* Re: [PATCH 5/6] HID: asus: add microphone mute LED support for T3304
From: James Ye @ 2026-05-04 1:27 UTC (permalink / raw)
To: Denis Benato
Cc: jikos, bentiss, lee, pavel, linux-input, linux-leds, linux-kernel
In-Reply-To: <769ce05a-3148-408f-b012-74a85c1a2343@linux.dev>
On Mon, 4 May 2026 at 08:45, Denis Benato <denis.benato@linux.dev> wrote:
> Isn't QUIRK_T3304_KEYBOARD enough? Or are you saying you know there is more than one keyboard
> model that requires this?
I don't know for certain if there are any other such keyboards with
LEDs that need to be handled like this, but I can imagine that there
are.
I decided to introduce an additional quirk because:
- I don't know how to detect if a micmute LED is present.
- The quirk could be used to implement support in other devices.
- asus_kbd_register_leds is also gated by QUIRK_USE_KBD_BACKLIGHT,
adding a device-specific quirk didn't feel appropriate.
If there turns out to be a widely-supported detection method and T330
doesn't support this, then just QUIRK_T3304_KEYBOARD would be better.
If you would prefer then I shall remove QUIRK_HID_MICMUTE. This can be
revisited when more than one device uses this code.
>
> Do we really want to use strlen?
>
> Do we really want to use strlen on the result of a function without additional checks?
My understanding is that this is safe, as this name is set by the
kernel. Existing use of dev_name appears to not involve additional
checks.
> This doesn't look like a good idea to change this for all laptops under the sun...
>
>
> Perhaps might make sense to move this check before? Maybe not?
Returning an error from asus_kbd_register_leds is currently non-fatal,
so the only difference in behaviour is that devices with
QUIRK_USE_KBD_BACKLIGHT that do not report supporting a backlight will
no longer log a warning.
T3304 indeed lacks a backlight, so we can't proceed with the backlight
setup code, but asus_kbd_get_functions() is still a prerequisite for
the micmute LED.
I think the alternative is:
- Move the asus_kbd_get_functions() call site from
asus_kbd_register_leds() to asus_probe(), and
- Separate asus_kbd_register_leds() into two functions for backlight
and micmute LEDs respectively, keeping the current behaviour for
backlight registration.
Your thoughts?
Cheers,
James
>
> Denis
^ permalink raw reply
* [PATCH v3 0/4] HID: Proper fix for OOM in hid-core
From: Benjamin Tissoires @ 2026-05-04 8:47 UTC (permalink / raw)
To: Jiri Kosina, Filipe Laíns, Bastien Nocera, Ping Cheng,
Jason Gerecke, Viresh Kumar, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Lee Jones
Cc: Icenowy Zheng, linux-input, linux-kernel, greybus-dev,
linux-staging, linux-usb, Benjamin Tissoires, stable
Commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
bogus memset()") enforced the provided data to be at least the size of
the declared buffer in the report descriptor to prevent a buffer
overflow.
We only had corner cases of malicious devices exposing the OOM because
in most cases, the buffer provided by the transport layer needs to be
allocated at probe time and is large enough to handle all the possible
reports.
However, the patch from above, which enforces the spec a little bit more
introduced both regressions for devices not following the spec (not
necesserally malicious), but also a stream of errors for those devices.
Let's revert to the old behavior by giving more information to HID core
to be able to decide whether it can or not memset the rest of the buffer
to 0 and continue the processing.
Note that the first commit makes an API change, but the callers are
relatively limited, so it should be fine on its own. The second patch
can't really make the same kind of API change because we have too many
callers in various subsystems. We can switch them one by one to the safe
approach when needed.
The last 2 patches are small cleanups I initially put together with the
2 first patches, but they can be applied on their own and don't need to
be pulled in stable like the first 2.
Cheers,
Benjamin
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
Changes in v3:
- fixed ghib -> ghid in greybus
- fixed i386 size_t debug size reported by kernel-bot
- Link to v2: https://lore.kernel.org/r/20260416-wip-fix-core-v2-0-be92570e5627@kernel.org
Changes in v2:
- added a small blurb explaining the difference between the safe and the
non safe version of hid_safe_input_report
- Link to v1: https://lore.kernel.org/r/20260415-wip-fix-core-v1-0-ed3c4c823175@kernel.org
---
Benjamin Tissoires (4):
HID: pass the buffer size to hid_report_raw_event
HID: core: introduce hid_safe_input_report()
HID: multitouch: use __free(kfree) to clean up temporary buffers
HID: wacom: use __free(kfree) to clean up temporary buffers
drivers/hid/bpf/hid_bpf_dispatch.c | 6 ++--
drivers/hid/hid-core.c | 67 ++++++++++++++++++++++++++++++--------
drivers/hid/hid-gfrm.c | 4 +--
drivers/hid/hid-logitech-hidpp.c | 2 +-
drivers/hid/hid-multitouch.c | 18 ++++------
drivers/hid/hid-primax.c | 2 +-
drivers/hid/hid-vivaldi-common.c | 2 +-
drivers/hid/i2c-hid/i2c-hid-core.c | 7 ++--
drivers/hid/usbhid/hid-core.c | 11 ++++---
drivers/hid/wacom_sys.c | 46 +++++++++-----------------
drivers/staging/greybus/hid.c | 2 +-
include/linux/hid.h | 6 ++--
include/linux/hid_bpf.h | 14 +++++---
13 files changed, 109 insertions(+), 78 deletions(-)
---
base-commit: 7df6572f1cb381d6b89ceed58e3b076c233c2cd0
change-id: 20260415-wip-fix-core-7d85c8516ed0
Best regards,
--
Benjamin Tissoires <bentiss@kernel.org>
^ permalink raw reply
* [PATCH v3 1/4] HID: pass the buffer size to hid_report_raw_event
From: Benjamin Tissoires @ 2026-05-04 8:47 UTC (permalink / raw)
To: Jiri Kosina, Filipe Laíns, Bastien Nocera, Ping Cheng,
Jason Gerecke, Viresh Kumar, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Lee Jones
Cc: Icenowy Zheng, linux-input, linux-kernel, greybus-dev,
linux-staging, linux-usb, Benjamin Tissoires, stable
In-Reply-To: <20260504-wip-fix-core-v3-0-ce1f11f4968f@kernel.org>
commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
bogus memset()") enforced the provided data to be at least the size of
the declared buffer in the report descriptor to prevent a buffer
overflow. However, we can try to be smarter by providing both the buffer
size and the data size, meaning that hid_report_raw_event() can make
better decision whether we should plaining reject the buffer (buffer
overflow attempt) or if we can safely memset it to 0 and pass it to the
rest of the stack.
Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
drivers/hid/bpf/hid_bpf_dispatch.c | 6 ++++--
drivers/hid/hid-core.c | 42 +++++++++++++++++++++++++-------------
drivers/hid/hid-gfrm.c | 4 ++--
drivers/hid/hid-logitech-hidpp.c | 2 +-
drivers/hid/hid-multitouch.c | 2 +-
drivers/hid/hid-primax.c | 2 +-
drivers/hid/hid-vivaldi-common.c | 2 +-
drivers/hid/wacom_sys.c | 6 +++---
drivers/staging/greybus/hid.c | 2 +-
include/linux/hid.h | 4 ++--
include/linux/hid_bpf.h | 14 ++++++++-----
11 files changed, 53 insertions(+), 33 deletions(-)
diff --git a/drivers/hid/bpf/hid_bpf_dispatch.c b/drivers/hid/bpf/hid_bpf_dispatch.c
index 50c7b45c59e3..d0130658091b 100644
--- a/drivers/hid/bpf/hid_bpf_dispatch.c
+++ b/drivers/hid/bpf/hid_bpf_dispatch.c
@@ -24,7 +24,8 @@ EXPORT_SYMBOL(hid_ops);
u8 *
dispatch_hid_bpf_device_event(struct hid_device *hdev, enum hid_report_type type, u8 *data,
- u32 *size, int interrupt, u64 source, bool from_bpf)
+ size_t *buf_size, u32 *size, int interrupt, u64 source,
+ bool from_bpf)
{
struct hid_bpf_ctx_kern ctx_kern = {
.ctx = {
@@ -74,6 +75,7 @@ dispatch_hid_bpf_device_event(struct hid_device *hdev, enum hid_report_type type
*size = ret;
}
+ *buf_size = ctx_kern.ctx.allocated_size;
return ctx_kern.data;
}
EXPORT_SYMBOL_GPL(dispatch_hid_bpf_device_event);
@@ -505,7 +507,7 @@ __hid_bpf_input_report(struct hid_bpf_ctx *ctx, enum hid_report_type type, u8 *b
if (ret)
return ret;
- return hid_ops->hid_input_report(ctx->hid, type, buf, size, 0, (u64)(long)ctx, true,
+ return hid_ops->hid_input_report(ctx->hid, type, buf, size, size, 0, (u64)(long)ctx, true,
lock_already_taken);
}
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 61afec5915ec..a806820df7e5 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2033,24 +2033,32 @@ int __hid_request(struct hid_device *hid, struct hid_report *report,
}
EXPORT_SYMBOL_GPL(__hid_request);
-int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
- int interrupt)
+int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data,
+ size_t bufsize, u32 size, int interrupt)
{
struct hid_report_enum *report_enum = hid->report_enum + type;
struct hid_report *report;
struct hid_driver *hdrv;
int max_buffer_size = HID_MAX_BUFFER_SIZE;
u32 rsize, csize = size;
+ size_t bsize = bufsize;
u8 *cdata = data;
int ret = 0;
report = hid_get_report(report_enum, data);
if (!report)
- goto out;
+ return 0;
+
+ if (unlikely(bsize < csize)) {
+ hid_warn_ratelimited(hid, "Event data for report %d is incorrect (%d vs %ld)\n",
+ report->id, csize, bsize);
+ return -EINVAL;
+ }
if (report_enum->numbered) {
cdata++;
csize--;
+ bsize--;
}
rsize = hid_compute_report_size(report);
@@ -2063,11 +2071,16 @@ int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *
else if (rsize > max_buffer_size)
rsize = max_buffer_size;
+ if (bsize < rsize) {
+ hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %ld)\n",
+ report->id, rsize, bsize);
+ return -EINVAL;
+ }
+
if (csize < rsize) {
- hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %d)\n",
- report->id, rsize, csize);
- ret = -EINVAL;
- goto out;
+ dbg_hid("report %d is too short, (%d < %d)\n", report->id,
+ csize, rsize);
+ memset(cdata + csize, 0, rsize - csize);
}
if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)
@@ -2075,7 +2088,7 @@ int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *
if (hid->claimed & HID_CLAIMED_HIDRAW) {
ret = hidraw_report_event(hid, data, size);
if (ret)
- goto out;
+ return ret;
}
if (hid->claimed != HID_CLAIMED_HIDRAW && report->maxfield) {
@@ -2087,15 +2100,15 @@ int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *
if (hid->claimed & HID_CLAIMED_INPUT)
hidinput_report_event(hid, report);
-out:
+
return ret;
}
EXPORT_SYMBOL_GPL(hid_report_raw_event);
static int __hid_input_report(struct hid_device *hid, enum hid_report_type type,
- u8 *data, u32 size, int interrupt, u64 source, bool from_bpf,
- bool lock_already_taken)
+ u8 *data, size_t bufsize, u32 size, int interrupt, u64 source,
+ bool from_bpf, bool lock_already_taken)
{
struct hid_report_enum *report_enum;
struct hid_driver *hdrv;
@@ -2120,7 +2133,8 @@ static int __hid_input_report(struct hid_device *hid, enum hid_report_type type,
report_enum = hid->report_enum + type;
hdrv = hid->driver;
- data = dispatch_hid_bpf_device_event(hid, type, data, &size, interrupt, source, from_bpf);
+ data = dispatch_hid_bpf_device_event(hid, type, data, &bufsize, &size, interrupt,
+ source, from_bpf);
if (IS_ERR(data)) {
ret = PTR_ERR(data);
goto unlock;
@@ -2149,7 +2163,7 @@ static int __hid_input_report(struct hid_device *hid, enum hid_report_type type,
goto unlock;
}
- ret = hid_report_raw_event(hid, type, data, size, interrupt);
+ ret = hid_report_raw_event(hid, type, data, bufsize, size, interrupt);
unlock:
if (!lock_already_taken)
@@ -2171,7 +2185,7 @@ static int __hid_input_report(struct hid_device *hid, enum hid_report_type type,
int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
int interrupt)
{
- return __hid_input_report(hid, type, data, size, interrupt, 0,
+ return __hid_input_report(hid, type, data, size, size, interrupt, 0,
false, /* from_bpf */
false /* lock_already_taken */);
}
diff --git a/drivers/hid/hid-gfrm.c b/drivers/hid/hid-gfrm.c
index 699186ff2349..d2a56bf92b41 100644
--- a/drivers/hid/hid-gfrm.c
+++ b/drivers/hid/hid-gfrm.c
@@ -66,7 +66,7 @@ static int gfrm_raw_event(struct hid_device *hdev, struct hid_report *report,
switch (data[1]) {
case GFRM100_SEARCH_KEY_DOWN:
ret = hid_report_raw_event(hdev, HID_INPUT_REPORT, search_key_dn,
- sizeof(search_key_dn), 1);
+ sizeof(search_key_dn), sizeof(search_key_dn), 1);
break;
case GFRM100_SEARCH_KEY_AUDIO_DATA:
@@ -74,7 +74,7 @@ static int gfrm_raw_event(struct hid_device *hdev, struct hid_report *report,
case GFRM100_SEARCH_KEY_UP:
ret = hid_report_raw_event(hdev, HID_INPUT_REPORT, search_key_up,
- sizeof(search_key_up), 1);
+ sizeof(search_key_up), sizeof(search_key_up), 1);
break;
default:
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index b1330d23bd2d..b3ff9265377b 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3673,7 +3673,7 @@ static int hidpp10_consumer_keys_raw_event(struct hidpp_device *hidpp,
memcpy(&consumer_report[1], &data[3], 4);
/* We are called from atomic context */
hid_report_raw_event(hidpp->hid_dev, HID_INPUT_REPORT,
- consumer_report, 5, 1);
+ consumer_report, sizeof(consumer_report), 5, 1);
return 1;
}
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index e82a3c4e5b44..eeab0b6e32cc 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -533,7 +533,7 @@ static void mt_get_feature(struct hid_device *hdev, struct hid_report *report)
}
ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf,
- size, 0);
+ size, size, 0);
if (ret)
dev_warn(&hdev->dev, "failed to report feature\n");
}
diff --git a/drivers/hid/hid-primax.c b/drivers/hid/hid-primax.c
index e44d79dff8de..8db054280afb 100644
--- a/drivers/hid/hid-primax.c
+++ b/drivers/hid/hid-primax.c
@@ -44,7 +44,7 @@ static int px_raw_event(struct hid_device *hid, struct hid_report *report,
data[0] |= (1 << (data[idx] - 0xE0));
data[idx] = 0;
}
- hid_report_raw_event(hid, HID_INPUT_REPORT, data, size, 0);
+ hid_report_raw_event(hid, HID_INPUT_REPORT, data, size, size, 0);
return 1;
default: /* unknown report */
diff --git a/drivers/hid/hid-vivaldi-common.c b/drivers/hid/hid-vivaldi-common.c
index bf734055d4b6..b12bb5cc091a 100644
--- a/drivers/hid/hid-vivaldi-common.c
+++ b/drivers/hid/hid-vivaldi-common.c
@@ -85,7 +85,7 @@ void vivaldi_feature_mapping(struct hid_device *hdev,
}
ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, report_data,
- report_len, 0);
+ report_len, report_len, 0);
if (ret) {
dev_warn(&hdev->dev, "failed to report feature %d\n",
field->report->id);
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 0d1c6d90fe21..a32320b351e3 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -90,7 +90,7 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
kfree(buf);
continue;
}
- err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, false);
+ err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, size, false);
if (err) {
hid_warn(hdev, "%s: unable to flush event due to error %d\n",
__func__, err);
@@ -334,7 +334,7 @@ static void wacom_feature_mapping(struct hid_device *hdev,
data, n, WAC_CMD_RETRIES);
if (ret == n && features->type == HID_GENERIC) {
ret = hid_report_raw_event(hdev,
- HID_FEATURE_REPORT, data, n, 0);
+ HID_FEATURE_REPORT, data, n, n, 0);
} else if (ret == 2 && features->type != HID_GENERIC) {
features->touch_max = data[1];
} else {
@@ -395,7 +395,7 @@ static void wacom_feature_mapping(struct hid_device *hdev,
data, n, WAC_CMD_RETRIES);
if (ret == n) {
ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT,
- data, n, 0);
+ data, n, n, 0);
} else {
hid_warn(hdev, "%s: could not retrieve sensor offsets\n",
__func__);
diff --git a/drivers/staging/greybus/hid.c b/drivers/staging/greybus/hid.c
index 1f58c907c036..f1f9f6fbc00e 100644
--- a/drivers/staging/greybus/hid.c
+++ b/drivers/staging/greybus/hid.c
@@ -201,7 +201,7 @@ static void gb_hid_init_report(struct gb_hid *ghid, struct hid_report *report)
* we just need to setup the input fields, so using
* hid_report_raw_event is safe.
*/
- hid_report_raw_event(ghid->hid, report->type, ghid->inbuf, size, 1);
+ hid_report_raw_event(ghid->hid, report->type, ghid->inbuf, ghid->bufsize, size, 1);
}
static void gb_hid_init_reports(struct gb_hid *ghid)
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 442a80d79e89..ac432a2ef415 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -1298,8 +1298,8 @@ static inline u32 hid_report_len(struct hid_report *report)
return DIV_ROUND_UP(report->size, 8) + (report->id > 0);
}
-int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
- int interrupt);
+int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data,
+ size_t bufsize, u32 size, int interrupt);
/* HID quirks API */
unsigned long hid_lookup_quirk(const struct hid_device *hdev);
diff --git a/include/linux/hid_bpf.h b/include/linux/hid_bpf.h
index a2e47dbcf82c..19fffa4574a4 100644
--- a/include/linux/hid_bpf.h
+++ b/include/linux/hid_bpf.h
@@ -72,8 +72,8 @@ struct hid_ops {
int (*hid_hw_output_report)(struct hid_device *hdev, __u8 *buf, size_t len,
u64 source, bool from_bpf);
int (*hid_input_report)(struct hid_device *hid, enum hid_report_type type,
- u8 *data, u32 size, int interrupt, u64 source, bool from_bpf,
- bool lock_already_taken);
+ u8 *data, size_t bufsize, u32 size, int interrupt, u64 source,
+ bool from_bpf, bool lock_already_taken);
struct module *owner;
const struct bus_type *bus_type;
};
@@ -200,7 +200,8 @@ struct hid_bpf {
#ifdef CONFIG_HID_BPF
u8 *dispatch_hid_bpf_device_event(struct hid_device *hid, enum hid_report_type type, u8 *data,
- u32 *size, int interrupt, u64 source, bool from_bpf);
+ size_t *buf_size, u32 *size, int interrupt, u64 source,
+ bool from_bpf);
int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
unsigned char reportnum, __u8 *buf,
u32 size, enum hid_report_type rtype,
@@ -215,8 +216,11 @@ int hid_bpf_device_init(struct hid_device *hid);
const u8 *call_hid_bpf_rdesc_fixup(struct hid_device *hdev, const u8 *rdesc, unsigned int *size);
#else /* CONFIG_HID_BPF */
static inline u8 *dispatch_hid_bpf_device_event(struct hid_device *hid, enum hid_report_type type,
- u8 *data, u32 *size, int interrupt,
- u64 source, bool from_bpf) { return data; }
+ u8 *data, size_t *buf_size, u32 *size,
+ int interrupt, u64 source, bool from_bpf)
+{
+ return data;
+}
static inline int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
unsigned char reportnum, u8 *buf,
u32 size, enum hid_report_type rtype,
--
2.54.0
^ permalink raw reply related
* [PATCH v3 2/4] HID: core: introduce hid_safe_input_report()
From: Benjamin Tissoires @ 2026-05-04 8:47 UTC (permalink / raw)
To: Jiri Kosina, Filipe Laíns, Bastien Nocera, Ping Cheng,
Jason Gerecke, Viresh Kumar, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Lee Jones
Cc: Icenowy Zheng, linux-input, linux-kernel, greybus-dev,
linux-staging, linux-usb, Benjamin Tissoires, stable
In-Reply-To: <20260504-wip-fix-core-v3-0-ce1f11f4968f@kernel.org>
hid_input_report() is used in too many places to have a commit that
doesn't cross subsystem borders. Instead of changing the API, introduce
a new one when things matters in the transport layers:
- usbhid
- i2chid
This effectively revert to the old behavior for those two transport
layers.
Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
drivers/hid/hid-core.c | 25 +++++++++++++++++++++++++
drivers/hid/i2c-hid/i2c-hid-core.c | 7 ++++---
drivers/hid/usbhid/hid-core.c | 11 ++++++-----
include/linux/hid.h | 2 ++
4 files changed, 37 insertions(+), 8 deletions(-)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index a806820df7e5..b3596851c719 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2181,6 +2181,7 @@ static int __hid_input_report(struct hid_device *hid, enum hid_report_type type,
* @interrupt: distinguish between interrupt and control transfers
*
* This is data entry for lower layers.
+ * Legacy, please use hid_safe_input_report() instead.
*/
int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
int interrupt)
@@ -2191,6 +2192,30 @@ int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data
}
EXPORT_SYMBOL_GPL(hid_input_report);
+/**
+ * hid_safe_input_report - report data from lower layer (usb, bt...)
+ *
+ * @hid: hid device
+ * @type: HID report type (HID_*_REPORT)
+ * @data: report contents
+ * @bufsize: allocated size of the data buffer
+ * @size: useful size of data parameter
+ * @interrupt: distinguish between interrupt and control transfers
+ *
+ * This is data entry for lower layers.
+ * Please use this function instead of the non safe version because we provide
+ * here the size of the buffer, allowing hid-core to make smarter decisions
+ * regarding the incoming buffer.
+ */
+int hid_safe_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data,
+ size_t bufsize, u32 size, int interrupt)
+{
+ return __hid_input_report(hid, type, data, bufsize, size, interrupt, 0,
+ false, /* from_bpf */
+ false /* lock_already_taken */);
+}
+EXPORT_SYMBOL_GPL(hid_safe_input_report);
+
bool hid_match_one_id(const struct hid_device *hdev,
const struct hid_device_id *id)
{
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 5a183af3d5c6..e0a302544cef 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -574,9 +574,10 @@ static void i2c_hid_get_input(struct i2c_hid *ihid)
if (ihid->hid->group != HID_GROUP_RMI)
pm_wakeup_event(&ihid->client->dev, 0);
- hid_input_report(ihid->hid, HID_INPUT_REPORT,
- ihid->inbuf + sizeof(__le16),
- ret_size - sizeof(__le16), 1);
+ hid_safe_input_report(ihid->hid, HID_INPUT_REPORT,
+ ihid->inbuf + sizeof(__le16),
+ ihid->bufsize - sizeof(__le16),
+ ret_size - sizeof(__le16), 1);
}
return;
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index fbbfc0f60829..5af93b9b1fb5 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -283,9 +283,9 @@ static void hid_irq_in(struct urb *urb)
break;
usbhid_mark_busy(usbhid);
if (!test_bit(HID_RESUME_RUNNING, &usbhid->iofl)) {
- hid_input_report(urb->context, HID_INPUT_REPORT,
- urb->transfer_buffer,
- urb->actual_length, 1);
+ hid_safe_input_report(urb->context, HID_INPUT_REPORT,
+ urb->transfer_buffer, urb->transfer_buffer_length,
+ urb->actual_length, 1);
/*
* autosuspend refused while keys are pressed
* because most keyboards don't wake up when
@@ -482,9 +482,10 @@ static void hid_ctrl(struct urb *urb)
switch (status) {
case 0: /* success */
if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_IN)
- hid_input_report(urb->context,
+ hid_safe_input_report(urb->context,
usbhid->ctrl[usbhid->ctrltail].report->type,
- urb->transfer_buffer, urb->actual_length, 0);
+ urb->transfer_buffer, urb->transfer_buffer_length,
+ urb->actual_length, 0);
break;
case -ESHUTDOWN: /* unplug */
unplug = 1;
diff --git a/include/linux/hid.h b/include/linux/hid.h
index ac432a2ef415..bfb9859f391e 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -1030,6 +1030,8 @@ struct hid_field *hid_find_field(struct hid_device *hdev, unsigned int report_ty
int hid_set_field(struct hid_field *, unsigned, __s32);
int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
int interrupt);
+int hid_safe_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data,
+ size_t bufsize, u32 size, int interrupt);
struct hid_field *hidinput_get_led_field(struct hid_device *hid);
unsigned int hidinput_count_leds(struct hid_device *hid);
__s32 hidinput_calc_abs_res(const struct hid_field *field, __u16 code);
--
2.54.0
^ permalink raw reply related
* [PATCH v3 3/4] HID: multitouch: use __free(kfree) to clean up temporary buffers
From: Benjamin Tissoires @ 2026-05-04 8:47 UTC (permalink / raw)
To: Jiri Kosina, Filipe Laíns, Bastien Nocera, Ping Cheng,
Jason Gerecke, Viresh Kumar, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Lee Jones
Cc: Icenowy Zheng, linux-input, linux-kernel, greybus-dev,
linux-staging, linux-usb, Benjamin Tissoires
In-Reply-To: <20260504-wip-fix-core-v3-0-ce1f11f4968f@kernel.org>
This simplifies error handling and protects against memory leaks.
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
drivers/hid/hid-multitouch.c | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index eeab0b6e32cc..b19463e545d6 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -507,7 +507,6 @@ static void mt_get_feature(struct hid_device *hdev, struct hid_report *report)
{
int ret;
u32 size = hid_report_len(report);
- u8 *buf;
/*
* Do not fetch the feature report if the device has been explicitly
@@ -516,7 +515,7 @@ static void mt_get_feature(struct hid_device *hdev, struct hid_report *report)
if (hdev->quirks & HID_QUIRK_NO_INIT_REPORTS)
return;
- buf = hid_alloc_report_buf(report, GFP_KERNEL);
+ u8 *buf __free(kfree) = hid_alloc_report_buf(report, GFP_KERNEL);
if (!buf)
return;
@@ -529,7 +528,7 @@ static void mt_get_feature(struct hid_device *hdev, struct hid_report *report)
/* The report ID in the request and the response should match */
if (report->id != buf[0]) {
hid_err(hdev, "Returned feature report did not match the request\n");
- goto free;
+ return;
}
ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf,
@@ -537,9 +536,6 @@ static void mt_get_feature(struct hid_device *hdev, struct hid_report *report)
if (ret)
dev_warn(&hdev->dev, "failed to report feature\n");
}
-
-free:
- kfree(buf);
}
static void mt_feature_mapping(struct hid_device *hdev,
@@ -1658,7 +1654,6 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev,
struct mt_class *cls = &td->mtclass;
struct hid_report *report = field->report;
unsigned int index = usage->usage_index;
- char *buf;
u32 report_len;
int max;
@@ -1673,17 +1668,18 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev,
return false;
if (cls->quirks & MT_QUIRK_FORCE_GET_FEATURE) {
- report_len = hid_report_len(report);
- buf = hid_alloc_report_buf(report, GFP_KERNEL);
+ char *buf __free(kfree) = hid_alloc_report_buf(report, GFP_KERNEL);
+
if (!buf) {
hid_err(hdev,
"failed to allocate buffer for report\n");
return false;
}
+
+ report_len = hid_report_len(report);
hid_hw_raw_request(hdev, report->id, buf, report_len,
HID_FEATURE_REPORT,
HID_REQ_GET_REPORT);
- kfree(buf);
}
field->value[index] = td->inputmode_value;
--
2.54.0
^ permalink raw reply related
* [PATCH v3 4/4] HID: wacom: use __free(kfree) to clean up temporary buffers
From: Benjamin Tissoires @ 2026-05-04 8:47 UTC (permalink / raw)
To: Jiri Kosina, Filipe Laíns, Bastien Nocera, Ping Cheng,
Jason Gerecke, Viresh Kumar, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Lee Jones
Cc: Icenowy Zheng, linux-input, linux-kernel, greybus-dev,
linux-staging, linux-usb, Benjamin Tissoires
In-Reply-To: <20260504-wip-fix-core-v3-0-ce1f11f4968f@kernel.org>
This simplifies error handling and protects against memory leaks.
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
drivers/hid/hid-core.c | 4 ++--
drivers/hid/wacom_sys.c | 40 +++++++++++++---------------------------
2 files changed, 15 insertions(+), 29 deletions(-)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index b3596851c719..7fc20e0405ad 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2050,8 +2050,8 @@ int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *
return 0;
if (unlikely(bsize < csize)) {
- hid_warn_ratelimited(hid, "Event data for report %d is incorrect (%d vs %ld)\n",
- report->id, csize, bsize);
+ hid_warn_ratelimited(hid, "Event data for report %d is incorrect (%d vs %d)\n",
+ report->id, csize, (unsigned int)bsize);
return -EINVAL;
}
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index a32320b351e3..adb31f54e524 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -70,11 +70,10 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
{
while (!kfifo_is_empty(fifo)) {
int size = kfifo_peek_len(fifo);
- u8 *buf;
unsigned int count;
int err;
- buf = kzalloc(size, GFP_KERNEL);
+ u8 *buf __free(kfree) = kzalloc(size, GFP_KERNEL);
if (!buf) {
kfifo_skip(fifo);
continue;
@@ -87,7 +86,6 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
// to flush seems reasonable enough, however.
hid_warn(hdev, "%s: removed fifo entry with unexpected size\n",
__func__);
- kfree(buf);
continue;
}
err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, size, false);
@@ -95,8 +93,6 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
hid_warn(hdev, "%s: unable to flush event due to error %d\n",
__func__, err);
}
-
- kfree(buf);
}
}
@@ -311,7 +307,6 @@ static void wacom_feature_mapping(struct hid_device *hdev,
struct wacom_features *features = &wacom->wacom_wac.features;
struct hid_data *hid_data = &wacom->wacom_wac.hid_data;
unsigned int equivalent_usage = wacom_equivalent_usage(usage->hid);
- u8 *data;
int ret;
u32 n;
@@ -325,10 +320,11 @@ static void wacom_feature_mapping(struct hid_device *hdev,
/* leave touch_max as is if predefined */
if (!features->touch_max) {
/* read manually */
- n = hid_report_len(field->report);
- data = hid_alloc_report_buf(field->report, GFP_KERNEL);
+ u8 *data __free(kfree) = hid_alloc_report_buf(field->report, GFP_KERNEL);
+
if (!data)
break;
+ n = hid_report_len(field->report);
data[0] = field->report->id;
ret = wacom_get_report(hdev, HID_FEATURE_REPORT,
data, n, WAC_CMD_RETRIES);
@@ -344,7 +340,6 @@ static void wacom_feature_mapping(struct hid_device *hdev,
"defaulting to %d\n",
features->touch_max);
}
- kfree(data);
}
break;
case HID_DG_INPUTMODE:
@@ -386,10 +381,11 @@ static void wacom_feature_mapping(struct hid_device *hdev,
case WACOM_HID_WD_OFFSETRIGHT:
case WACOM_HID_WD_OFFSETBOTTOM:
/* read manually */
- n = hid_report_len(field->report);
- data = hid_alloc_report_buf(field->report, GFP_KERNEL);
+ u8 *data __free(kfree) = hid_alloc_report_buf(field->report, GFP_KERNEL);
+
if (!data)
break;
+ n = hid_report_len(field->report);
data[0] = field->report->id;
ret = wacom_get_report(hdev, HID_FEATURE_REPORT,
data, n, WAC_CMD_RETRIES);
@@ -400,7 +396,6 @@ static void wacom_feature_mapping(struct hid_device *hdev,
hid_warn(hdev, "%s: could not retrieve sensor offsets\n",
__func__);
}
- kfree(data);
break;
}
}
@@ -581,7 +576,6 @@ static int wacom_hid_set_device_mode(struct hid_device *hdev)
static int wacom_set_device_mode(struct hid_device *hdev,
struct wacom_wac *wacom_wac)
{
- u8 *rep_data;
struct hid_report *r;
struct hid_report_enum *re;
u32 length;
@@ -595,7 +589,7 @@ static int wacom_set_device_mode(struct hid_device *hdev,
if (!r)
return -EINVAL;
- rep_data = hid_alloc_report_buf(r, GFP_KERNEL);
+ u8 *rep_data __free(kfree) = hid_alloc_report_buf(r, GFP_KERNEL);
if (!rep_data)
return -ENOMEM;
@@ -614,8 +608,6 @@ static int wacom_set_device_mode(struct hid_device *hdev,
rep_data[1] != wacom_wac->mode_report &&
limit++ < WAC_MSG_RETRIES);
- kfree(rep_data);
-
return error < 0 ? error : 0;
}
@@ -921,7 +913,6 @@ static int wacom_add_shared_data(struct hid_device *hdev)
static int wacom_led_control(struct wacom *wacom)
{
- unsigned char *buf;
int retval;
unsigned char report_id = WAC_CMD_LED_CONTROL;
int buf_size = 9;
@@ -940,7 +931,8 @@ static int wacom_led_control(struct wacom *wacom)
report_id = WAC_CMD_WL_INTUOSP2;
buf_size = 51;
}
- buf = kzalloc(buf_size, GFP_KERNEL);
+
+ unsigned char *buf __free(kfree) = kzalloc(buf_size, GFP_KERNEL);
if (!buf)
return -ENOMEM;
@@ -996,7 +988,6 @@ static int wacom_led_control(struct wacom *wacom)
retval = wacom_set_report(wacom->hdev, HID_FEATURE_REPORT, buf, buf_size,
WAC_CMD_RETRIES);
- kfree(buf);
return retval;
}
@@ -1004,11 +995,10 @@ static int wacom_led_control(struct wacom *wacom)
static int wacom_led_putimage(struct wacom *wacom, int button_id, u8 xfer_id,
const unsigned len, const void *img)
{
- unsigned char *buf;
int i, retval;
const unsigned chunk_len = len / 4; /* 4 chunks are needed to be sent */
- buf = kzalloc(chunk_len + 3 , GFP_KERNEL);
+ unsigned char *buf __free(kfree) = kzalloc(chunk_len + 3, GFP_KERNEL);
if (!buf)
return -ENOMEM;
@@ -1018,7 +1008,7 @@ static int wacom_led_putimage(struct wacom *wacom, int button_id, u8 xfer_id,
retval = wacom_set_report(wacom->hdev, HID_FEATURE_REPORT, buf, 2,
WAC_CMD_RETRIES);
if (retval < 0)
- goto out;
+ return retval;
buf[0] = xfer_id;
buf[1] = button_id & 0x07;
@@ -1038,8 +1028,6 @@ static int wacom_led_putimage(struct wacom *wacom, int button_id, u8 xfer_id,
wacom_set_report(wacom->hdev, HID_FEATURE_REPORT, buf, 2,
WAC_CMD_RETRIES);
-out:
- kfree(buf);
return retval;
}
@@ -1948,10 +1936,9 @@ static int wacom_remote_create_attr_group(struct wacom *wacom, __u32 serial,
static int wacom_cmd_unpair_remote(struct wacom *wacom, unsigned char selector)
{
const size_t buf_size = 2;
- unsigned char *buf;
int retval;
- buf = kzalloc(buf_size, GFP_KERNEL);
+ unsigned char *buf __free(kfree) = kzalloc(buf_size, GFP_KERNEL);
if (!buf)
return -ENOMEM;
@@ -1960,7 +1947,6 @@ static int wacom_cmd_unpair_remote(struct wacom *wacom, unsigned char selector)
retval = wacom_set_report(wacom->hdev, HID_OUTPUT_REPORT, buf,
buf_size, WAC_CMD_RETRIES);
- kfree(buf);
return retval;
}
--
2.54.0
^ permalink raw reply related
* Re: [PATCH v3 1/4] HID: pass the buffer size to hid_report_raw_event
From: Johan Hovold @ 2026-05-04 9:31 UTC (permalink / raw)
To: Benjamin Tissoires
Cc: Jiri Kosina, Filipe Laíns, Bastien Nocera, Ping Cheng,
Jason Gerecke, Viresh Kumar, Alex Elder, Greg Kroah-Hartman,
Lee Jones, Icenowy Zheng, linux-input, linux-kernel, greybus-dev,
linux-staging, linux-usb, stable
In-Reply-To: <20260504-wip-fix-core-v3-1-ce1f11f4968f@kernel.org>
On Mon, May 04, 2026 at 10:47:22AM +0200, Benjamin Tissoires wrote:
> commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
> bogus memset()") enforced the provided data to be at least the size of
> the declared buffer in the report descriptor to prevent a buffer
> overflow. However, we can try to be smarter by providing both the buffer
> size and the data size, meaning that hid_report_raw_event() can make
> better decision whether we should plaining reject the buffer (buffer
> overflow attempt) or if we can safely memset it to 0 and pass it to the
> rest of the stack.
>
> Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
> ---
> drivers/hid/bpf/hid_bpf_dispatch.c | 6 ++++--
> drivers/hid/hid-core.c | 42 +++++++++++++++++++++++++-------------
> drivers/hid/hid-gfrm.c | 4 ++--
> drivers/hid/hid-logitech-hidpp.c | 2 +-
> drivers/hid/hid-multitouch.c | 2 +-
> drivers/hid/hid-primax.c | 2 +-
> drivers/hid/hid-vivaldi-common.c | 2 +-
> drivers/hid/wacom_sys.c | 6 +++---
> drivers/staging/greybus/hid.c | 2 +-
The Greybus change builds fine now:
Acked-by: Johan Hovold <johan@kernel.org>
> include/linux/hid.h | 4 ++--
> include/linux/hid_bpf.h | 14 ++++++++-----
> 11 files changed, 53 insertions(+), 33 deletions(-)
Johan
^ permalink raw reply
* [PATCH] Input: atmel_mxt_ts - Set byte_offset as signed
From: Ricardo Ribalda @ 2026-05-04 10:55 UTC (permalink / raw)
To: Nick Dyer, Dmitry Torokhov
Cc: linux-input, linux-kernel, linux-media, Ricardo Ribalda
The calculations done to obtain byte_offset can result into a negative
number, fix its type.
This patch fixes the following sparse error:
drivers/input/touchscreen/atmel_mxt_ts.c:1481:44: warning: unsigned value that used to be signed checked against zero?
drivers/input/touchscreen/atmel_mxt_ts.c:1479:49: signed value source
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
drivers/input/touchscreen/atmel_mxt_ts.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 87c6a10381f2..26ba82fb60b6 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -1397,7 +1397,8 @@ static int mxt_prepare_cfg_mem(struct mxt_data *data, struct mxt_cfg *cfg)
{
struct device *dev = &data->client->dev;
struct mxt_object *object;
- unsigned int type, instance, size, byte_offset;
+ unsigned int type, instance, size;
+ int byte_offset;
int offset;
int ret;
int i;
---
base-commit: 254f49634ee16a731174d2ae34bc50bd5f45e731
change-id: 20260504-fix-sparse-3bfa6ba62e5b
Best regards,
--
Ricardo Ribalda <ribalda@chromium.org>
^ permalink raw reply related
* Re: [PATCH v3 1/4] HID: pass the buffer size to hid_report_raw_event
From: Greg Kroah-Hartman @ 2026-05-04 12:21 UTC (permalink / raw)
To: Benjamin Tissoires
Cc: Jiri Kosina, Filipe Laíns, Bastien Nocera, Ping Cheng,
Jason Gerecke, Viresh Kumar, Johan Hovold, Alex Elder, Lee Jones,
Icenowy Zheng, linux-input, linux-kernel, greybus-dev,
linux-staging, linux-usb, stable
In-Reply-To: <20260504-wip-fix-core-v3-1-ce1f11f4968f@kernel.org>
On Mon, May 04, 2026 at 10:47:22AM +0200, Benjamin Tissoires wrote:
> commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
> bogus memset()") enforced the provided data to be at least the size of
> the declared buffer in the report descriptor to prevent a buffer
> overflow. However, we can try to be smarter by providing both the buffer
> size and the data size, meaning that hid_report_raw_event() can make
> better decision whether we should plaining reject the buffer (buffer
> overflow attempt) or if we can safely memset it to 0 and pass it to the
> rest of the stack.
>
> Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
^ permalink raw reply
* Re: [PATCH] Input: atmel_mxt_ts - Set byte_offset as signed
From: Dmitry Torokhov @ 2026-05-04 17:00 UTC (permalink / raw)
To: Ricardo Ribalda; +Cc: Nick Dyer, linux-input, linux-kernel, linux-media
In-Reply-To: <20260504-fix-sparse-v1-1-1071137cd280@chromium.org>
On Mon, May 04, 2026 at 10:55:03AM +0000, Ricardo Ribalda wrote:
> The calculations done to obtain byte_offset can result into a negative
> number, fix its type.
>
> This patch fixes the following sparse error:
>
> drivers/input/touchscreen/atmel_mxt_ts.c:1481:44: warning: unsigned value that used to be signed checked against zero?
> drivers/input/touchscreen/atmel_mxt_ts.c:1479:49: signed value source
>
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Applied, thank you.
--
Dmitry
^ permalink raw reply
* [PATCH 1/3] Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
From: Dmitry Torokhov @ 2026-05-04 18:54 UTC (permalink / raw)
To: Nick Dyer, linux-input; +Cc: Ricardo Ribalda, linux-kernel, stable
When a configuration file provides an object size that is larger than the
driver's known mxt_obj_size(object), the driver intends to discard the
extra bytes.
The loop iterates using for (i = 0; i < size; i++). Inside the loop, the
condition to skip processing extra bytes is:
if (i > mxt_obj_size(object))
continue;
Since i is a 0-based index, the valid indices for the object are 0 through
mxt_obj_size(object) - 1.
When i == mxt_obj_size(object), the condition evaluates to false, and the
code processes the byte instead of discarding it.
This causes the code to calculate byte_offset = reg + i - cfg->start_ofs
and writes the byte there, overwriting exactly one byte of the adjacent
instance or object.
Update the boundary check to skip extra bytes correctly by using >=.
Fixes: 50a77c658b80 ("Input: atmel_mxt_ts - download device config using firmware loader")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/input/touchscreen/atmel_mxt_ts.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index d62bf2c95578..28b2bd889c70 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -1503,7 +1503,7 @@ static int mxt_prepare_cfg_mem(struct mxt_data *data, struct mxt_cfg *cfg)
}
cfg->raw_pos += offset;
- if (i > mxt_obj_size(object))
+ if (i >= mxt_obj_size(object))
continue;
byte_offset = reg + i - cfg->start_ofs;
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH 2/3] Input: atmel_mxt_ts - check mem_size before calculating config memory size
From: Dmitry Torokhov @ 2026-05-04 18:54 UTC (permalink / raw)
To: Nick Dyer, linux-input; +Cc: Ricardo Ribalda, linux-kernel
In-Reply-To: <20260504185448.4055973-1-dmitry.torokhov@gmail.com>
In mxt_update_cfg(), the driver calculates the memory size needed to store
the configuration as data->mem_size - cfg.start_ofs. If data->mem_size is
less than or equal to cfg.start_ofs, this calculation will underflow or
result in a zero-size buffer, neither of which is valid for a configuration
update.
Add a check to return -EINVAL if data->mem_size is too small. While at it,
change the types of start_ofs and mem_size in struct mxt_cfg to u16 to
match the device address space.
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/input/touchscreen/atmel_mxt_ts.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 28b2bd889c70..d660cc5b5fe3 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -275,8 +275,8 @@ struct mxt_cfg {
off_t raw_pos;
u8 *mem;
- size_t mem_size;
- int start_ofs;
+ u16 mem_size;
+ u16 start_ofs;
struct mxt_info info;
};
@@ -1657,6 +1657,13 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *fw)
cfg.start_ofs = MXT_OBJECT_START +
data->info->object_num * sizeof(struct mxt_object) +
MXT_INFO_CHECKSUM_SIZE;
+
+ if (data->mem_size < cfg.start_ofs) {
+ dev_err(dev, "Memory size too small: %u < %u\n",
+ data->mem_size, cfg.start_ofs);
+ return -EINVAL;
+ }
+
cfg.mem_size = data->mem_size - cfg.start_ofs;
u8 *mem_buf __free(kfree) = cfg.mem = kzalloc(cfg.mem_size, GFP_KERNEL);
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH 3/3] Input: atmel_mxt_ts - use __free() for obuf in mxt_object_show
From: Dmitry Torokhov @ 2026-05-04 18:54 UTC (permalink / raw)
To: Nick Dyer, linux-input; +Cc: Ricardo Ribalda, linux-kernel
In-Reply-To: <20260504185448.4055973-1-dmitry.torokhov@gmail.com>
Use the __free(kfree) macro for the obuf allocation in mxt_object_show()
to simplify the code.
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/input/touchscreen/atmel_mxt_ts.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index d660cc5b5fe3..6af4db5ed117 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -2870,14 +2870,12 @@ static ssize_t mxt_object_show(struct device *dev,
int count = 0;
int i, j;
int error;
- u8 *obuf;
/* Pre-allocate buffer large enough to hold max sized object. */
- obuf = kmalloc(256, GFP_KERNEL);
+ u8 *obuf __free(kfree) = kmalloc(256, GFP_KERNEL);
if (!obuf)
return -ENOMEM;
- error = 0;
for (i = 0; i < data->info->object_num; i++) {
object = data->object_table + i;
@@ -2892,15 +2890,13 @@ static ssize_t mxt_object_show(struct device *dev,
error = __mxt_read_reg(data->client, addr, size, obuf);
if (error)
- goto done;
+ return error;
count = mxt_show_instance(buf, count, object, j, obuf);
}
}
-done:
- kfree(obuf);
- return error ?: count;
+ return count;
}
static int mxt_check_firmware_format(struct device *dev,
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* Re: [PATCH 6/6] leds: led-class: mark classdev as unregistering early
From: kernel test robot @ 2026-05-04 21:49 UTC (permalink / raw)
To: James Ye, jikos, bentiss, lee, pavel
Cc: llvm, oe-kbuild-all, linux-input, linux-leds, linux-kernel,
denis.benato, James Ye
In-Reply-To: <20260503072643.2774762-7-jye836@gmail.com>
Hi James,
kernel test robot noticed the following build errors:
[auto build test ERROR on hid/for-next]
[also build test ERROR on lee-leds/for-leds-next linus/master v6.16-rc1 next-20260430]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/James-Ye/HID-input-delete-hid_battery-on-disconnect/20260504-013406
base: https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git for-next
patch link: https://lore.kernel.org/r/20260503072643.2774762-7-jye836%40gmail.com
patch subject: [PATCH 6/6] leds: led-class: mark classdev as unregistering early
config: x86_64-kexec (https://download.01.org/0day-ci/archive/20260504/202605042355.hVEd8jjX-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260504/202605042355.hVEd8jjX-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202605042355.hVEd8jjX-lkp@intel.com/
All errors (new ones prefixed by >>):
>> drivers/hid/hid-input.c:2423:48: error: no member named 'batteries' in 'struct hid_device'
2423 | list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
| ~~~ ^
include/linux/list.h:869:30: note: expanded from macro 'list_for_each_entry_safe'
869 | for (pos = list_first_entry(head, typeof(*pos), member), \
| ^~~~
include/linux/list.h:620:14: note: expanded from macro 'list_first_entry'
620 | list_entry((ptr)->next, type, member)
| ^~~
include/linux/list.h:609:15: note: expanded from macro 'list_entry'
609 | container_of(ptr, type, member)
| ^~~
include/linux/container_of.h:20:26: note: expanded from macro 'container_of'
20 | void *__mptr = (void *)(ptr); \
| ^~~
>> drivers/hid/hid-input.c:2423:48: error: no member named 'batteries' in 'struct hid_device'
2423 | list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
| ~~~ ^
include/linux/list.h:869:30: note: expanded from macro 'list_for_each_entry_safe'
869 | for (pos = list_first_entry(head, typeof(*pos), member), \
| ^~~~
include/linux/list.h:620:14: note: expanded from macro 'list_first_entry'
620 | list_entry((ptr)->next, type, member)
| ^~~
include/linux/list.h:609:15: note: expanded from macro 'list_entry'
609 | container_of(ptr, type, member)
| ^~~
note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
include/linux/compiler_types.h:610:63: note: expanded from macro '__same_type'
610 | #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
| ^
include/linux/build_bug.h:79:50: note: expanded from macro 'static_assert'
79 | #define static_assert(expr, ...) __static_assert(expr, ##__VA_ARGS__, #expr)
| ^~~~
include/linux/build_bug.h:80:56: note: expanded from macro '__static_assert'
80 | #define __static_assert(expr, msg, ...) _Static_assert(expr, msg)
| ^~~~
>> drivers/hid/hid-input.c:2423:48: error: no member named 'batteries' in 'struct hid_device'
2423 | list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
| ~~~ ^
include/linux/list.h:869:30: note: expanded from macro 'list_for_each_entry_safe'
869 | for (pos = list_first_entry(head, typeof(*pos), member), \
| ^~~~
include/linux/list.h:620:14: note: expanded from macro 'list_first_entry'
620 | list_entry((ptr)->next, type, member)
| ^~~
include/linux/list.h:609:15: note: expanded from macro 'list_entry'
609 | container_of(ptr, type, member)
| ^~~
note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
include/linux/compiler_types.h:610:63: note: expanded from macro '__same_type'
610 | #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
| ^
include/linux/build_bug.h:79:50: note: expanded from macro 'static_assert'
79 | #define static_assert(expr, ...) __static_assert(expr, ##__VA_ARGS__, #expr)
| ^~~~
include/linux/build_bug.h:80:56: note: expanded from macro '__static_assert'
80 | #define __static_assert(expr, msg, ...) _Static_assert(expr, msg)
| ^~~~
>> drivers/hid/hid-input.c:2423:48: error: no member named 'batteries' in 'struct hid_device'
2423 | list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
| ~~~ ^
include/linux/list.h:871:32: note: expanded from macro 'list_for_each_entry_safe'
871 | !list_entry_is_head(pos, head, member); \
| ^~~~
include/linux/list.h:773:30: note: expanded from macro 'list_entry_is_head'
773 | list_is_head(&pos->member, (head))
| ^~~~
4 errors generated.
vim +2423 drivers/hid/hid-input.c
2407
2408 void hidinput_disconnect(struct hid_device *hid)
2409 {
2410 struct hid_input *hidinput, *next;
2411 struct hid_battery *bat, *bat_next;
2412
2413 list_for_each_entry_safe(hidinput, next, &hid->inputs, list) {
2414 list_del(&hidinput->list);
2415 if (hidinput->registered)
2416 input_unregister_device(hidinput->input);
2417 else
2418 input_free_device(hidinput->input);
2419 kfree(hidinput->name);
2420 kfree(hidinput);
2421 }
2422
> 2423 list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
2424 list_del(&bat->list);
2425 }
2426
2427 /* led_work is spawned by input_dev callbacks, but doesn't access the
2428 * parent input_dev at all. Once all input devices are removed, we
2429 * know that led_work will never get restarted, so we can cancel it
2430 * synchronously and are safe. */
2431 cancel_work_sync(&hid->led_work);
2432 }
2433 EXPORT_SYMBOL_GPL(hidinput_disconnect);
2434
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH 2/3] Input: atmel_mxt_ts - check mem_size before calculating config memory size
From: Dmitry Torokhov @ 2026-05-04 22:59 UTC (permalink / raw)
To: Nick Dyer, linux-input; +Cc: Ricardo Ribalda, linux-kernel
In-Reply-To: <20260504185448.4055973-2-dmitry.torokhov@gmail.com>
On Mon, May 04, 2026 at 11:54:46AM -0700, Dmitry Torokhov wrote:
> In mxt_update_cfg(), the driver calculates the memory size needed to store
> the configuration as data->mem_size - cfg.start_ofs. If data->mem_size is
> less than or equal to cfg.start_ofs, this calculation will underflow or
> result in a zero-size buffer, neither of which is valid for a configuration
> update.
>
> Add a check to return -EINVAL if data->mem_size is too small. While at it,
> change the types of start_ofs and mem_size in struct mxt_cfg to u16 to
> match the device address space.
>
> Assisted-by: Gemini:gemini-3.1-pro
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> ---
> drivers/input/touchscreen/atmel_mxt_ts.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
> index 28b2bd889c70..d660cc5b5fe3 100644
> --- a/drivers/input/touchscreen/atmel_mxt_ts.c
> +++ b/drivers/input/touchscreen/atmel_mxt_ts.c
> @@ -275,8 +275,8 @@ struct mxt_cfg {
> off_t raw_pos;
>
> u8 *mem;
> - size_t mem_size;
> - int start_ofs;
> + u16 mem_size;
> + u16 start_ofs;
>
> struct mxt_info info;
> };
> @@ -1657,6 +1657,13 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *fw)
> cfg.start_ofs = MXT_OBJECT_START +
> data->info->object_num * sizeof(struct mxt_object) +
> MXT_INFO_CHECKSUM_SIZE;
> +
> + if (data->mem_size < cfg.start_ofs) {
This is supposed to be "<=", like the commit message says.
> + dev_err(dev, "Memory size too small: %u < %u\n",
> + data->mem_size, cfg.start_ofs);
> + return -EINVAL;
> + }
> +
> cfg.mem_size = data->mem_size - cfg.start_ofs;
>
> u8 *mem_buf __free(kfree) = cfg.mem = kzalloc(cfg.mem_size, GFP_KERNEL);
--
Dmitry
^ permalink raw reply
* Re: [PATCH v3 4/4] HID: wacom: use __free(kfree) to clean up temporary buffers
From: Dmitry Torokhov @ 2026-05-04 23:15 UTC (permalink / raw)
To: Benjamin Tissoires
Cc: Jiri Kosina, Filipe Laíns, Bastien Nocera, Ping Cheng,
Jason Gerecke, Viresh Kumar, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Lee Jones, Icenowy Zheng, linux-input,
linux-kernel, greybus-dev, linux-staging, linux-usb
In-Reply-To: <20260504-wip-fix-core-v3-4-ce1f11f4968f@kernel.org>
Hi Benjamin,
On Mon, May 04, 2026 at 10:47:25AM +0200, Benjamin Tissoires wrote:
> @@ -386,10 +381,11 @@ static void wacom_feature_mapping(struct hid_device *hdev,
> case WACOM_HID_WD_OFFSETRIGHT:
> case WACOM_HID_WD_OFFSETBOTTOM:
> /* read manually */
> - n = hid_report_len(field->report);
> - data = hid_alloc_report_buf(field->report, GFP_KERNEL);
> + u8 *data __free(kfree) = hid_alloc_report_buf(field->report, GFP_KERNEL);
> +
> if (!data)
> break;
> + n = hid_report_len(field->report);
> data[0] = field->report->id;
> ret = wacom_get_report(hdev, HID_FEATURE_REPORT,
> data, n, WAC_CMD_RETRIES);
> @@ -400,7 +396,6 @@ static void wacom_feature_mapping(struct hid_device *hdev,
> hid_warn(hdev, "%s: could not retrieve sensor offsets\n",
> __func__);
> }
> - kfree(data);
> break;
> }
I'd recommend establishing a new scope for the "data", otherwise it is
fragile. If there was another label below then this cleanup would
explode since current scope of "data" is from the declaration point
until the end of the switch statement.
Having a dedicated scope makes lifertime explicit.
Thanks.
--
Dmitry
^ permalink raw reply
* Re: [PATCH] Input: touchscreen: tsc2007: Reduce I2C transactions for Z2 read
From: Dmitry Torokhov @ 2026-05-05 0:29 UTC (permalink / raw)
To: Andreas Kemnade; +Cc: Yuki Horii, clamor95, johannes.kirchmair, linux-input
In-Reply-To: <20260502125313.3e1c296a@kemnade.info>
On Sat, May 02, 2026 at 12:53:13PM +0200, Andreas Kemnade wrote:
> Hi,
>
> On Sun, 19 Apr 2026 17:18:23 -0700
> Dmitry Torokhov <dmitry.torokhov@gmail.com> wrote:
>
> > Hi Yuki,
> >
> > On Fri, Apr 10, 2026 at 04:41:00PM +0900, Yuki Horii wrote:
> > > From: Yuki Horii <yuuki198708@gmail.com>
> > >
> > > The current implementation sends a separate power-down command
> > > after reading the Z2 value, resulting in an extra I2C
> > > transaction per measurement cycle.
> > >
> > > The TSC2007 command byte contains a 2-bit power-down mode
> > > selection field. By selecting the power-down state in the Z2
> > > measurement command, the device powers down after the Z2 A/D
> > > conversion completes, eliminating the subsequent power-down
> > > transaction.
> > >
> > > This reduces the number of I2C transactions by one per touch
> > > measurement cycle, decreasing I2C bus overhead and improving
> > > touch sampling performance.
> > >
> > > Signed-off-by: Yuki Horii <yuuki198708@gmail.com>
> > > ---
> > > drivers/input/touchscreen/tsc2007_core.c | 6 ++----
> > > 1 file changed, 2 insertions(+), 4 deletions(-)
> > >
> > > diff --git a/drivers/input/touchscreen/tsc2007_core.c b/drivers/input/touchscreen/tsc2007_core.c
> > > index 948935de894b..ff60245baa96 100644
> > > --- a/drivers/input/touchscreen/tsc2007_core.c
> > > +++ b/drivers/input/touchscreen/tsc2007_core.c
> > > @@ -61,10 +61,8 @@ static void tsc2007_read_values(struct tsc2007 *tsc, struct ts_event *tc)
> > >
> > > /* turn y+ off, x- on; we'll use formula #1 */
> > > tc->z1 = tsc2007_xfer(tsc, READ_Z1);
> > > - tc->z2 = tsc2007_xfer(tsc, READ_Z2);
> > > -
> > > - /* Prepare for next touch reading - power down ADC, enable PENIRQ */
> > > - tsc2007_xfer(tsc, PWRDOWN);
> > > + /* Read Z2 and power down ADC after A/D conversion, enable PENIRQ */
> > > + tc->z2 = tsc2007_xfer(tsc, (TSC2007_POWER_OFF_IRQ_EN | TSC2007_MEASURE_Z2));
> > > }
> > >
> > > u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc)
> >
> > Thank you for the patch.
> >
> > I'd like people using this part to chime in (CCed).
> >
> This looks like that there might be some reason behind it. But I cannot find any.
> Either by reading the datasheet nor by testing.
>
> I have checked the interrupt counter. Output seems still be same.
> Interrupts appear when finger is moving.
>
> So
> Tested-by: Andreas Kemnade <andreas@kemnade.info> # GTA04
Thank you for giving it a spin Andreas.
Applied, thank you Yuki.
--
Dmitry
^ permalink raw reply
* Re: [PATCH 6/6] leds: led-class: mark classdev as unregistering early
From: kernel test robot @ 2026-05-05 2:24 UTC (permalink / raw)
To: James Ye, jikos, bentiss, lee, pavel
Cc: oe-kbuild-all, linux-input, linux-leds, linux-kernel,
denis.benato, James Ye
In-Reply-To: <20260503072643.2774762-7-jye836@gmail.com>
Hi James,
kernel test robot noticed the following build errors:
[auto build test ERROR on hid/for-next]
[also build test ERROR on lee-leds/for-leds-next linus/master v7.1-rc2 next-20260504]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/James-Ye/HID-input-delete-hid_battery-on-disconnect/20260504-013406
base: https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git for-next
patch link: https://lore.kernel.org/r/20260503072643.2774762-7-jye836%40gmail.com
patch subject: [PATCH 6/6] leds: led-class: mark classdev as unregistering early
config: x86_64-randconfig-2005-20250721 (https://download.01.org/0day-ci/archive/20260505/202605050414.YJmW3t4y-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260505/202605050414.YJmW3t4y-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202605050414.YJmW3t4y-lkp@intel.com/
All errors (new ones prefixed by >>):
In file included from include/linux/list.h:5,
from include/linux/module.h:12,
from drivers/hid/hid-input.c:16:
drivers/hid/hid-input.c: In function 'hidinput_disconnect':
>> drivers/hid/hid-input.c:2423:53: error: 'struct hid_device' has no member named 'batteries'
2423 | list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
| ^~
include/linux/container_of.h:20:33: note: in definition of macro 'container_of'
20 | void *__mptr = (void *)(ptr); \
| ^~~
include/linux/list.h:620:9: note: in expansion of macro 'list_entry'
620 | list_entry((ptr)->next, type, member)
| ^~~~~~~~~~
include/linux/list.h:869:20: note: in expansion of macro 'list_first_entry'
869 | for (pos = list_first_entry(head, typeof(*pos), member), \
| ^~~~~~~~~~~~~~~~
drivers/hid/hid-input.c:2423:9: note: in expansion of macro 'list_for_each_entry_safe'
2423 | list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
| ^~~~~~~~~~~~~~~~~~~~~~~~
In file included from include/linux/container_of.h:5:
>> drivers/hid/hid-input.c:2423:53: error: 'struct hid_device' has no member named 'batteries'
2423 | list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
| ^~
include/linux/build_bug.h:80:56: note: in definition of macro '__static_assert'
80 | #define __static_assert(expr, msg, ...) _Static_assert(expr, msg)
| ^~~~
include/linux/container_of.h:21:9: note: in expansion of macro 'static_assert'
21 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \
| ^~~~~~~~~~~~~
include/linux/container_of.h:21:23: note: in expansion of macro '__same_type'
21 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \
| ^~~~~~~~~~~
include/linux/list.h:609:9: note: in expansion of macro 'container_of'
609 | container_of(ptr, type, member)
| ^~~~~~~~~~~~
include/linux/list.h:620:9: note: in expansion of macro 'list_entry'
620 | list_entry((ptr)->next, type, member)
| ^~~~~~~~~~
include/linux/list.h:869:20: note: in expansion of macro 'list_first_entry'
869 | for (pos = list_first_entry(head, typeof(*pos), member), \
| ^~~~~~~~~~~~~~~~
drivers/hid/hid-input.c:2423:9: note: in expansion of macro 'list_for_each_entry_safe'
2423 | list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
| ^~~~~~~~~~~~~~~~~~~~~~~~
>> drivers/hid/hid-input.c:2423:53: error: 'struct hid_device' has no member named 'batteries'
2423 | list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
| ^~
include/linux/build_bug.h:80:56: note: in definition of macro '__static_assert'
80 | #define __static_assert(expr, msg, ...) _Static_assert(expr, msg)
| ^~~~
include/linux/container_of.h:21:9: note: in expansion of macro 'static_assert'
21 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \
| ^~~~~~~~~~~~~
include/linux/container_of.h:22:23: note: in expansion of macro '__same_type'
22 | __same_type(*(ptr), void), \
| ^~~~~~~~~~~
include/linux/list.h:609:9: note: in expansion of macro 'container_of'
609 | container_of(ptr, type, member)
| ^~~~~~~~~~~~
include/linux/list.h:620:9: note: in expansion of macro 'list_entry'
620 | list_entry((ptr)->next, type, member)
| ^~~~~~~~~~
include/linux/list.h:869:20: note: in expansion of macro 'list_first_entry'
869 | for (pos = list_first_entry(head, typeof(*pos), member), \
| ^~~~~~~~~~~~~~~~
drivers/hid/hid-input.c:2423:9: note: in expansion of macro 'list_for_each_entry_safe'
2423 | list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
| ^~~~~~~~~~~~~~~~~~~~~~~~
include/linux/compiler_types.h:610:27: error: expression in static assertion is not an integer
610 | #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:80:56: note: in definition of macro '__static_assert'
80 | #define __static_assert(expr, msg, ...) _Static_assert(expr, msg)
| ^~~~
include/linux/container_of.h:21:9: note: in expansion of macro 'static_assert'
21 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \
| ^~~~~~~~~~~~~
include/linux/container_of.h:21:23: note: in expansion of macro '__same_type'
21 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \
| ^~~~~~~~~~~
include/linux/list.h:609:9: note: in expansion of macro 'container_of'
609 | container_of(ptr, type, member)
| ^~~~~~~~~~~~
include/linux/list.h:620:9: note: in expansion of macro 'list_entry'
620 | list_entry((ptr)->next, type, member)
| ^~~~~~~~~~
include/linux/list.h:869:20: note: in expansion of macro 'list_first_entry'
869 | for (pos = list_first_entry(head, typeof(*pos), member), \
| ^~~~~~~~~~~~~~~~
drivers/hid/hid-input.c:2423:9: note: in expansion of macro 'list_for_each_entry_safe'
2423 | list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
| ^~~~~~~~~~~~~~~~~~~~~~~~
>> drivers/hid/hid-input.c:2423:53: error: 'struct hid_device' has no member named 'batteries'
2423 | list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
| ^~
include/linux/list.h:773:37: note: in definition of macro 'list_entry_is_head'
773 | list_is_head(&pos->member, (head))
| ^~~~
drivers/hid/hid-input.c:2423:9: note: in expansion of macro 'list_for_each_entry_safe'
2423 | list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
| ^~~~~~~~~~~~~~~~~~~~~~~~
vim +2423 drivers/hid/hid-input.c
2407
2408 void hidinput_disconnect(struct hid_device *hid)
2409 {
2410 struct hid_input *hidinput, *next;
2411 struct hid_battery *bat, *bat_next;
2412
2413 list_for_each_entry_safe(hidinput, next, &hid->inputs, list) {
2414 list_del(&hidinput->list);
2415 if (hidinput->registered)
2416 input_unregister_device(hidinput->input);
2417 else
2418 input_free_device(hidinput->input);
2419 kfree(hidinput->name);
2420 kfree(hidinput);
2421 }
2422
> 2423 list_for_each_entry_safe(bat, bat_next, &hid->batteries, list) {
2424 list_del(&bat->list);
2425 }
2426
2427 /* led_work is spawned by input_dev callbacks, but doesn't access the
2428 * parent input_dev at all. Once all input devices are removed, we
2429 * know that led_work will never get restarted, so we can cancel it
2430 * synchronously and are safe. */
2431 cancel_work_sync(&hid->led_work);
2432 }
2433 EXPORT_SYMBOL_GPL(hidinput_disconnect);
2434
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH v3] Input: ads7846 - don't use scratch for tx_buf when clearing register
From: Dmitry Torokhov @ 2026-05-05 3:01 UTC (permalink / raw)
To: Kris Bahnsen
Cc: Marek Vasut, stable, Mark Featherston, linux-input, linux-kernel
In-Reply-To: <20260430173739.3843425-1-kris@embeddedTS.com>
Hi Kris,
On Thu, Apr 30, 2026 at 05:37:38PM +0000, Kris Bahnsen wrote:
> The workaround for XPT2046 clears the command register, giving the
> touchscreen controller a NOP. The change incorrectly re-uses the
> req->scratch variable which is used as rx_buf for xfer[5], so by
> the time xfer[6] occurs, the contents of req->scratch may not be
> 0. It was found that the touchscreen controller can end up in
> a completely unresponsive state due to it being given a command
> the driver does not expect.
>
> Instead, rely on the spi_transfer behavior of tx_buf being NULL to
> transmit all 0 bits and use the scratch variable for the rx_buf for
> both the 1 byte command to and 2 byte response from the controller.
>
> This change was tested on real TSC2046 and ADS7843 controllers,
> but not the XPT2046 the workaround was originally created for.
> Confirming that the original modification to clear the command
> register does not impact either real controller.
>
> Fixes: 781a07da9bb94 ("Input: ads7846 - add dummy command register clearing cycle")
> Cc: stable@vger.kernel.org
> Co-developed-by: Mark Featherston <mark@embeddedTS.com>
> Signed-off-by: Mark Featherston <mark@embeddedTS.com>
> Signed-off-by: Kris Bahnsen <kris@embeddedTS.com>
> ---
>
> V1 -> V2: Don't use rx_buf when clearing command reg
> V2 -> V3: Modify original 2 xfer command to eliminate dev_err()
> output on xfer with len and NULL buffers
>
> drivers/input/touchscreen/ads7846.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
> index 4b39f7212d35c..488bcc8393293 100644
> --- a/drivers/input/touchscreen/ads7846.c
> +++ b/drivers/input/touchscreen/ads7846.c
> @@ -403,8 +403,7 @@ static int ads7846_read12_ser(struct device *dev, unsigned command)
> spi_message_add_tail(&req->xfer[5], &req->msg);
>
> /* clear the command register */
> - req->scratch = 0;
> - req->xfer[6].tx_buf = &req->scratch;
> + req->xfer[6].rx_buf = &req->scratch;
Sashiko (I believe correctly) pointed out that by doing this "scratch"
is now write only and this may cause DMA from the device stomp on
message status and other unrelated data that shares the same cacheline
with scracth. While it was already a problem before now it is even more
likely.
Since scratch is now write-only I believe moving it below "sample"
forces it into separate cacheline and fixes this problem. Could you
please try making this change?
Thanks.
--
Dmitry
^ permalink raw reply
* Re: [PATCH v2 1/2] Input: ads7846 - restore half-duplex support
From: Dmitry Torokhov @ 2026-05-05 4:45 UTC (permalink / raw)
To: Aaro Koskinen
Cc: Oleksij Rempel, Janusz Krzysztofik, Tony Lindgren, Linus Walleij,
linux-input, linux-kernel, linux-omap
In-Reply-To: <aeZ_M7jjisCExva8@darkstar.musicnaut.iki.fi>
On Mon, Apr 20, 2026 at 10:32:03PM +0300, Aaro Koskinen wrote:
> Hi,
>
> On Sun, Apr 19, 2026 at 05:13:56PM -0700, Dmitry Torokhov wrote:
> > > +static void ads7846_halfd_read_state(struct ads7846 *ts)
> > > +{
> > > + struct ads7846_packet *packet = ts->packet;
> > > + int msg_idx = 0;
> > > +
> > > + packet->ignore = false;
> > > +
> > > + while (msg_idx < ts->msg_count) {
> > > + int error;
> > > +
> > > + ads7846_wait_for_hsync(ts);
> > > +
> > > + error = spi_sync(ts->spi, &ts->msg[msg_idx]);
> > > + if (error) {
> > > + dev_err_ratelimited(&ts->spi->dev, "spi_sync --> %d\n",
> > > + error);
> > > + packet->ignore = true;
> > > + return;
> >
> > Sashiko recommends trying to power down ADC on errors, what do you
> > think?
>
> If we want to re-work error handling, then I guess it should be done the
> same way for both full and half-duplex modes, and belongs to a separate
> change set. This code has been in use quite a while, maybe 20 years,
> and I haven't seen those errors in real use anyway, and AFAIK there
> hasn't been any bug/problem reports by others either.
>
> Maybe it wasn't so clearly stated in the commit message, but the patch
> just restores the old code verbatim that was working fine for half-duplex
> mode.
Fair enough, applied.
Thanks.
--
Dmitry
^ permalink raw reply
* [PATCH] Input: ads7846 - consolidate coordinate filtering logic
From: Dmitry Torokhov @ 2026-05-05 4:54 UTC (permalink / raw)
To: linux-input
Cc: Aaro Koskinen, Mark Featherston, Kris Bahnsen, Marek Vasut,
linux-kernel
The ads7846 driver has two separate filtering functions,
ads7846_filter() and ads7846_filter_one(), for the full-duplex and
half-duplex SPI paths, respectively.
They can be consolidated by extracting the core filtering logic for a
single command into a helper function, ads7846_filter_cmd(), which
iterates from l->skip to l->count. The half-duplex setup function is
updated to set l->skip = l->count - 1 so that the helper only processes
the last sample, preserving the original half-duplex behavior.
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
Not tested so will appreciate if someone could give it a spin.
drivers/input/touchscreen/ads7846.c | 74 +++++++++++++++--------------
1 file changed, 38 insertions(+), 36 deletions(-)
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index d3b529333ca2..093f4b56cc18 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -759,52 +759,54 @@ static bool ads7846_cmd_need_settle(enum ads7846_cmds cmd_idx)
return false;
}
-static int ads7846_filter(struct ads7846 *ts)
+static int ads7846_filter_cmd(struct ads7846 *ts, unsigned int cmd_idx)
{
struct ads7846_packet *packet = ts->packet;
- int action;
- int val;
- unsigned int cmd_idx, b;
+ struct ads7846_buf_layout *l = &packet->l[cmd_idx];
+ unsigned int b;
- packet->ignore = false;
- for (cmd_idx = packet->last_cmd_idx; cmd_idx < packet->cmds - 1; cmd_idx++) {
- struct ads7846_buf_layout *l = &packet->l[cmd_idx];
+ for (b = l->skip; b < l->count; b++) {
+ int val = ads7846_get_value(&packet->rx[l->offset + b]);
- packet->last_cmd_idx = cmd_idx;
+ switch (ts->filter(ts->filter_data, cmd_idx, &val)) {
+ case ADS7846_FILTER_REPEAT:
+ if (b == l->count - 1)
+ return -EAGAIN;
+ break;
- for (b = l->skip; b < l->count; b++) {
- val = ads7846_get_value(&packet->rx[l->offset + b]);
-
- action = ts->filter(ts->filter_data, cmd_idx, &val);
- if (action == ADS7846_FILTER_REPEAT) {
- if (b == l->count - 1)
- return -EAGAIN;
- } else if (action == ADS7846_FILTER_OK) {
- ads7846_set_cmd_val(ts, cmd_idx, val);
- break;
- } else {
- packet->ignore = true;
- return 0;
- }
+ case ADS7846_FILTER_OK:
+ ads7846_set_cmd_val(ts, cmd_idx, val);
+ return 0;
+
+ case ADS7846_FILTER_IGNORE:
+ default:
+ return -EIO;
}
}
- return 0;
+ return -EIO;
}
-static int ads7846_filter_one(struct ads7846 *ts, unsigned int cmd_idx)
+static int ads7846_filter(struct ads7846 *ts)
{
struct ads7846_packet *packet = ts->packet;
- struct ads7846_buf_layout *l = &packet->l[cmd_idx];
- int action, val;
-
- val = ads7846_get_value(&packet->rx[l->offset + l->count - 1]);
- action = ts->filter(ts->filter_data, cmd_idx, &val);
- if (action == ADS7846_FILTER_REPEAT)
- return -EAGAIN;
- else if (action != ADS7846_FILTER_OK)
- return -EIO;
- ads7846_set_cmd_val(ts, cmd_idx, val);
+ unsigned int cmd_idx;
+ int error;
+
+ packet->ignore = false;
+ for (cmd_idx = packet->last_cmd_idx; cmd_idx < packet->cmds - 1; cmd_idx++) {
+ packet->last_cmd_idx = cmd_idx;
+
+ error = ads7846_filter_cmd(ts, cmd_idx);
+ if (error) {
+ if (error == -EAGAIN)
+ return -EAGAIN;
+
+ packet->ignore = true;
+ return 0;
+ }
+ }
+
return 0;
}
@@ -857,7 +859,7 @@ static void ads7846_halfd_read_state(struct ads7846 *ts)
if (msg_idx == ts->msg_count - 1)
break;
- error = ads7846_filter_one(ts, msg_idx);
+ error = ads7846_filter_cmd(ts, msg_idx);
if (error == -EAGAIN) {
continue;
} else if (error) {
@@ -1119,7 +1121,7 @@ static int ads7846_halfd_spi_msg(struct ads7846 *ts,
l->offset = offset;
offset += max_count;
l->count = max_count;
- l->skip = 0;
+ l->skip = max_count - 1;
size += sizeof(*packet->rx) * max_count;
}
--
2.54.0.545.g6539524ca2-goog
--
Dmitry
^ permalink raw reply related
* [PATCH v2 01/20] Input: rmi4 - fix register descriptor address calculation
From: Dmitry Torokhov @ 2026-05-05 4:59 UTC (permalink / raw)
To: linux-input; +Cc: Marge Yang, Greg Kroah-Hartman, linux-kernel, stable
When reading the register descriptor, the base address is incremented by
1 to read the presence register block. However, after reading the
presence register block, the address is incorrectly incremented by only
1 byte (++addr) instead of the actual size of the presence block
(size_presence_reg). This causes the subsequent structure block read to
read from the wrong memory location if the presence block is larger than
1 byte.
Fix this by advancing the address by size_presence_reg.
Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
v2 of the series: added a bunch of new patches.
drivers/input/rmi4/rmi_driver.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index ccd9338a44db..06f5e3000cf0 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -594,7 +594,7 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
ret = rmi_read_block(d, addr, buf, size_presence_reg);
if (ret)
return ret;
- ++addr;
+ addr += size_presence_reg;
if (buf[0] == 0) {
presense_offset = 3;
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH v2 02/20] Input: rmi4 - refactor register descriptor parsing
From: Dmitry Torokhov @ 2026-05-05 4:59 UTC (permalink / raw)
To: linux-input; +Cc: Marge Yang, Greg Kroah-Hartman, linux-kernel, stable
In-Reply-To: <20260505045952.1570713-1-dmitry.torokhov@gmail.com>
Factor out parsing a register descriptor item from
rmi_read_register_desc() and ensure there are no out-of-bounds accesses.
Use get_unaligned_le16() and get_unaligned_le32() for reading multi-byte
values.
Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/input/rmi4/rmi_driver.c | 124 +++++++++++++++++++-------------
1 file changed, 76 insertions(+), 48 deletions(-)
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index 06f5e3000cf0..75949fb1a922 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -22,6 +22,7 @@
#include <uapi/linux/input.h>
#include <linux/rmi.h>
#include <linux/export.h>
+#include <linux/unaligned.h>
#include "rmi_bus.h"
#include "rmi_driver.h"
@@ -558,30 +559,74 @@ int rmi_scan_pdt(struct rmi_device *rmi_dev, void *ctx,
return retval < 0 ? retval : 0;
}
+static int rmi_parse_register_desc_item(struct rmi_register_desc_item *item,
+ const u8 *buf, size_t size)
+{
+ unsigned int offset = 0;
+ unsigned int map_offset = 0;
+ int b;
+
+ if (offset >= size)
+ return -EIO;
+
+ item->reg_size = buf[offset++];
+ if (item->reg_size == 0) {
+ if (size - offset < 2)
+ return -EIO;
+ item->reg_size = get_unaligned_le16(&buf[offset]);
+ offset += 2;
+ }
+
+ if (item->reg_size == 0) {
+ if (size - offset < 4)
+ return -EIO;
+ item->reg_size = get_unaligned_le32(&buf[offset]);
+ offset += 4;
+ }
+
+ do {
+ if (offset >= size)
+ return -EIO;
+
+ for (b = 0; b < 7; b++) {
+ if (buf[offset] & BIT(b)) {
+ if (map_offset >= RMI_REG_DESC_SUBPACKET_BITS)
+ return -EIO;
+ __set_bit(map_offset, item->subpacket_map);
+ }
+ ++map_offset;
+ }
+ } while (buf[offset++] & BIT(7));
+
+ item->num_subpackets = bitmap_weight(item->subpacket_map,
+ RMI_REG_DESC_SUBPACKET_BITS);
+
+ return offset;
+}
+
int rmi_read_register_desc(struct rmi_device *d, u16 addr,
- struct rmi_register_descriptor *rdesc)
+ struct rmi_register_descriptor *rdesc)
{
int ret;
u8 size_presence_reg;
u8 buf[35];
- int presense_offset = 1;
- u8 *struct_buf;
- int reg;
- int offset = 0;
- int map_offset = 0;
+ unsigned int presence_offset;
+ unsigned int map_offset;
+ unsigned int offset;
+ unsigned int reg;
int i;
int b;
/*
* The first register of the register descriptor is the size of
- * the register descriptor's presense register.
+ * the register descriptor's presence register.
*/
ret = rmi_read(d, addr, &size_presence_reg);
if (ret)
return ret;
++addr;
- if (size_presence_reg < 0 || size_presence_reg > 35)
+ if (size_presence_reg < 1 || size_presence_reg > 35)
return -EIO;
memset(buf, 0, sizeof(buf));
@@ -597,16 +642,23 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
addr += size_presence_reg;
if (buf[0] == 0) {
- presense_offset = 3;
- rdesc->struct_size = buf[1] | (buf[2] << 8);
+ if (size_presence_reg < 3)
+ return -EIO;
+ presence_offset = 3;
+ rdesc->struct_size = get_unaligned_le16(&buf[1]);
} else {
+ presence_offset = 1;
rdesc->struct_size = buf[0];
}
- for (i = presense_offset; i < size_presence_reg; i++) {
+ map_offset = 0;
+ for (i = presence_offset; i < size_presence_reg; i++) {
for (b = 0; b < 8; b++) {
- if (buf[i] & (0x1 << b))
+ if (buf[i] & BIT(b)) {
+ if (map_offset >= RMI_REG_DESC_PRESENSE_BITS)
+ return -EIO;
bitmap_set(rdesc->presense_map, map_offset, 1);
+ }
++map_offset;
}
}
@@ -626,7 +678,7 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
* I'm not using devm_kzalloc here since it will not be retained
* after exiting this function
*/
- struct_buf = kzalloc(rdesc->struct_size, GFP_KERNEL);
+ u8 *struct_buf __free(kfree) = kzalloc(rdesc->struct_size, GFP_KERNEL);
if (!struct_buf)
return -ENOMEM;
@@ -638,56 +690,32 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
*/
ret = rmi_read_block(d, addr, struct_buf, rdesc->struct_size);
if (ret)
- goto free_struct_buff;
+ return ret;
reg = find_first_bit(rdesc->presense_map, RMI_REG_DESC_PRESENSE_BITS);
+ offset = 0;
for (i = 0; i < rdesc->num_registers; i++) {
struct rmi_register_desc_item *item = &rdesc->registers[i];
- int reg_size = struct_buf[offset];
-
- ++offset;
- if (reg_size == 0) {
- reg_size = struct_buf[offset] |
- (struct_buf[offset + 1] << 8);
- offset += 2;
- }
+ int item_size;
- if (reg_size == 0) {
- reg_size = struct_buf[offset] |
- (struct_buf[offset + 1] << 8) |
- (struct_buf[offset + 2] << 16) |
- (struct_buf[offset + 3] << 24);
- offset += 4;
- }
+ item_size = rmi_parse_register_desc_item(item,
+ &struct_buf[offset],
+ rdesc->struct_size - offset);
+ if (item_size < 0)
+ return item_size;
item->reg = reg;
- item->reg_size = reg_size;
-
- map_offset = 0;
-
- do {
- for (b = 0; b < 7; b++) {
- if (struct_buf[offset] & (0x1 << b))
- bitmap_set(item->subpacket_map,
- map_offset, 1);
- ++map_offset;
- }
- } while (struct_buf[offset++] & 0x80);
-
- item->num_subpackets = bitmap_weight(item->subpacket_map,
- RMI_REG_DESC_SUBPACKET_BITS);
+ offset += item_size;
rmi_dbg(RMI_DEBUG_CORE, &d->dev,
"%s: reg: %d reg size: %ld subpackets: %d\n", __func__,
item->reg, item->reg_size, item->num_subpackets);
reg = find_next_bit(rdesc->presense_map,
- RMI_REG_DESC_PRESENSE_BITS, reg + 1);
+ RMI_REG_DESC_PRESENSE_BITS, reg + 1);
}
-free_struct_buff:
- kfree(struct_buf);
- return ret;
+ return 0;
}
const struct rmi_register_desc_item *rmi_get_register_desc_item(
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH v2 03/20] Input: rmi4 - fix type overflow in register counts
From: Dmitry Torokhov @ 2026-05-05 4:59 UTC (permalink / raw)
To: linux-input; +Cc: Marge Yang, Greg Kroah-Hartman, linux-kernel, stable
In-Reply-To: <20260505045952.1570713-1-dmitry.torokhov@gmail.com>
The number of registers in the RMI4 register descriptor is populated
by counting the bits in the presence map using bitmap_weight(). Since
the presence map can contain up to 256 bits (RMI_REG_DESC_PRESENSE_BITS),
storing this count in a u8 can overflow to 0 if all 256 bits are set.
Change the num_registers field in struct rmi_register_descriptor
from u8 to u16 to prevent potential integer overflow and ensure safe
processing of devices reporting large descriptors.
Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/input/rmi4/rmi_driver.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/input/rmi4/rmi_driver.h b/drivers/input/rmi4/rmi_driver.h
index e84495caab15..5f769fcc758d 100644
--- a/drivers/input/rmi4/rmi_driver.h
+++ b/drivers/input/rmi4/rmi_driver.h
@@ -65,7 +65,7 @@ struct rmi_register_desc_item {
struct rmi_register_descriptor {
unsigned long struct_size;
unsigned long presense_map[BITS_TO_LONGS(RMI_REG_DESC_PRESENSE_BITS)];
- u8 num_registers;
+ u16 num_registers;
struct rmi_register_desc_item *registers;
};
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH v2 04/20] Input: rmi4 - fix num_subpackets overflow in register descriptor
From: Dmitry Torokhov @ 2026-05-05 4:59 UTC (permalink / raw)
To: linux-input; +Cc: Marge Yang, Greg Kroah-Hartman, linux-kernel, stable
In-Reply-To: <20260505045952.1570713-1-dmitry.torokhov@gmail.com>
RMI_REG_DESC_SUBPACKET_BITS is defined as 296 (37 * BITS_PER_BYTE). This
may overflow num_subpackets in struct rmi_register_desc_item which is
defined as a u8.
Fix this by changing the type of num_subpackets to u16.
Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/input/rmi4/rmi_driver.h | 2 +-
drivers/input/rmi4/rmi_f12.c | 7 +++++++
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/input/rmi4/rmi_driver.h b/drivers/input/rmi4/rmi_driver.h
index 5f769fcc758d..6952059bf4f5 100644
--- a/drivers/input/rmi4/rmi_driver.h
+++ b/drivers/input/rmi4/rmi_driver.h
@@ -53,7 +53,7 @@ struct pdt_entry {
struct rmi_register_desc_item {
u16 reg;
unsigned long reg_size;
- u8 num_subpackets;
+ u16 num_subpackets;
unsigned long subpacket_map[BITS_TO_LONGS(
RMI_REG_DESC_SUBPACKET_BITS)];
};
diff --git a/drivers/input/rmi4/rmi_f12.c b/drivers/input/rmi4/rmi_f12.c
index 8246fe77114b..c2b07c6905d7 100644
--- a/drivers/input/rmi4/rmi_f12.c
+++ b/drivers/input/rmi4/rmi_f12.c
@@ -467,6 +467,13 @@ static int rmi_f12_probe(struct rmi_function *fn)
f12->data1 = item;
f12->data1_offset = data_offset;
data_offset += item->reg_size;
+
+ if (item->num_subpackets > 255) {
+ dev_err(&fn->dev, "Too many fingers declared: %d\n",
+ item->num_subpackets);
+ return -EINVAL;
+ }
+
sensor->nbr_fingers = item->num_subpackets;
sensor->report_abs = 1;
sensor->attn_size += item->reg_size;
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox