x910
[ 56.053123] run_timer_softirq+0xd1/0x190
[ 56.075012] Allocated by task 11:
[ 56.077221] devm_kmalloc+0x70/0x1d0
[ 56.077545] appletb_kbd_probe+0x65/0x470 [hid_appletb_kbd]
[ 56.085606] uhid_device_add_worker+0x3b/0x100
[ 56.088719] Freed by task 11:
[ 56.091296] devres_release_group+0x1fd/0x3d0
[ 56.091844] hid_device_probe+0x4db/0x7d0
[ 56.096916] uhid_device_add_worker+0x3b/0x100
[ 56.123572] backlight_device_set_brightness+0x77/0x280
[ 56.123902] appletb_inactivity_timer+0xe9/0x190 [hid_appletb_kbd]
[ 56.123967] call_timer_fn+0x163/0x4a0
[ 56.124338] __run_timer_base.part.0+0x575/0x910
[ 56.124711] run_timer_softirq+0xd1/0x190
Patch 2 also matches what I saw in the same setup. On the unpatched
tree, I can reproduce:
[ 56.120488] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591
[ 56.121118] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0
[ 56.123080] __mutex_lock+0xda/0x21c0
[ 56.123572] backlight_device_set_brightness+0x77/0x280
[ 56.123902] appletb_inactivity_timer+0xe9/0x190 [hid_appletb_kbd]
[ 56.124338] __run_timer_base.part.0+0x575/0x910
[ 56.124711] run_timer_softirq+0xd1/0x190
After applying patch 2, that warning no longer appeared in the timer
reproducer in my uhi/QEMU runs. I also added a small UHID input trigger
to exercise appletb_kbd_hid_event(), and in that setup brightness
restored from 1 back to 2 in 5/5 iterations after the synthetic key
event.
The limitation is that this is still UHID-only coverage. I do not have
native Touch Bar hardware, and pure UHID does not model a real internal
Apple keyboard/trackpad closely enough for me to claim coverage of the
appletb_kbd_inp_event() path or real USB IRQ-context behavior.
Thanks,
Sangyun
^ permalink raw reply
* Re: [PATCH v2 1/7] iio: HID: Add helper method hid_sensor_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:03 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, Pietro Di Consolo Gregorio, linux-iio,
linux-input
In-Reply-To: <20260421222210.16016-2-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:33PM -0300, Natália Salvino André wrote:
> Add helper method to deduplicate code in HID sensors.
...
> +#include <linux/bits.h>
Will need bitops.h instead (see below why).
...
> +void hid_sensor_adjust_channel_bit_mask(struct iio_chan_spec *channels,
> + int channel, int size)
> +{
> + channels[channel].scan_type.format = 's';
> + /* Real storage bits will change based on the report desc. */
> + channels[channel].scan_type.realbits = size * BITS_PER_BYTE;
BITS_TO_BYTES(size)
> + /* Maximum size of a sample to capture is u32 */
> + channels[channel].scan_type.storagebits = sizeof(u32) * BITS_PER_BYTE;
BITS_PER_TYPE(u32)
> +}
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 2/7] iio: accel: HID: Replace method accel_3d_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:07 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, Pietro Di Consolo Gregorio, linux-iio,
linux-input
In-Reply-To: <20260421222210.16016-3-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:34PM -0300, Natália Salvino André wrote:
> Replace method accel_3d_adjust_channel_bit_mask()
> with helper method hid_sensor_adjust_channel_bit_mask().
...
> - accel_3d_adjust_channel_bit_mask(channels,
> - CHANNEL_SCAN_INDEX_X + i,
> - st->accel[CHANNEL_SCAN_INDEX_X + i].size);
> + hid_sensor_adjust_channel_bit_mask(channels,
> + CHANNEL_SCAN_INDEX_X + i,
> + st->accel[CHANNEL_SCAN_INDEX_X + i].size);
Indentation is broken. Taking into account that the last line is too long when
properly indented, perhaps
hid_sensor_adjust_channel_bit_mask(channels,
CHANNEL_SCAN_INDEX_X + i,
st->accel[CHANNEL_SCAN_INDEX_X + i].size);
Which makes it most right and under 80 limit.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 3/7] iio: gyro: HID: Replace method gyro_3d_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:14 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, Pietro Di Consolo Gregorio, linux-iio,
linux-input
In-Reply-To: <20260421222210.16016-4-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:35PM -0300, Natália Salvino André wrote:
> Replace method gyro_3d_adjust_channel_bit_mask()
> with helper method hid_sensor_adjust_channel_bit_mask().
...
> + hid_sensor_adjust_channel_bit_mask(channels,
> + CHANNEL_SCAN_INDEX_X + i,
> + st->gyro[CHANNEL_SCAN_INDEX_X + i].size);
Same, at least one more tab for indentation.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH 0/2] HID: appletb-kbd: fix UAF and mutex-in-atomic in inactivity timer
From: Aditya Garg @ 2026-04-22 9:15 UTC (permalink / raw)
To: Sangyun Kim
Cc: jikos@kernel.org, bentiss@kernel.org, qasdev00@gmail.com,
linux-input@vger.kernel.org, linux-kernel@vger.kernel.org
In-Reply-To: <20260422060104.jbimo4nm6pat3f53@nunu>
I got the bug just once so it's possible that it was a firmware related bug in the touchbar as well.
> On 22 Apr 2026, at 11:31 AM, Sangyun Kim <sangyun.kim@snu.ac.kr> wrote:
>
> On Mon, Apr 20, 2026 at 06:17:36 PM +0530, Aditya Garg wrote:
>
>>
>>
>>> On 4/20/26 10:43, Sangyun Kim wrote:
>>> This series addresses two defects in hid-appletb-kbd's inactivity
>>> timer subsystem. The two patches target different bugs and are
>>> logically independent; they are sent together because they touch the
>>> same tear-down code and because the same maintainer will review both.
>>>
>>> Patch 1 fixes a slab use-after-free with two related tear-down windows
>>> introduced by commit 38224c472a03 ("HID: appletb-kbd: fix slab
>>> use-after-free bug in appletb_kbd_probe"):
>>>
>>> A) Within "if (kbd->backlight_dev)" the order was
>>> put_device() then timer_delete_sync(). A concurrent
>>> hid_appletb_bl unbind between those two calls can drop the last
>>> devm reference and free the backlight_device; the still-armed
>>> inactivity timer softirq then dereferences the freed object
>>> through backlight_device_set_brightness() -> mutex_lock(&ops_lock).
>>>
>>> B) The "if (kbd->backlight_dev)" block ran before
>>> hid_hw_close()/hid_hw_stop(), so even after window A is closed a
>>> late ".event" callback from the HID core (USB URB completion on
>>> real hardware) can arrive between timer_delete_sync() and
>>> put_device(), reach reset_inactivity_timer(), re-arm the timer
>>> via mod_timer(), and reopen the same UAF.
>>>
>>> Both windows produce the same KASAN slab-use-after-free on the object
>>> allocated by devm_backlight_device_register(). Patch 1 closes them
>>> together by moving hid_hw_close()/hid_hw_stop() before the backlight
>>> cleanup and, inside that cleanup block, calling timer_delete_sync()
>>> before put_device(). Shipping both as one commit avoids leaving
>>> stable kernels in a half-fixed state where only window A is closed.
>>>
>>> Patch 2 fixes a separate "sleeping function called from invalid
>>> context" bug in the same subsystem. The inactivity timer is a
>>> struct timer_list, so the callback runs in softirq context and calls
>>> backlight_device_set_brightness() -> mutex_lock() from atomic
>>> context; reset_inactivity_timer() has the same issue on the
>>> brightness-restore path (it is called from appletb_kbd_hid_event()
>>> and appletb_kbd_inp_event(), which run in softirq/IRQ context on
>>> real USB hardware). Convert the inactivity timer to a delayed_work
>>> and defer the brightness-restore call to a dedicated work_struct so
>>> both sleeping calls run in process context.
>>>
>>> Sangyun Kim (2):
>>> HID: appletb-kbd: fix UAF in inactivity-timer cleanup path
>>> HID: appletb-kbd: run inactivity autodim from workqueues
>>>
>>> drivers/hid/hid-appletb-kbd.c | 56 ++++++++++++++++++++++-------------
>>> 1 file changed, 36 insertions(+), 20 deletions(-)
>>>
>>
>> I had a very weird bug just once. And that was when I pressed fn key, upon releasing, the touchbar mode did not restore to normal.
>>
>> Although it was just once, and I was never able to reproduce it again.
>>
>> Have you tested it on your Machine btw?
>>
>>
>
> Hi,
>
> I have not tested this series on actual Apple Touch Bar hardware on my
> side, as I do not have access to such a machine locally. All testing on
> my side was done under QEMU with a uhid-based setup.
>
> Because of that, I cannot say much about the one-off case where the
> Touch Bar did not restore the normal mode after releasing Fn. I have not
> been able to reproduce that specific behavior in my setup.
>
> For patch 1, however, I was able to reproduce the teardown UAF in the
> uhid/QEMU setup and got the following KASAN report.
>
> [ 56.040407] ==================================================================
> [ 56.042444] BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x861/0x910
> [ 56.044962] Write of size 8 at addr ffff88801b7e8958 by task swapper/0/0
> [ 56.049092] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G N 7.0.0-dirty #2 PREEMPT(full)
> [ 56.049967] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> [ 56.050843] Call Trace:
> [ 56.051146] <IRQ>
> [ 56.052394] __run_timer_base.part.0+0x861/0x910
> [ 56.053123] run_timer_softirq+0xd1/0x190
>
> [ 56.075012] Allocated by task 11:
> [ 56.077221] devm_kmalloc+0x70/0x1d0
> [ 56.077545] appletb_kbd_probe+0x65/0x470 [hid_appletb_kbd]
> [ 56.085606] uhid_device_add_worker+0x3b/0x100
>
> [ 56.088719] Freed by task 11:
> [ 56.091296] devres_release_group+0x1fd/0x3d0
> [ 56.091844] hid_device_probe+0x4db/0x7d0
> [ 56.096916] uhid_device_add_worker+0x3b/0x100
>
> [ 56.123572] backlight_device_set_brightness+0x77/0x280
> [ 56.123902] appletb_inactivity_timer+0xe9/0x190 [hid_appletb_kbd]
> [ 56.123967] call_timer_fn+0x163/0x4a0
> [ 56.124338] __run_timer_base.part.0+0x575/0x910
> [ 56.124711] run_timer_softirq+0xd1/0x190
>
> Patch 2 also matches what I saw in the same setup. On the unpatched
> tree, I can reproduce:
>
> [ 56.120488] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591
> [ 56.121118] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0
> [ 56.123080] __mutex_lock+0xda/0x21c0
> [ 56.123572] backlight_device_set_brightness+0x77/0x280
> [ 56.123902] appletb_inactivity_timer+0xe9/0x190 [hid_appletb_kbd]
> [ 56.124338] __run_timer_base.part.0+0x575/0x910
> [ 56.124711] run_timer_softirq+0xd1/0x190
>
> After applying patch 2, that warning no longer appeared in the timer
> reproducer in my uhi/QEMU runs. I also added a small UHID input trigger
> to exercise appletb_kbd_hid_event(), and in that setup brightness
> restored from 1 back to 2 in 5/5 iterations after the synthetic key
> event.
>
> The limitation is that this is still UHID-only coverage. I do not have
> native Touch Bar hardware, and pure UHID does not model a real internal
> Apple keyboard/trackpad closely enough for me to claim coverage of the
> appletb_kbd_inp_event() path or real USB IRQ-context behavior.
>
> Thanks,
> Sangyun
^ permalink raw reply
* Re: [PATCH v2 5/7] iio: light: HID: Replace method prox_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:16 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, Pietro Di Consolo Gregorio, linux-iio,
linux-input
In-Reply-To: <20260421222210.16016-6-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:37PM -0300, Natália Salvino André wrote:
> Replace method prox_adjust_channel_bit_mask()
> with helper method hid_sensor_adjust_channel_bit_mask().
...
> + hid_sensor_adjust_channel_bit_mask(channels, index,
> + st->prox_attr[index].size);
This fits 80 when indented properly.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 4/7] iio: light: HID: Replace method als_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:17 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, Pietro Di Consolo Gregorio, linux-iio,
linux-input
In-Reply-To: <20260421222210.16016-5-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:36PM -0300, Natália Salvino André wrote:
> Replace method als_adjust_channel_bit_mask()
> with helper method hid_sensor_adjust_channel_bit_mask().
...
> - als_adjust_channel_bit_mask(channels, index, st->als[i].size);
> + hid_sensor_adjust_channel_bit_mask(channels, index, st->als[i].size);
Indent to next line
hid_sensor_adjust_channel_bit_mask(channels, index,
st->als[i].size);
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 6/7] iio: magnetometer: HID: Replace method magn_3d_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:18 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, Pietro Di Consolo Gregorio, linux-iio,
linux-input
In-Reply-To: <20260421222210.16016-7-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:38PM -0300, Natália Salvino André wrote:
> Replace method magn_3d_adjust_channel_bit_mask()
> with helper method hid_sensor_adjust_channel_bit_mask().
...
> - magn_3d_adjust_channel_bit_mask(_channels,
> - *chan_count,
> - st->magn[i].size);
> + hid_sensor_adjust_channel_bit_mask(_channels,
> + *chan_count,
> + st->magn[i].size);
Fix the indentation accordingly.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 7/7] iio: pressure: HID: Replace method press_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:18 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, Pietro Di Consolo Gregorio, linux-iio,
linux-input
In-Reply-To: <20260421222210.16016-8-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:39PM -0300, Natália Salvino André wrote:
> Replace method press_adjust_channel_bit_mask()
> with helper method hid_sensor_adjust_channel_bit_mask().
...
> - press_adjust_channel_bit_mask(channels, CHANNEL_SCAN_INDEX_PRESSURE,
> - st->press_attr.size);
> + hid_sensor_adjust_channel_bit_mask(channels, CHANNEL_SCAN_INDEX_PRESSURE,
> + st->press_attr.size);
Ouch!
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 0/7] Add helper method hid_sensor_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:21 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, linux-iio, linux-input
In-Reply-To: <20260421222210.16016-1-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:32PM -0300, Natália Salvino André wrote:
> This patch series introduces a generic helper function to handle channel bit mask adjustments
> for HID sensors. Currently, multiple drivers implement identical logic for this task
This message should be wrapped on ~72 characters. Some of the maintainers may
use cover letter as fake-merge commit message. And even if not, the standards
in the kernel for the cover letter and commit messages are the same in terms of
writing rules.
Basically this is the biggest issue in the whole series: missed proper
indentation / wrapping.
Code wise looks good, thanks for doing this!
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* [git pull] Input updates for v7.1-rc0
From: Dmitry Torokhov @ 2026-04-22 15:05 UTC (permalink / raw)
To: Linus Torvalds; +Cc: linux-kernel, linux-input
Hi Linus,
Please pull from:
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git tags/input-for-v7.1-rc0
to receive updates for the input subsystem. You will get:
- a new charlieplex GPIO keypad driver
- an update to aw86927 driver to support 86938 chip
- an update for Chrome OS EC keyboard driver to support Fn-<key> keymap
extension
- an UAF fix in debugfs teardown in EDT touchscreen driver
- a number of conversions for input drivers to use guard() and __free()
cleanup primitives
- several drivers for bus mice (inport, logibm) and other very old
devices have been removed
- OLPC HGPK PS/2 protocol has been removed as it's been broken and
inactive for 10 something years
- dedicated kpsmoused has been removed from psmouse driver
- other assorted cleanups and fixups.
Changelog:
---------
Ariel Silver (1):
Input: atkbd - validate scancode in firmware keymap entries
Bhushan Shah (1):
dt-bindings: input: touchscreen: edt-ft5x06: Add FocalTech FT3519
Dmitry Torokhov (57):
Input: cros_ec_keyb - use u8 instead of uint8_t
Input: cros_ec_keyb - use BIT() macro instead of open-coding shifts
Input: cros_ec_keyb - simplify cros_ec_keyb_work()
Input: cros_ec_keyb - do not allocate keyboard state separately
Input: cros_ec_keyb - factor out column processing
Input: atkbd - use __free() cleanup facility in when parsing FW keymap
Input: atkbd - use dev_warn_ratelimited()
Input: atkbd - switch to using explicitly sized types
Input: atkbd - fix various formatting issues
Input: hgpk - remove protocol support
Input: alps - use standard workqueue when registering supplemental device
Input: psmouse - remove dedicated kpsmoused workqueue
Input: ad7877 - use guard notation when acquiring mutexes/locks
Input: ad7879 - use guard notation when acquiring mutexes
Input: ads7846 - switch to using cleanup functions
Input: atmel_mxt_ts - switch to using cleanup functions
Input: auo-pixcir-ts - use guard notation when acquiring mutexes
Input: bu21029_ts - use guard notation when acquiring mutex
Input: chipone_icn8318 - use guard notation when acquiring mutex
Input: cyttsp - use guard notation when acquiring mutex
Input: edt-ft5x06 - use guard notation when acquiring mutex
Input: eeti_ts - use guard notation when acquiring mutexes
Input: ektf2127 - use guard notation when acquiring mutex
Input: elants_i2c - switch to using cleanup facilities
Input: elo - use guard notation when acquiring mutex
Input: exc3000 - use guard notation when acquiring mutex
Input: goodix - switch to using cleanup functions in firmware code
Input: hideep - switch to using cleanup functions
Input: hycon-hy46xx - use guard notation when acquiring mutex
Input: imagis - use guard notation when acquiring mutex
Input: imx6ul_tsc - use guard notation when acquiring mutex
Input: ipaq-micro-ts - use guard notation when acquiring mutex/spinlock
Input: iqs5xx - switch to using cleanup functions
Input: iqs5xx - simplify parsing of firmware blob
Input: iqs7211 - use cleanup facility for fwnodes
Input: lpc32xx_ts - use guard notation when acquiring mutex
Input: melfas_mip4 - switch to using cleanup functions
Input: mk712 - use guard notation when acquiring spinlock
Input: mms114 - use guard notation when acquiring mutex
Input: msg2638 - use guard notation when acquiring mutex
Input: mxs-lradc-ts - use guard notation when acquiring spinlock
Input: novatek-nvt-ts - use guard notation when acquiring mutex
Input: pixcir_i2c_ts - use guard notation when acquiring mutex
Input: raydium_i2c_ts - switch to using cleanup functions
Input: stmfts - use guard notation when acquiring mutex
Input: sur40 - use guard notation when acquiring spinlock
Input: sx8654 - use guard notation when acquiring spinlock
Input: sx8654 - use IRQF_NOAUTOEN when requesting interrupt
Input: tsc2007 - use guard notation when acquiring mutexes
Input: wdt87xx_i2c - switch to using cleanup functions
Input: wm97xx - use guard notation when acquiring mutex
Input: zinitix - use guard notation when acquiring mutex
Input: inport - remove driver
Input: logibm - remove driver
Input: mk712 - remove driver
Input: ct82c710 - remove driver
Input: edt-ft5x06 - fix use-after-free in debugfs teardown
Duoming Zhou (1):
Input: psmouse - replace flush_workqueue() with disable_delayed_work_sync()
Eduard Bostina (1):
dt-bindings: input: touchscreen: Convert TS-4800 to DT schema
Elliot Tester (1):
Input: xpad - remove stale TODO and changelog header
Ethan Carter Edwards (1):
Input: imx_keypad - fix spelling mistake "Colums" -> "Columns"
Fabio Baltieri (2):
Input: export input_default_setkeycode
Input: cros_ec_keyb - add function key support
Griffin Kroah-Hartman (3):
Input: aw86927 - respect vibration magnitude levels
dt-bindings: input: awinic,aw86927: Add Awinic AW86938
Input: aw86927 - add support for Awinic AW86938
Hugo Villeneuve (5):
dt-bindings: input: matrix-keymap: fix key board wording
dt-bindings: input: add debounce-delay-ms common property
dt-bindings: input: add settling-time-us common property
dt-bindings: input: add GPIO charlieplex keypad
Input: charlieplex_keypad - add GPIO charlieplex keypad
Johan Hovold (4):
Input: keyspan-remote - refactor endpoint lookup
Input: appletouch - refactor endpoint lookup
Input: synaptics_usb - refactor endpoint lookup
Input: usbtouchscreen - refactor endpoint lookup
Langyan Ye (2):
dt-bindings: input: Add Parade TC3408 touchscreen controller
HID: i2c-hid: elan: Add parade-tc3408 timing
Marek Vasut (1):
dt-bindings: touchscreen: trivial-touch: Move allOf: after required:
Max Brener (1):
Input: libps2 - embed WARN_ON(1) macros into their enclosing if statements
Michael Tretter (2):
Input: st1232 - read firmware version and revision
Input: st1232 - expose firmware version via sysfs
Oliver Neukum (2):
Input: aiptek - use HID headers
Input: pegasus_notetaker - use HID defines
Pengpeng Hou (2):
Input: gf2k - skip invalid hat lookup values
Input: aiptek - validate raw macro indices before updating state
Rafael J. Wysocki (1):
Input: atlas - convert ACPI driver to a platform one
Sanjay Govind (1):
Input: xpad - add RedOctane Games vendor id
Seungjin Bae (1):
Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
Thorsten Blum (3):
Input: adxl34x - drop redundant error variable in adxl34x_i2c_probe
Input: qt1050 - inline i2c_check_functionality check
Input: qt1070 - inline i2c_check_functionality check
Val Packett (1):
Input: goodix-berlin - report a resolution of 10 units/mm
Yauhen Kharuzhy (5):
Input: drv260x - add I2C IDs for all device variants
Input: drv260x - sort all #include alphabetically
Input: drv260x - add support for ACPI-enumerated devices
Input: drv260x - handle calibration timeout
Input: drv260x - fix unbalanced regulator_disable() call
bui duc phuc (2):
dt-bindings: input: touchscreen: sitronix,st1232: Add wakeup-source
Input: mpr121 - drop redundant wakeup handling
Diffstat:
--------
.../bindings/auxdisplay/holtek,ht16k33.yaml | 5 +-
.../devicetree/bindings/input/awinic,aw86927.yaml | 7 +-
.../bindings/input/cirrus,ep9307-keypad.yaml | 7 +-
.../bindings/input/gpio-charlieplex-keypad.yaml | 108 ++
.../bindings/input/gpio-matrix-keypad.yaml | 5 +-
Documentation/devicetree/bindings/input/input.yaml | 16 +
.../devicetree/bindings/input/matrix-keymap.yaml | 4 +-
.../bindings/input/mediatek,mt6779-keypad.yaml | 1 +
.../devicetree/bindings/input/parade,tc3408.yaml | 68 ++
.../bindings/input/touchscreen/edt-ft5x06.yaml | 30 +-
.../input/touchscreen/sitronix,st1232.yaml | 4 +
.../input/touchscreen/technologic,ts4800-ts.yaml | 42 +
.../bindings/input/touchscreen/trivial-touch.yaml | 6 +-
.../bindings/input/touchscreen/ts4800-ts.txt | 11 -
.../devicetree/bindings/mfd/fsl,mc13xxx.yaml | 2 -
MAINTAINERS | 7 +
drivers/hid/i2c-hid/i2c-hid-of-elan.c | 8 +
drivers/input/input.c | 23 +-
drivers/input/joystick/gf2k.c | 6 +-
drivers/input/joystick/xpad.c | 35 +-
drivers/input/keyboard/Kconfig | 14 +
drivers/input/keyboard/Makefile | 1 +
drivers/input/keyboard/atkbd.c | 133 ++-
drivers/input/keyboard/charlieplex_keypad.c | 232 +++++
drivers/input/keyboard/cros_ec_keyb.c | 261 +++--
drivers/input/keyboard/imx_keypad.c | 4 +-
drivers/input/keyboard/mpr121_touchkey.c | 8 -
drivers/input/keyboard/qt1050.c | 3 +-
drivers/input/keyboard/qt1070.c | 3 +-
drivers/input/misc/adxl34x-i2c.c | 5 +-
drivers/input/misc/atlas_btns.c | 22 +-
drivers/input/misc/aw86927.c | 66 +-
drivers/input/misc/drv260x.c | 50 +-
drivers/input/misc/ims-pcu.c | 32 +-
drivers/input/misc/keyspan_remote.c | 22 +-
drivers/input/mouse/Kconfig | 36 -
drivers/input/mouse/Makefile | 3 -
drivers/input/mouse/alps.c | 11 +-
drivers/input/mouse/alps.h | 4 +-
drivers/input/mouse/appletouch.c | 21 +-
drivers/input/mouse/hgpk.c | 1063 --------------------
drivers/input/mouse/hgpk.h | 61 --
drivers/input/mouse/inport.c | 177 ----
drivers/input/mouse/logibm.c | 166 ---
drivers/input/mouse/psmouse-base.c | 51 +-
drivers/input/mouse/psmouse.h | 6 +-
drivers/input/mouse/synaptics_usb.c | 23 +-
drivers/input/serio/Kconfig | 13 -
drivers/input/serio/Makefile | 1 -
drivers/input/serio/ct82c710.c | 239 -----
drivers/input/serio/libps2.c | 12 +-
drivers/input/tablet/aiptek.c | 20 +-
drivers/input/tablet/pegasus_notetaker.c | 7 +-
drivers/input/touchscreen/Kconfig | 12 -
drivers/input/touchscreen/Makefile | 1 -
drivers/input/touchscreen/ad7877.c | 32 +-
drivers/input/touchscreen/ad7879.c | 46 +-
drivers/input/touchscreen/ads7846.c | 44 +-
drivers/input/touchscreen/atmel_mxt_ts.c | 290 +++---
drivers/input/touchscreen/auo-pixcir-ts.c | 43 +-
drivers/input/touchscreen/bu21029_ts.c | 8 +-
drivers/input/touchscreen/chipone_icn8318.c | 8 +-
drivers/input/touchscreen/cyttsp_core.c | 20 +-
drivers/input/touchscreen/edt-ft5x06.c | 90 +-
drivers/input/touchscreen/eeti_ts.c | 27 +-
drivers/input/touchscreen/ektf2127.c | 8 +-
drivers/input/touchscreen/elants_i2c.c | 91 +-
drivers/input/touchscreen/elo.c | 32 +-
drivers/input/touchscreen/exc3000.c | 31 +-
drivers/input/touchscreen/goodix_berlin_core.c | 8 +
drivers/input/touchscreen/goodix_fwupload.c | 29 +-
drivers/input/touchscreen/hideep.c | 54 +-
drivers/input/touchscreen/hycon-hy46xx.c | 31 +-
drivers/input/touchscreen/imagis.c | 30 +-
drivers/input/touchscreen/imx6ul_tsc.c | 19 +-
drivers/input/touchscreen/ipaq-micro-ts.c | 8 +-
drivers/input/touchscreen/iqs5xx.c | 190 ++--
drivers/input/touchscreen/iqs7211.c | 24 +-
drivers/input/touchscreen/lpc32xx_ts.c | 8 +-
drivers/input/touchscreen/melfas_mip4.c | 121 +--
drivers/input/touchscreen/mk712.c | 215 ----
drivers/input/touchscreen/mms114.c | 20 +-
drivers/input/touchscreen/msg2638.c | 19 +-
drivers/input/touchscreen/mxs-lradc-ts.c | 7 +-
drivers/input/touchscreen/novatek-nvt-ts.c | 8 +-
drivers/input/touchscreen/pixcir_i2c_ts.c | 38 +-
drivers/input/touchscreen/raydium_i2c_ts.c | 56 +-
drivers/input/touchscreen/st1232.c | 67 +-
drivers/input/touchscreen/stmfts.c | 63 +-
drivers/input/touchscreen/sur40.c | 23 +-
drivers/input/touchscreen/sx8654.c | 20 +-
drivers/input/touchscreen/tsc2007_core.c | 7 +-
drivers/input/touchscreen/tsc2007_iio.c | 9 +-
drivers/input/touchscreen/usbtouchscreen.c | 43 +-
drivers/input/touchscreen/wdt87xx_i2c.c | 44 +-
drivers/input/touchscreen/wm97xx-core.c | 57 +-
drivers/input/touchscreen/zinitix.c | 19 +-
include/linux/input.h | 4 +
98 files changed, 1815 insertions(+), 3374 deletions(-)
create mode 100644 Documentation/devicetree/bindings/input/gpio-charlieplex-keypad.yaml
create mode 100644 Documentation/devicetree/bindings/input/parade,tc3408.yaml
create mode 100644 Documentation/devicetree/bindings/input/touchscreen/technologic,ts4800-ts.yaml
delete mode 100644 Documentation/devicetree/bindings/input/touchscreen/ts4800-ts.txt
create mode 100644 drivers/input/keyboard/charlieplex_keypad.c
delete mode 100644 drivers/input/mouse/hgpk.c
delete mode 100644 drivers/input/mouse/hgpk.h
delete mode 100644 drivers/input/mouse/inport.c
delete mode 100644 drivers/input/mouse/logibm.c
delete mode 100644 drivers/input/serio/ct82c710.c
delete mode 100644 drivers/input/touchscreen/mk712.c
Thanks.
--
Dmitry
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox