* Re: [PATCH v3 1/2] HID: sensor: custom: Fix use-after-free in enable_sensor
From: sashiko-bot @ 2026-07-07 7:50 UTC (permalink / raw)
To: Haoxiang Li; +Cc: dmitry.torokhov, linux-input
In-Reply-To: <20260707071545.3087073-2-haoxiang_li2024@163.com>
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
Pre-existing issues:
- [Critical] Incorrect mapping between the sysfs attribute name index and the `sensor_inst->fields` array leads to Heap Out-Of-Bounds reads.
- [High] The `/dev/HID-SENSOR-*` character device operations do not synchronize with device removal, leading to Use-After-Free on `devm`-managed structures.
- [High] The `data_fifo` is freed before the sensor hub interrupt callback is unregistered during device removal, creating a race condition that leads to a Use-After-Free.
- [High] The sensor hub device is never closed on driver removal if it was concurrently enabled, causing a permanent power and reference count leak.
--
--- Patch [1]: [PATCH v3 1/2] HID: sensor: custom: Fix use-after-free in enable_sensor ---
commit d433ad359db5f5f5744d4b3f8a4dc8088af760b6
Author: Haoxiang Li <haoxiang_li2024@163.com>
HID: sensor: custom: Fix use-after-free in enable_sensor
This commit fixes a use-after-free by altering the initialization and cleanup
order of the sysfs attributes and the enable_sensor group. This prevents
enable_sensor from being accessed before its dependencies are fully
initialized or after they have been freed.
Link: https://sashiko.dev/#/patchset/20260623021950.1736413-1-haoxiang_li2024@163.com?part=1
> diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
> index afffea8940214..6b0da2e0e1c93 100644
> --- a/drivers/hid/hid-sensor-custom.c
> +++ b/drivers/hid/hid-sensor-custom.c
> @@ -1005,26 +1005,26 @@ static int hid_sensor_custom_probe(struct platform_device *pdev)
> return ret;
> }
>
> - ret = sysfs_create_group(&sensor_inst->pdev->dev.kobj,
> - &enable_sensor_attr_group);
> + ret = hid_sensor_custom_add_attributes(sensor_inst);
[Severity: Critical]
This is a pre-existing issue, but is there an out-of-bounds read when parsing
the sysfs strings created by this function?
During initialization, if a HID field is skipped, it is not appended to the
sensor_inst->fields array, keeping sensor_field_count small. However, its
original field index is embedded into the sysfs file name.
When a valid sysfs file is later read, show_value() parses the index from
the filename and uses it directly as an array index:
if (sscanf(attr->attr.name, "input-%x-%x-%s",
&index, &usage, name) == 3) {
input = true;
field_index = index;
}
...
value = sensor_inst->fields[field_index].attribute.logical_minimum;
Could this bypass the array bounds and leak memory to userspace?
[ ... ]
> @@ -1042,9 +1042,10 @@ static void hid_sensor_custom_remove(struct platform_device *pdev)
> }
>
> hid_sensor_custom_dev_if_remove(sensor_inst);
[Severity: High]
This isn't a bug introduced by this patch, but doesn't this leave a
use-after-free window?
If a user holds open the misc device /dev/HID-SENSOR-*, misc_deregister()
does not close existing open file descriptors. Since sensor_inst is
allocated with devm_kzalloc(), it is freed when remove() returns.
Would subsequent calls to hid_sensor_custom_read(), poll(), or
hid_sensor_custom_release() dereference the freed sensor_inst object?
[Severity: High]
This is a pre-existing issue, but is there a race condition here?
The data_fifo is freed by hid_sensor_custom_dev_if_remove() before the
interrupt callback is unregistered by sensor_hub_remove_callback().
If an interrupt occurs while sysfs_remove_group() or
hid_sensor_custom_remove_attributes() is blocking, couldn't the callback
hid_sensor_capture_sample() write incoming data to the freed data_fifo
via kfifo_in()?
[Severity: High]
This is also a pre-existing issue, but does this function leak the sensor hub
reference and power state?
If a user writes '1' to the enable_sensor sysfs attribute,
sensor_hub_device_open() powers on the device and takes a reference. Since
this function tears down the interfaces without checking sensor_inst->enable
and calling sensor_hub_device_close(), does the HID device reference leak
permanently?
> - hid_sensor_custom_remove_attributes(sensor_inst);
> + /* Remove enable_sensor first as it uses fields via power_state/report_state. */
> sysfs_remove_group(&sensor_inst->pdev->dev.kobj,
> &enable_sensor_attr_group);
> + hid_sensor_custom_remove_attributes(sensor_inst);
> sensor_hub_remove_callback(hsdev, hsdev->usage);
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260707071545.3087073-1-haoxiang_li2024@163.com?part=1
^ permalink raw reply
* [PATCH v3 1/2] HID: sensor: custom: Fix use-after-free in enable_sensor
From: Haoxiang Li @ 2026-07-07 7:15 UTC (permalink / raw)
To: jikos, jic23, srinivas.pandruvada, bentiss
Cc: linux-input, linux-iio, linux-kernel, Haoxiang Li,
Sashiko AI Review, stable
In-Reply-To: <20260707071545.3087073-1-haoxiang_li2024@163.com>
enable_sensor_store() can call set_power_report_state(), which
dereferences sensor_inst->power_state and sensor_inst->report_state.
These pointers refer to entries in sensor_inst->fields.
Create the field attributes before exposing the enable_sensor sysfs
attribute, so enable_sensor cannot be accessed before the state it
depends on has been initialized.
On remove, delete enable_sensor before freeing the field attributes,
so a concurrent sysfs write cannot dereference freed memory through
power_state or report_state.
Reported-by: Sashiko AI Review <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260623021950.1736413-1-haoxiang_li2024@163.com?part=1
Fixes: 4a7de0519df5 ("HID: sensor: Custom and Generic sensor support")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
---
drivers/hid/hid-sensor-custom.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
index afffea894021..6b0da2e0e1c9 100644
--- a/drivers/hid/hid-sensor-custom.c
+++ b/drivers/hid/hid-sensor-custom.c
@@ -1005,26 +1005,26 @@ static int hid_sensor_custom_probe(struct platform_device *pdev)
return ret;
}
- ret = sysfs_create_group(&sensor_inst->pdev->dev.kobj,
- &enable_sensor_attr_group);
+ ret = hid_sensor_custom_add_attributes(sensor_inst);
if (ret)
goto err_remove_callback;
- ret = hid_sensor_custom_add_attributes(sensor_inst);
+ ret = sysfs_create_group(&sensor_inst->pdev->dev.kobj,
+ &enable_sensor_attr_group);
if (ret)
- goto err_remove_group;
+ goto err_remove_attributes;
ret = hid_sensor_custom_dev_if_add(sensor_inst);
if (ret)
- goto err_remove_attributes;
+ goto err_remove_group;
return 0;
-err_remove_attributes:
- hid_sensor_custom_remove_attributes(sensor_inst);
err_remove_group:
sysfs_remove_group(&sensor_inst->pdev->dev.kobj,
&enable_sensor_attr_group);
+err_remove_attributes:
+ hid_sensor_custom_remove_attributes(sensor_inst);
err_remove_callback:
sensor_hub_remove_callback(hsdev, hsdev->usage);
@@ -1042,9 +1042,10 @@ static void hid_sensor_custom_remove(struct platform_device *pdev)
}
hid_sensor_custom_dev_if_remove(sensor_inst);
- hid_sensor_custom_remove_attributes(sensor_inst);
+ /* Remove enable_sensor first as it uses fields via power_state/report_state. */
sysfs_remove_group(&sensor_inst->pdev->dev.kobj,
&enable_sensor_attr_group);
+ hid_sensor_custom_remove_attributes(sensor_inst);
sensor_hub_remove_callback(hsdev, hsdev->usage);
}
--
2.25.1
^ permalink raw reply related
* [PATCH v3 0/2] HID: sensor: custom: Fix fields lifetime issues
From: Haoxiang Li @ 2026-07-07 7:15 UTC (permalink / raw)
To: jikos, jic23, srinivas.pandruvada, bentiss
Cc: linux-input, linux-iio, linux-kernel, Haoxiang Li
Hi,
This series fixes lifetime issues around sensor_inst->fields and the
sysfs attributes that can access it.
The first patch creates the field attributes before exposing enable_sensor
and removes enable_sensor before freeing the field attributes. This keeps
enable_sensor from accessing power_state and report_state pointers after
the fields array has been freed.
The second patch fixes the original field sysfs group leak on probe
failure by unwinding any field groups that were created before a later
sysfs_create_group() failure.
Changes in v3:
- Move the enable_sensor registration reorder from patch 2 to patch 1.
- Add a comment explaining why enable_sensor is removed before fields.
- Add Reported-by and Link tags for the Sashiko review.
- Keep patch 2 focused on the field sysfs group cleanup. Tanks, Jonathan!
Changes in v2:
- Split the fix into two patches.
- Unwind already-created field sysfs groups on failure. Thanks, Jiri!
Haoxiang Li (2):
HID: sensor: custom: Fix use-after-free in enable_sensor
HID: sensor: custom: Fix field sysfs group cleanup on failure
drivers/hid/hid-sensor-custom.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
base-commit: ef0c9f75a19532d7675384708fc8621e10850104
--
2.25.1
^ permalink raw reply
* [PATCH v3 2/2] HID: sensor: custom: Fix field sysfs group cleanup on failure
From: Haoxiang Li @ 2026-07-07 7:15 UTC (permalink / raw)
To: jikos, jic23, srinivas.pandruvada, bentiss
Cc: linux-input, linux-iio, linux-kernel, Haoxiang Li, stable
In-Reply-To: <20260707071545.3087073-1-haoxiang_li2024@163.com>
hid_sensor_custom_add_attributes() creates one sysfs group for each
custom sensor field. If sysfs_create_group() fails after some groups
have already been created, the function returns the error without
removing the previously created groups.
Add a local unwind path to remove the groups that were already created.
With enable_sensor exposed only after the field attributes are ready,
this path can free sensor_inst->fields without leaving enable_sensor
able to access pointers into that array.
Fixes: 4a7de0519df5 ("HID: sensor: Custom and Generic sensor support")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
---
drivers/hid/hid-sensor-custom.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
index 6b0da2e0e1c9..c2b425afd951 100644
--- a/drivers/hid/hid-sensor-custom.c
+++ b/drivers/hid/hid-sensor-custom.c
@@ -609,7 +609,7 @@ static int hid_sensor_custom_add_attributes(struct hid_sensor_custom
&sensor_inst->fields[i].
hid_custom_attribute_group);
if (ret)
- break;
+ goto err_remove_groups;
/* For power or report field store indexes */
if (sensor_inst->fields[i].attribute.attrib_id ==
@@ -621,6 +621,13 @@ static int hid_sensor_custom_add_attributes(struct hid_sensor_custom
}
return ret;
+
+err_remove_groups:
+ while (--i >= 0)
+ sysfs_remove_group(&sensor_inst->pdev->dev.kobj,
+ &sensor_inst->fields[i].hid_custom_attribute_group);
+ kfree(sensor_inst->fields);
+ return ret;
}
static void hid_sensor_custom_remove_attributes(struct hid_sensor_custom *
--
2.25.1
^ permalink raw reply related
* [PATCH] Input: i8042 - replace strlcat() with seq_buf and scnprintf()
From: Ian Bridges @ 2026-07-07 6:04 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input, linux-kernel, linux-hardening
In preparation for removing the strlcat() API[1], replace its uses in
i8042-acpipnpio.h.
i8042_pnp_id_to_string() accumulates a variable number of PNP ids in
a loop, which is what seq_buf is for. The kbd and aux probe functions
build a name from at most three parts that are all known up front, so
the whole construction becomes a single scnprintf() there.
Link: https://github.com/KSPP/linux/issues/370 [1]
Signed-off-by: Ian Bridges <icb@fastmail.org>
---
scnprintf() is used rather than snprintf() because the name buffers
tolerate truncation by design and the builtin snprintf() triggers
-Wformat-truncation at W=1 for it. The output is unchanged in all
cases.
The possible truncation predates the patch. The name buffers hold 32
bytes, which is 31 characters plus a terminator. A full entry is a
7 character PNP id, a ':' separator, and up to 49 characters of PNP
device name, or 57 characters in the worst case. That leaves 23
characters for the device name, so a BIOS name longer than that is
cut short in the i8042 PNP console line. The old and the new code
truncate at the same point and produce the same bytes. Enlarging the
buffers would be a visible behavior change and is left for a separate
patch.
The patch was tested as follows:
- An x86_64 build of drivers/input/serio/i8042.o at W=1 produces no
warnings.
- A userspace comparison of the old and new construction ran with
randomized PNP id chains, device names, and buffer sizes. The
outputs were byte-identical in every case.
- Base and patched kernels were booted in QEMU, whose PS/2
controller exposes PNP0303 and PNP0F13 devices. The serio
firmware_id sysfs strings and the PS/2 controller console line are
identical before and after the change.
drivers/input/serio/i8042-acpipnpio.h | 27 ++++++++++++++-------------
1 file changed, 14 insertions(+), 13 deletions(-)
diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h
index 412f82d7a303..9ecb0eed48c4 100644
--- a/drivers/input/serio/i8042-acpipnpio.h
+++ b/drivers/input/serio/i8042-acpipnpio.h
@@ -3,6 +3,7 @@
#define _I8042_ACPIPNPIO_H
#include <linux/acpi.h>
+#include <linux/seq_buf.h>
#ifdef CONFIG_X86
#include <asm/x86_init.h>
@@ -1479,17 +1480,21 @@ static char i8042_pnp_aux_name[32];
static void i8042_pnp_id_to_string(struct pnp_id *id, char *dst, int dst_size)
{
- strscpy(dst, "PNP:", dst_size);
+ struct seq_buf sb;
+
+ seq_buf_init(&sb, dst, dst_size);
+ seq_buf_printf(&sb, "PNP:");
while (id) {
- strlcat(dst, " ", dst_size);
- strlcat(dst, id->id, dst_size);
+ seq_buf_printf(&sb, " %s", id->id);
id = id->next;
}
}
static int i8042_pnp_kbd_probe(struct pnp_dev *dev, const struct pnp_device_id *did)
{
+ const char *name = pnp_dev_name(dev);
+
if (pnp_port_valid(dev, 0) && pnp_port_len(dev, 0) == 1)
i8042_pnp_data_reg = pnp_port_start(dev,0);
@@ -1499,11 +1504,8 @@ static int i8042_pnp_kbd_probe(struct pnp_dev *dev, const struct pnp_device_id *
if (pnp_irq_valid(dev,0))
i8042_pnp_kbd_irq = pnp_irq(dev, 0);
- strscpy(i8042_pnp_kbd_name, did->id, sizeof(i8042_pnp_kbd_name));
- if (strlen(pnp_dev_name(dev))) {
- strlcat(i8042_pnp_kbd_name, ":", sizeof(i8042_pnp_kbd_name));
- strlcat(i8042_pnp_kbd_name, pnp_dev_name(dev), sizeof(i8042_pnp_kbd_name));
- }
+ scnprintf(i8042_pnp_kbd_name, sizeof(i8042_pnp_kbd_name), "%s%s%s",
+ did->id, strlen(name) ? ":" : "", name);
i8042_pnp_id_to_string(dev->id, i8042_kbd_firmware_id,
sizeof(i8042_kbd_firmware_id));
i8042_kbd_fwnode = dev_fwnode(&dev->dev);
@@ -1517,6 +1519,8 @@ static int i8042_pnp_kbd_probe(struct pnp_dev *dev, const struct pnp_device_id *
static int i8042_pnp_aux_probe(struct pnp_dev *dev, const struct pnp_device_id *did)
{
+ const char *name = pnp_dev_name(dev);
+
if (pnp_port_valid(dev, 0) && pnp_port_len(dev, 0) == 1)
i8042_pnp_data_reg = pnp_port_start(dev,0);
@@ -1526,11 +1530,8 @@ static int i8042_pnp_aux_probe(struct pnp_dev *dev, const struct pnp_device_id *
if (pnp_irq_valid(dev, 0))
i8042_pnp_aux_irq = pnp_irq(dev, 0);
- strscpy(i8042_pnp_aux_name, did->id, sizeof(i8042_pnp_aux_name));
- if (strlen(pnp_dev_name(dev))) {
- strlcat(i8042_pnp_aux_name, ":", sizeof(i8042_pnp_aux_name));
- strlcat(i8042_pnp_aux_name, pnp_dev_name(dev), sizeof(i8042_pnp_aux_name));
- }
+ scnprintf(i8042_pnp_aux_name, sizeof(i8042_pnp_aux_name), "%s%s%s",
+ did->id, strlen(name) ? ":" : "", name);
i8042_pnp_id_to_string(dev->id, i8042_aux_firmware_id,
sizeof(i8042_aux_firmware_id));
--
2.47.3
^ permalink raw reply related
* Re: [PATCH 02/10] [v3] input: gpio-keys: make legacy gpiolib optional
From: Dmitry Torokhov @ 2026-07-07 4:54 UTC (permalink / raw)
To: Arnd Bergmann, Bartosz Golaszewski
Cc: sashiko-reviews, linux-input, Hans de Goede, Jin Yao
In-Reply-To: <ah-1z9LhVG0wtfBw@google.com>
On Tue, Jun 02, 2026 at 10:10:28PM -0700, Dmitry Torokhov wrote:
> On Mon, Jun 01, 2026 at 08:32:31PM +0200, Arnd Bergmann wrote:
> >
> > Hans, Dmitry, do you already have plans to deal with the
> > soc_button_array driver to move it away from legacy GPIOs?
> >
> > So far I can see four possible ways we can deal with it,
> > but none that I actually like:
> >
> > a) delay the problem, apply my original oneline change
> > to 'select GPIOLIB_LEGACY' and fix it later, so we
> > can make GPIOLIB_LEGACY default-disabled in 7.3.
> >
> > b) add a gpiod member to struct gpio_keys_button and skip
> > the intermediate gpio number here. Clean it up later.
> >
> > c) always pass the gpio as an interrupt, as the driver
> > already does for some machines
> >
> > d) add dynamic device properties that duplicate the
> > information from ACPI/DMI, so the driver can
> > stop using platform data
> >
> > e) disconnect gpio_keys_button from gpio-keys.c and
> > register the buttons to the input subsystem
> > directly from soc_button_device_create().
>
> I tried doing e) and while it is possible I ended up re-implementing
> most of gpio_keys.c which is not great. We still need both GPIO and
> IRQ-only modes, and handling debouncing, both software and hardware, and
> so on. So I would like to see if d) is possible. The problem is that we
> need to reconstruct GPIO reference from existing gpio_desc. If Bart will
> be OK with something like below then I think the conversion should be
> achievable.
It turns out Bart was not on the CC list so I was waiting for response
in vain...
Bart, will you be OK with something like below?
>
> gpiolib: Introduce gpiod_get_software_node_reference()
>
> From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
>
> To support converting drivers (such as soc_button_array) to use static
> device properties/software nodes, we need a way to reconstruct a GPIO
> reference from an existing gpio_desc.
>
> Introduce gpiod_get_software_node_reference() which populates a
> struct software_node_ref_args with the GPIO device's fwnode, the pin
> offset, and the appropriate active-low flag.
>
> Assisted-by: Gemini:gemini-3.1-pro
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> ---
> drivers/gpio/gpiolib.c | 35 +++++++++++++++++++++++++++++++++++
> include/linux/gpio/consumer.h | 12 ++++++++++++
> 2 files changed, 47 insertions(+)
>
> diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
> index 1e6dce430dca..63cef0fb02b5 100644
> --- a/drivers/gpio/gpiolib.c
> +++ b/drivers/gpio/gpiolib.c
> @@ -247,6 +247,41 @@ int gpiod_hwgpio(const struct gpio_desc *desc)
> }
> EXPORT_SYMBOL_GPL(gpiod_hwgpio);
>
> +/**
> + * gpiod_get_software_node_reference() - Reconstruct a software node reference
> + * from a GPIO descriptor
> + * @desc: GPIO descriptor
> + * @args: Pointer to software node reference arguments structure to populate
> + *
> + * This function can be used to construct a software node reference from
> + * an existing GPIO descriptor. This is useful when a driver wants to pass
> + * a software node to a secondary device, but needs to reconstruct a GPIO
> + * reference dynamically.
> + *
> + * Returns:
> + * 0 on success, or a negative error code on failure.
> + */
> +int gpiod_get_software_node_reference(const struct gpio_desc *desc,
> + struct software_node_ref_args *args)
> +{
> + struct gpio_device *gdev;
> +
> + if (IS_ERR_OR_NULL(desc) || !args)
> + return -EINVAL;
> +
> + gdev = desc->gdev;
> +
> + memset(args, 0, sizeof(*args));
> + args->fwnode = dev_fwnode(&gdev->dev);
> + args->nargs = 2;
> + args->args[0] = gpiod_hwgpio(desc);
> + if (test_bit(GPIOD_FLAG_ACTIVE_LOW, &desc->flags))
> + args->args[1] = GPIO_ACTIVE_LOW;
> +
> + return 0;
> +}
> +EXPORT_SYMBOL_GPL(gpiod_get_software_node_reference);
> +
> /**
> * gpiod_to_chip - Return the GPIO chip to which a GPIO descriptor belongs
> * @desc: descriptor to return the chip of
> diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
> index 3efb5cb1e1d1..c95b715a1d15 100644
> --- a/include/linux/gpio/consumer.h
> +++ b/include/linux/gpio/consumer.h
> @@ -11,6 +11,7 @@
> struct acpi_device;
> struct device;
> struct fwnode_handle;
> +struct software_node_ref_args;
>
> struct gpio_array;
> struct gpio_desc;
> @@ -177,6 +178,9 @@ int desc_to_gpio(const struct gpio_desc *desc);
>
> int gpiod_hwgpio(const struct gpio_desc *desc);
>
> +int gpiod_get_software_node_reference(const struct gpio_desc *desc,
> + struct software_node_ref_args *args);
> +
> struct gpio_desc *fwnode_gpiod_get_index(struct fwnode_handle *fwnode,
> const char *con_id, int index,
> enum gpiod_flags flags,
> @@ -545,6 +549,14 @@ static inline int desc_to_gpio(const struct gpio_desc *desc)
> return -EINVAL;
> }
>
> +static inline
> +int gpiod_get_software_node_reference(const struct gpio_desc *desc,
> + struct software_node_ref_args *args)
> +{
> + WARN_ON(desc);
> + return -EINVAL;
> +}
> +
> static inline
> struct gpio_desc *fwnode_gpiod_get_index(struct fwnode_handle *fwnode,
> const char *con_id, int index,
>
> Thanks.
>
--
Dmitry
^ permalink raw reply
* Re: [PATCH] Input: iforce - validate packet lengths
From: Dmitry Torokhov @ 2026-07-07 2:56 UTC (permalink / raw)
To: Pengpeng Hou; +Cc: Bryam Vargas, linux-input, linux-kernel
In-Reply-To: <20260706092016.78176-1-pengpeng@iscas.ac.cn>
Hi Pengpeng,
On Mon, Jul 06, 2026 at 05:20:16PM +0800, Pengpeng Hou wrote:
> iforce_process_packet() decodes several packet formats from a
> variable-length input buffer.
>
> Add minimum length checks for joystick, wheel and status packets before
> reading their fixed fields.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/input/joystick/iforce/iforce-packets.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> diff --git a/drivers/input/joystick/iforce/iforce-packets.c b/drivers/input/joystick/iforce/iforce-packets.c
> index effa76bfd8f9..54697b252b84 100644
> --- a/drivers/input/joystick/iforce/iforce-packets.c
> +++ b/drivers/input/joystick/iforce/iforce-packets.c
> @@ -155,6 +155,9 @@ void iforce_process_packet(struct iforce *iforce,
> switch (packet_id) {
>
> case 0x01: /* joystick position data */
> + if (len < 5)
> + break;
This is not enough. iforce_report_hats_buttons() is called
unconditionally and is referencing data[6].
If we add checks we need to cover all cases.
Thanks.
--
Dmitry
^ permalink raw reply
* Re: [PATCH 09/10] HID: steam: Reject short reads
From: Vicki Pfau @ 2026-07-07 2:48 UTC (permalink / raw)
To: Yousef Alhouseen; +Cc: jikos, bentiss, linux-input, syzbot+75f3f9bff8c510602d36
In-Reply-To: <CAMuQ4bVSA-Ca8RKaCeRASO=HJV=hkPDNOPyfdg6TZm7BQURnSA@mail.gmail.com>
Hi Yousef,
On 7/3/26 4:26 AM, Yousef Alhouseen wrote:
> Hi Vicki,
>
> I think the length comparison is reversed here.
You appear to be correct. Not sure how I messed htat up.
>
> hid_hw_raw_request() includes the report-ID byte in ret, while
> steam_recv_report() strips that byte before copying, so only ret - 1
> bytes are present in data. The encoded report body is data[1] + 2
> bytes (command, length, and payload). A short report therefore
> satisfies:
>
> ret - 1 < data[1] + 2
>
> or equivalently:
>
> ret < data[1] + 3>
> The current data[1] > ret + 2 test will miss the usual short-read
> cases. Also, when ret == 2, only data[0] was copied, so reading
> data[1] is itself uninitialized despite the ret >= 2 guard.
In theory you'd be correct, but in practice I've already cropped that byte off when doing the copy from buf into data, decreasing ret by 1 (if positive). Thus, both of those bounds are correct as 2 instead of 3. However, that decrement is based on a min(size, ret - 1), which means that if size is e.g. 3 but the reply is e.g. 5, overwriting ret will still appear as a short read. That is another bug in this code, but distinct. I'll fix that in v2.
>
> Perhaps the check could be structured as:
>
> if (ret > 0 && (ret < 3 || ret < data[1] + 3))
> return -EPROTO;
>
> with the diagnostic adjusted depending on whether the two-byte header
> was present.
>
> Thanks,
> Yousef
>
> On Thu, 2 Jul 2026 15:21:42 -0700, Vicki Pfau <vi@endrift.com> wrote:
>> Steam Controller FEATURE reports encode the size of the message in the
>> message itself. Previously we were trusting that the size reported matched
>> the size we actually read, leading to a potential issue with short reads.
>> Instead, we should actually verify the length of the read.
>>
>> Fixes: c164d6abf384 ("HID: add driver for Valve Steam Controller")
>> Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=75f3f9bff8c510602d36
>>
>> Signed-off-by: Vicki Pfau <vi@endrift.com>
>> ---
>> drivers/hid/hid-steam.c | 6 ++++++
>> 1 file changed, 6 insertions(+)
>>
>> diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
>> index 593151709cf1..e97431bc2828 100644
>> --- a/drivers/hid/hid-steam.c
>> +++ b/drivers/hid/hid-steam.c
>> @@ -389,6 +389,12 @@ static int steam_recv_report(struct steam_device *steam,
>> hid_err(steam->hdev, "%s: error %d\n", __func__, ret);
>> else
>> hid_dbg(steam->hdev, "Received report %*ph\n", ret, data);
>> +
>> + if (ret >= 2 && data[1] > ret + 2) {
>> + hid_err(steam->hdev, "%s: expected %u bytes, read %i\n",
>> + __func__, data[1] + 2, ret);
>> + return -EPROTO;
>> + }
>> return ret;
>> }
>>
>> --
>> 2.54.0
Vicki
^ permalink raw reply
* Re: [PATCH v2] HID: i2c-hid: Fixes "(null)" device name error logs in i2c_hid_parse
From: Doug Anderson @ 2026-07-07 2:32 UTC (permalink / raw)
To: Ai Chao
Cc: jikos, bentiss, treapking, kenkinming2002, raoxu, superm1,
linux-input, linux-kernel
In-Reply-To: <20260707015423.3944655-1-aichao@kylinos.cn>
Hi,
On Mon, Jul 6, 2026 at 6:54 PM Ai Chao <aichao@kylinos.cn> wrote:
>
> When i2c-hid fails to read the HID report descriptor during device
> initialization, the error message prints as:
>
> hid (null): reading report descriptor failed
>
> The HID device name is set in hid_add_device() after calling
> hdev->ll_driver->parse(), so when i2c_hid_parse() fails and calls
> hid_err(), the device name has not been set yet, resulting in "(null)"
> output.
>
> Use dev_err(&client->dev, ...) instead of hid_err(hid, ...) because
> the I2C client device is fully initialized with a proper name, providing
> meaningful error messages for debugging.
>
> Before: hid (null): reading report descriptor failed
> After: i2c_hid i2c-TPD0001:00: reading report descriptor failed
>
> Signed-off-by: Ai Chao <aichao@kylinos.cn>
> ---
> change for v2
> - Used Fixes tag.
Could have fooled me. ;-)
-Doug
^ permalink raw reply
* Re: [PATCH v5 0/6] gpiolib: fence off legacy interfaces
From: Dmitry Torokhov @ 2026-07-07 2:25 UTC (permalink / raw)
To: Arnd Bergmann
Cc: linux-gpio, Arnd Bergmann, John Paul Adrian Glaubitz,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
H. Peter Anvin, Linus Walleij, Bartosz Golaszewski, Lee Jones,
Pavel Machek, linux-sh, linux-kernel, linux-input, linux-leds
In-Reply-To: <20260629130329.1291953-1-arnd@kernel.org>
On Mon, Jun 29, 2026 at 03:03:23PM +0200, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@arndb.de>
>
> This is the remainder of the series previously posted as v2
> in [1]. I've changed the version to v5 for all patches to
> not confuse b4 too much, but the patches are mostly unchanged.
>
> The patch "Input: soc_button_array - select CONFIG_GPIOLIB_LEGACY"
> was not part of the series last time, but the build bots reported
> this as a regression since I had dropped that since v1.
>
> I hope that all that remains now can just get merged through the
> gpio tree. The gpio-keys patch needs a bit coordination with
> another patch addressing the same issue that is already in
> flight, so I expect that I'll rebase my series once more when
> that is in a stable branch, but the state I have here should
> just work as-is on top of v7.2-rc1.
>
> Arnd
>
> [1] https://lore.kernel.org/all/20260520183815.2510387-1-arnd@kernel.org/
>
> Arnd Bergmann (6):
> [v5] sh: select legacy gpiolib interface
> [v5] x86/olpc: select GPIOLIB_LEGACY
> [v5] Input: soc_button_array - select CONFIG_GPIOLIB_LEGACY
> [v5] Input: gpio-keys: make legacy gpiolib optional
> [v5] leds: gpio: make legacy gpiolib interface optional
> [v5] gpiolib: turn off legacy interface by default
>
> arch/sh/Kconfig | 1 +
> arch/sh/boards/Kconfig | 8 ++++
> arch/sh/boards/mach-highlander/Kconfig | 1 +
> arch/sh/boards/mach-rsk/Kconfig | 3 ++
> arch/x86/Kconfig | 1 +
> arch/x86/platform/olpc/olpc-xo1-sci.c | 2 +-
> drivers/gpio/Kconfig | 9 +++-
> drivers/input/keyboard/gpio_keys.c | 9 ++--
> drivers/input/keyboard/gpio_keys_polled.c | 4 +-
> drivers/input/misc/Kconfig | 3 ++
> drivers/input/misc/soc_button_array.c | 2 +-
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> # for input
Could this be done as an immutable branch?
Thanks.
--
Dmitry
^ permalink raw reply
* [PATCH v2] HID: i2c-hid: Fixes "(null)" device name error logs in i2c_hid_parse
From: Ai Chao @ 2026-07-07 1:54 UTC (permalink / raw)
To: jikos, bentiss, dianders, treapking, kenkinming2002, raoxu,
superm1
Cc: linux-input, linux-kernel, Ai Chao
When i2c-hid fails to read the HID report descriptor during device
initialization, the error message prints as:
hid (null): reading report descriptor failed
The HID device name is set in hid_add_device() after calling
hdev->ll_driver->parse(), so when i2c_hid_parse() fails and calls
hid_err(), the device name has not been set yet, resulting in "(null)"
output.
Use dev_err(&client->dev, ...) instead of hid_err(hid, ...) because
the I2C client device is fully initialized with a proper name, providing
meaningful error messages for debugging.
Before: hid (null): reading report descriptor failed
After: i2c_hid i2c-TPD0001:00: reading report descriptor failed
Signed-off-by: Ai Chao <aichao@kylinos.cn>
---
change for v2
- Used Fixes tag.
---
drivers/hid/i2c-hid/i2c-hid-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 3adb16366e93..0e725a0f0abe 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -792,7 +792,7 @@ static int i2c_hid_parse(struct hid_device *hid)
ihid->hdesc.wReportDescRegister,
rdesc, rsize);
if (ret) {
- hid_err(hid, "reading report descriptor failed\n");
+ dev_err(&client->dev, "reading report descriptor failed\n");
goto out;
}
}
--
2.34.1
^ permalink raw reply related
* Re: (subset) [PATCH v2 0/2] Introduce OnePlus 6/6T touchscreen compatible
From: Bjorn Andersson @ 2026-07-07 1:27 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Jason A. Donenfeld, Matthias Schiffer, Vincent Huang,
Konrad Dybcio, David Heidelberg
Cc: linux-input, devicetree, linux-kernel, linux-arm-msm, phone-devel,
Krzysztof Kozlowski, Konrad Dybcio
In-Reply-To: <20260523-synaptics-rmi4-dt-v2-0-0645122babdc@ixit.cz>
On Sat, 23 May 2026 11:45:33 +0200, David Heidelberg wrote:
> Mostly related to the
> https://codeberg.org/sdm845/linux/commits/branch/b4/synaptics-rmi4
> series, but independent on other changes which I trying to upstream for
> more than one year.
>
>
Applied, thanks!
[2/2] arm64: dts: qcom: sdm845-oneplus: Update compatible to include model
commit: cc8748ed4da16233d5b3f27e86a412a991645aed
Best regards,
--
Bjorn Andersson <andersson@kernel.org>
^ permalink raw reply
* Re: [PATCH v3 0/2] HID: iio: warning clean up and prefer kernel coding style
From: Andy Shevchenko @ 2026-07-06 21:16 UTC (permalink / raw)
To: sanjayembeddedse
Cc: Jiri Kosina, Jonathan Cameron, Srinivas Pandruvada, David Lechner,
Nuno Sá, Andy Shevchenko, linux-input, linux-iio,
linux-kernel, Maxwell Doose
In-Reply-To: <20260707-15-jun-hid-iio-alignment-v3-0-8791574ad0fe@gmail.com>
On Tue, Jul 07, 2026 at 12:29:42AM +0530, Sanjay Chitroda via B4 Relay wrote:
> This series updates HID sensor IIO drivers to address checkpatch
> warnings, improves readability and compliance with kernel coding style.
>
> The changes are:
> - replacing explicit NULL comparisons with implicit pointer checks;
> - adjusting indentation and alignment;
> - reformatting multi-line function declarations for improved
> readability and consistency.
>
> While updating alignment and line wrapping, function parameters are
> grouped more logically and common callback signatures are formatted
> consistently across HID sensor IIO drivers.
>
> Testing:
> - Compiled with W=1 for each patch in the series
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* [PATCH v3 1/2] iio: hid-sensors: align function parenthesis for readability
From: Sanjay Chitroda via B4 Relay @ 2026-07-06 18:59 UTC (permalink / raw)
To: Jiri Kosina, Jonathan Cameron, Srinivas Pandruvada, David Lechner,
Nuno Sá, Andy Shevchenko
Cc: linux-input, linux-iio, linux-kernel, Sanjay Chitroda
In-Reply-To: <20260707-15-jun-hid-iio-alignment-v3-0-8791574ad0fe@gmail.com>
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Adjust alignment of parentheses across HID sensor IIO drivers to
improve readability and maintain consistency with kernel coding style.
While updating the formatting, group related arguments consistently in
multi-line function signatures where appropriate.
No functional change intended.
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
---
drivers/iio/accel/hid-sensor-accel-3d.c | 46 ++++++-------
.../iio/common/hid-sensors/hid-sensor-attributes.c | 80 +++++++++++-----------
.../iio/common/hid-sensors/hid-sensor-trigger.c | 2 +-
.../iio/common/hid-sensors/hid-sensor-trigger.h | 2 +-
drivers/iio/gyro/hid-sensor-gyro-3d.c | 35 ++++------
drivers/iio/humidity/hid-sensor-humidity.c | 33 ++++-----
drivers/iio/light/hid-sensor-als.c | 32 ++++-----
drivers/iio/light/hid-sensor-prox.c | 29 ++++----
drivers/iio/magnetometer/hid-sensor-magn-3d.c | 49 ++++++-------
drivers/iio/orientation/hid-sensor-incl-3d.c | 31 ++++-----
drivers/iio/orientation/hid-sensor-rotation.c | 24 +++----
.../iio/position/hid-sensor-custom-intel-hinge.c | 13 ++--
drivers/iio/pressure/hid-sensor-press.c | 35 ++++------
drivers/iio/temperature/hid-sensor-temperature.c | 30 ++++----
14 files changed, 202 insertions(+), 239 deletions(-)
diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
index 12481cfe9800..3986a0bdaf44 100644
--- a/drivers/iio/accel/hid-sensor-accel-3d.c
+++ b/drivers/iio/accel/hid-sensor-accel-3d.c
@@ -122,9 +122,8 @@ static const struct iio_chan_spec gravity_channels[] = {
/* Channel read_raw handler */
static int accel_3d_read_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int *val, int *val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int *val, int *val2, long mask)
{
struct accel_3d_state *accel_state = iio_priv(indio_dev);
int report_id = -1;
@@ -151,7 +150,7 @@ static int accel_3d_read_raw(struct iio_dev *indio_dev,
else {
*val = 0;
hid_sensor_power_state(&accel_state->common_attributes,
- false);
+ false);
return -EINVAL;
}
hid_sensor_power_state(&accel_state->common_attributes, false);
@@ -184,10 +183,8 @@ static int accel_3d_read_raw(struct iio_dev *indio_dev,
/* Channel write_raw handler */
static int accel_3d_write_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int val,
- int val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int val, int val2, long mask)
{
struct accel_3d_state *accel_state = iio_priv(indio_dev);
int ret = 0;
@@ -223,8 +220,7 @@ static void hid_sensor_push_data(struct iio_dev *indio_dev, void *data,
/* Callback handler to send event after all samples are received and captured */
static int accel_3d_proc_event(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- void *priv)
+ u32 usage_id, void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct accel_3d_state *accel_state = iio_priv(indio_dev);
@@ -247,9 +243,9 @@ static int accel_3d_proc_event(struct hid_sensor_hub_device *hsdev,
/* Capture samples in local storage */
static int accel_3d_capture_sample(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- size_t raw_len, char *raw_data,
- void *priv)
+ u32 usage_id,
+ size_t raw_len, char *raw_data,
+ void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct accel_3d_state *accel_state = iio_priv(indio_dev);
@@ -281,10 +277,10 @@ static int accel_3d_capture_sample(struct hid_sensor_hub_device *hsdev,
/* Parse report which is specific to an usage id*/
static int accel_3d_parse_report(struct platform_device *pdev,
- struct hid_sensor_hub_device *hsdev,
- struct iio_chan_spec *channels,
- u32 usage_id,
- struct accel_3d_state *st)
+ struct hid_sensor_hub_device *hsdev,
+ struct iio_chan_spec *channels,
+ u32 usage_id,
+ struct accel_3d_state *st)
{
int ret;
@@ -303,10 +299,10 @@ static int accel_3d_parse_report(struct platform_device *pdev,
};
}
dev_dbg(&pdev->dev, "accel_3d %x:%x, %x:%x, %x:%x\n",
- st->accel[0].index,
- st->accel[0].report_id,
- st->accel[1].index, st->accel[1].report_id,
- st->accel[2].index, st->accel[2].report_id);
+ st->accel[0].index,
+ st->accel[0].report_id,
+ st->accel[1].index, st->accel[1].report_id,
+ st->accel[2].index, st->accel[2].report_id);
st->scale_precision = hid_sensor_format_scale(
hsdev->usage,
@@ -366,8 +362,8 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
return -ENOMEM;
}
ret = accel_3d_parse_report(pdev, hsdev,
- (struct iio_chan_spec *)indio_dev->channels,
- hsdev->usage, accel_state);
+ (struct iio_chan_spec *)indio_dev->channels,
+ hsdev->usage, accel_state);
if (ret) {
dev_err(&pdev->dev, "failed to setup attributes\n");
return ret;
@@ -380,7 +376,7 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
atomic_set(&accel_state->common_attributes.data_ready, 0);
ret = hid_sensor_setup_trigger(indio_dev, name,
- &accel_state->common_attributes);
+ &accel_state->common_attributes);
if (ret < 0) {
dev_err(&pdev->dev, "trigger setup failed\n");
return ret;
@@ -390,7 +386,7 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
accel_state->callbacks.capture_sample = accel_3d_capture_sample;
accel_state->callbacks.pdev = pdev;
ret = sensor_hub_register_callback(hsdev, hsdev->usage,
- &accel_state->callbacks);
+ &accel_state->callbacks);
if (ret < 0) {
dev_err(&pdev->dev, "callback reg failed\n");
goto error_remove_trigger;
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
index 2f0a1ea42f48..9e7c26e37880 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
@@ -72,8 +72,7 @@ static const struct {
{HID_USAGE_SENSOR_HUMAN_ATTENTION, 0, 1, 0},
};
-static void simple_div(int dividend, int divisor, int *whole,
- int *micro_frac)
+static void simple_div(int dividend, int divisor, int *whole, int *micro_frac)
{
int rem;
int exp = 0;
@@ -111,7 +110,7 @@ for 10^-2.
Negative numbers are 2's complement
*/
static void convert_from_vtf_format(u32 value, int size, int exp,
- int *val1, int *val2)
+ int *val1, int *val2)
{
int sign = 1;
@@ -176,7 +175,7 @@ s32 hid_sensor_read_poll_value(struct hid_sensor_common *st)
EXPORT_SYMBOL_NS(hid_sensor_read_poll_value, "IIO_HID_ATTRIBUTES");
int hid_sensor_read_samp_freq_value(struct hid_sensor_common *st,
- int *val1, int *val2)
+ int *val1, int *val2)
{
s32 value;
int ret;
@@ -203,7 +202,7 @@ int hid_sensor_read_samp_freq_value(struct hid_sensor_common *st,
EXPORT_SYMBOL_NS(hid_sensor_read_samp_freq_value, "IIO_HID");
int hid_sensor_write_samp_freq_value(struct hid_sensor_common *st,
- int val1, int val2)
+ int val1, int val2)
{
s32 value;
int ret;
@@ -238,15 +237,15 @@ int hid_sensor_write_samp_freq_value(struct hid_sensor_common *st,
EXPORT_SYMBOL_NS(hid_sensor_write_samp_freq_value, "IIO_HID");
int hid_sensor_read_raw_hyst_value(struct hid_sensor_common *st,
- int *val1, int *val2)
+ int *val1, int *val2)
{
s32 value;
int ret;
ret = sensor_hub_get_feature(st->hsdev,
st->sensitivity.report_id,
- st->sensitivity.index, sizeof(value),
- &value);
+ st->sensitivity.index,
+ sizeof(value), &value);
if (ret < 0 || value < 0) {
*val1 = *val2 = 0;
return -EINVAL;
@@ -268,8 +267,8 @@ int hid_sensor_read_raw_hyst_rel_value(struct hid_sensor_common *st, int *val1,
ret = sensor_hub_get_feature(st->hsdev,
st->sensitivity_rel.report_id,
- st->sensitivity_rel.index, sizeof(value),
- &value);
+ st->sensitivity_rel.index,
+ sizeof(value), &value);
if (ret < 0 || value < 0) {
*val1 = *val2 = 0;
return -EINVAL;
@@ -283,7 +282,7 @@ int hid_sensor_read_raw_hyst_rel_value(struct hid_sensor_common *st, int *val1,
EXPORT_SYMBOL_NS(hid_sensor_read_raw_hyst_rel_value, "IIO_HID");
int hid_sensor_write_raw_hyst_value(struct hid_sensor_common *st,
- int val1, int val2)
+ int val1, int val2)
{
s32 value;
int ret;
@@ -292,8 +291,8 @@ int hid_sensor_write_raw_hyst_value(struct hid_sensor_common *st,
return -EINVAL;
value = convert_to_vtf_format(st->sensitivity.size,
- st->sensitivity.unit_expo,
- val1, val2);
+ st->sensitivity.unit_expo,
+ val1, val2);
ret = sensor_hub_set_feature(st->hsdev, st->sensitivity.report_id,
st->sensitivity.index, sizeof(value),
&value);
@@ -302,8 +301,8 @@ int hid_sensor_write_raw_hyst_value(struct hid_sensor_common *st,
ret = sensor_hub_get_feature(st->hsdev,
st->sensitivity.report_id,
- st->sensitivity.index, sizeof(value),
- &value);
+ st->sensitivity.index,
+ sizeof(value), &value);
if (ret < 0 || value < 0)
return -EINVAL;
@@ -323,8 +322,8 @@ int hid_sensor_write_raw_hyst_rel_value(struct hid_sensor_common *st,
return -EINVAL;
value = convert_to_vtf_format(st->sensitivity_rel.size,
- st->sensitivity_rel.unit_expo,
- val1, val2);
+ st->sensitivity_rel.unit_expo,
+ val1, val2);
ret = sensor_hub_set_feature(st->hsdev, st->sensitivity_rel.report_id,
st->sensitivity_rel.index, sizeof(value),
&value);
@@ -333,8 +332,8 @@ int hid_sensor_write_raw_hyst_rel_value(struct hid_sensor_common *st,
ret = sensor_hub_get_feature(st->hsdev,
st->sensitivity_rel.report_id,
- st->sensitivity_rel.index, sizeof(value),
- &value);
+ st->sensitivity_rel.index,
+ sizeof(value), &value);
if (ret < 0 || value < 0)
return -EINVAL;
@@ -355,8 +354,8 @@ EXPORT_SYMBOL_NS(hid_sensor_write_raw_hyst_rel_value, "IIO_HID");
* 1.001745329 ->exp:4-> val0[10017]val1[453290000]
* 9.806650000 ->exp:-2-> val0[0]val1[98066500]
*/
-static void adjust_exponent_nano(int *val0, int *val1, int scale0,
- int scale1, int exp)
+static void adjust_exponent_nano(int *val0, int *val1,
+ int scale0, int scale1, int exp)
{
int divisor;
int i;
@@ -403,8 +402,8 @@ static void adjust_exponent_nano(int *val0, int *val1, int scale0,
}
int hid_sensor_format_scale(u32 usage_id,
- struct hid_sensor_hub_attribute_info *attr_info,
- int *val0, int *val1)
+ struct hid_sensor_hub_attribute_info *attr_info,
+ int *val0, int *val1)
{
int i;
int exp;
@@ -414,12 +413,11 @@ int hid_sensor_format_scale(u32 usage_id,
for (i = 0; i < ARRAY_SIZE(unit_conversion); ++i) {
if (unit_conversion[i].usage_id == usage_id &&
- unit_conversion[i].unit == attr_info->units) {
- exp = hid_sensor_convert_exponent(
- attr_info->unit_expo);
+ unit_conversion[i].unit == attr_info->units) {
+ exp = hid_sensor_convert_exponent(attr_info->unit_expo);
adjust_exponent_nano(val0, val1,
- unit_conversion[i].scale_val0,
- unit_conversion[i].scale_val1, exp);
+ unit_conversion[i].scale_val0,
+ unit_conversion[i].scale_val1, exp);
break;
}
}
@@ -437,8 +435,8 @@ EXPORT_SYMBOL_NS(hid_sensor_convert_timestamp, "IIO_HID");
static
int hid_sensor_get_reporting_interval(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- struct hid_sensor_common *st)
+ u32 usage_id,
+ struct hid_sensor_common *st)
{
sensor_hub_input_get_attribute_info(hsdev,
HID_FEATURE_REPORT, usage_id,
@@ -472,9 +470,10 @@ int hid_sensor_get_report_latency(struct hid_sensor_common *st)
int ret;
int value;
- ret = sensor_hub_get_feature(st->hsdev, st->report_latency.report_id,
- st->report_latency.index, sizeof(value),
- &value);
+ ret = sensor_hub_get_feature(st->hsdev,
+ st->report_latency.report_id,
+ st->report_latency.index,
+ sizeof(value), &value);
if (ret < 0)
return ret;
@@ -497,10 +496,10 @@ bool hid_sensor_batch_mode_supported(struct hid_sensor_common *st)
EXPORT_SYMBOL_NS(hid_sensor_batch_mode_supported, "IIO_HID_ATTRIBUTES");
int hid_sensor_parse_common_attributes(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- struct hid_sensor_common *st,
- const u32 *sensitivity_addresses,
- u32 sensitivity_addresses_len)
+ u32 usage_id,
+ struct hid_sensor_common *st,
+ const u32 *sensitivity_addresses,
+ u32 sensitivity_addresses_len)
{
struct hid_sensor_hub_attribute_info timestamp;
@@ -526,7 +525,7 @@ int hid_sensor_parse_common_attributes(struct hid_sensor_hub_device *hsdev,
sensor_hub_input_get_attribute_info(hsdev,
HID_FEATURE_REPORT, usage_id,
HID_USAGE_SENSOR_PROP_SENSITIVITY_ABS,
- &st->sensitivity);
+ &st->sensitivity);
sensor_hub_input_get_attribute_info(hsdev,
HID_FEATURE_REPORT, usage_id,
@@ -577,8 +576,9 @@ int hid_sensor_parse_common_attributes(struct hid_sensor_hub_device *hsdev,
timestamp.index, timestamp.report_id);
ret = sensor_hub_get_feature(hsdev,
- st->power_state.report_id,
- st->power_state.index, sizeof(value), &value);
+ st->power_state.report_id,
+ st->power_state.index,
+ sizeof(value), &value);
if (ret < 0)
return ret;
if (value < 0)
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index c8ccf96f3d03..fffaebe8c7f0 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -233,7 +233,7 @@ void hid_sensor_remove_trigger(struct iio_dev *indio_dev,
EXPORT_SYMBOL_NS(hid_sensor_remove_trigger, "IIO_HID");
int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name,
- struct hid_sensor_common *attrb)
+ struct hid_sensor_common *attrb)
{
const struct iio_dev_attr **fifo_attrs;
int ret;
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.h b/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
index f94fca4f1edf..589de858e369 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
@@ -15,7 +15,7 @@ struct iio_dev;
extern const struct dev_pm_ops hid_sensor_pm_ops;
int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name,
- struct hid_sensor_common *attrb);
+ struct hid_sensor_common *attrb);
void hid_sensor_remove_trigger(struct iio_dev *indio_dev,
struct hid_sensor_common *attrb);
int hid_sensor_power_state(struct hid_sensor_common *st, bool state);
diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c
index c8130b488f10..34ab18fffc31 100644
--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c
+++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c
@@ -85,9 +85,8 @@ static const struct iio_chan_spec gyro_3d_channels[] = {
/* Channel read_raw handler */
static int gyro_3d_read_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int *val, int *val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int *val, int *val2, long mask)
{
struct gyro_3d_state *gyro_state = iio_priv(indio_dev);
int report_id = -1;
@@ -112,8 +111,7 @@ static int gyro_3d_read_raw(struct iio_dev *indio_dev,
min < 0);
else {
*val = 0;
- hid_sensor_power_state(&gyro_state->common_attributes,
- false);
+ hid_sensor_power_state(&gyro_state->common_attributes, false);
return -EINVAL;
}
hid_sensor_power_state(&gyro_state->common_attributes, false);
@@ -146,10 +144,8 @@ static int gyro_3d_read_raw(struct iio_dev *indio_dev,
/* Channel write_raw handler */
static int gyro_3d_write_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int val,
- int val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int val, int val2, long mask)
{
struct gyro_3d_state *gyro_state = iio_priv(indio_dev);
int ret = 0;
@@ -177,8 +173,7 @@ static const struct iio_info gyro_3d_info = {
/* Callback handler to send event after all samples are received and captured */
static int gyro_3d_proc_event(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- void *priv)
+ u32 usage_id, void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct gyro_3d_state *gyro_state = iio_priv(indio_dev);
@@ -199,9 +194,9 @@ static int gyro_3d_proc_event(struct hid_sensor_hub_device *hsdev,
/* Capture samples in local storage */
static int gyro_3d_capture_sample(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- size_t raw_len, char *raw_data,
- void *priv)
+ u32 usage_id,
+ size_t raw_len, char *raw_data,
+ void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct gyro_3d_state *gyro_state = iio_priv(indio_dev);
@@ -254,10 +249,10 @@ static int gyro_3d_parse_report(struct platform_device *pdev,
};
}
dev_dbg(&pdev->dev, "gyro_3d %x:%x, %x:%x, %x:%x\n",
- st->gyro[0].index,
- st->gyro[0].report_id,
- st->gyro[1].index, st->gyro[1].report_id,
- st->gyro[2].index, st->gyro[2].report_id);
+ st->gyro[0].index,
+ st->gyro[0].report_id,
+ st->gyro[1].index, st->gyro[1].report_id,
+ st->gyro[2].index, st->gyro[2].report_id);
st->scale_precision = hid_sensor_format_scale(
HID_USAGE_SENSOR_GYRO_3D,
@@ -318,7 +313,7 @@ static int hid_gyro_3d_probe(struct platform_device *pdev)
atomic_set(&gyro_state->common_attributes.data_ready, 0);
ret = hid_sensor_setup_trigger(indio_dev, name,
- &gyro_state->common_attributes);
+ &gyro_state->common_attributes);
if (ret < 0) {
dev_err(&pdev->dev, "trigger setup failed\n");
return ret;
@@ -328,7 +323,7 @@ static int hid_gyro_3d_probe(struct platform_device *pdev)
gyro_state->callbacks.capture_sample = gyro_3d_capture_sample;
gyro_state->callbacks.pdev = pdev;
ret = sensor_hub_register_callback(hsdev, HID_USAGE_SENSOR_GYRO_3D,
- &gyro_state->callbacks);
+ &gyro_state->callbacks);
if (ret < 0) {
dev_err(&pdev->dev, "callback reg failed\n");
goto error_remove_trigger;
diff --git a/drivers/iio/humidity/hid-sensor-humidity.c b/drivers/iio/humidity/hid-sensor-humidity.c
index 1d4612a471db..4338147e3641 100644
--- a/drivers/iio/humidity/hid-sensor-humidity.c
+++ b/drivers/iio/humidity/hid-sensor-humidity.c
@@ -45,7 +45,7 @@ static const struct iio_chan_spec humidity_channels[] = {
/* Adjust channel real bits based on report descriptor */
static void humidity_adjust_channel_bit_mask(struct iio_chan_spec *channels,
- int channel, int size)
+ int channel, int size)
{
channels[channel].scan_type.sign = 's';
/* Real storage bits will change based on the report desc. */
@@ -55,8 +55,8 @@ static void humidity_adjust_channel_bit_mask(struct iio_chan_spec *channels,
}
static int humidity_read_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int *val, int *val2, long mask)
+ struct iio_chan_spec const *chan,
+ int *val, int *val2, long mask)
{
struct hid_humidity_state *humid_st = iio_priv(indio_dev);
@@ -101,8 +101,8 @@ static int humidity_read_raw(struct iio_dev *indio_dev,
}
static int humidity_write_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int val, int val2, long mask)
+ struct iio_chan_spec const *chan,
+ int val, int val2, long mask)
{
struct hid_humidity_state *humid_st = iio_priv(indio_dev);
@@ -127,7 +127,7 @@ static const struct iio_info humidity_info = {
/* Callback handler to send event after all samples are received and captured */
static int humidity_proc_event(struct hid_sensor_hub_device *hsdev,
- u32 usage_id, void *pdev)
+ u32 usage_id, void *pdev)
{
struct iio_dev *indio_dev = platform_get_drvdata(pdev);
struct hid_humidity_state *humid_st = iio_priv(indio_dev);
@@ -141,8 +141,9 @@ static int humidity_proc_event(struct hid_sensor_hub_device *hsdev,
/* Capture samples in local storage */
static int humidity_capture_sample(struct hid_sensor_hub_device *hsdev,
- u32 usage_id, size_t raw_len,
- char *raw_data, void *pdev)
+ u32 usage_id,
+ size_t raw_len, char *raw_data,
+ void *pdev)
{
struct iio_dev *indio_dev = platform_get_drvdata(pdev);
struct hid_humidity_state *humid_st = iio_priv(indio_dev);
@@ -159,10 +160,10 @@ static int humidity_capture_sample(struct hid_sensor_hub_device *hsdev,
/* Parse report which is specific to an usage id */
static int humidity_parse_report(struct platform_device *pdev,
- struct hid_sensor_hub_device *hsdev,
- struct iio_chan_spec *channels,
- u32 usage_id,
- struct hid_humidity_state *st)
+ struct hid_sensor_hub_device *hsdev,
+ struct iio_chan_spec *channels,
+ u32 usage_id,
+ struct hid_humidity_state *st)
{
int ret;
@@ -216,12 +217,12 @@ static int hid_humidity_probe(struct platform_device *pdev)
return ret;
humid_chans = devm_kmemdup(&pdev->dev, humidity_channels,
- sizeof(humidity_channels), GFP_KERNEL);
+ sizeof(humidity_channels), GFP_KERNEL);
if (!humid_chans)
return -ENOMEM;
ret = humidity_parse_report(pdev, hsdev, humid_chans,
- HID_USAGE_SENSOR_HUMIDITY, humid_st);
+ HID_USAGE_SENSOR_HUMIDITY, humid_st);
if (ret)
return ret;
@@ -234,7 +235,7 @@ static int hid_humidity_probe(struct platform_device *pdev)
atomic_set(&humid_st->common_attributes.data_ready, 0);
ret = hid_sensor_setup_trigger(indio_dev, name,
- &humid_st->common_attributes);
+ &humid_st->common_attributes);
if (ret)
return ret;
@@ -242,7 +243,7 @@ static int hid_humidity_probe(struct platform_device *pdev)
humidity_callbacks.pdev = pdev;
ret = sensor_hub_register_callback(hsdev, HID_USAGE_SENSOR_HUMIDITY,
- &humidity_callbacks);
+ &humidity_callbacks);
if (ret)
goto error_remove_trigger;
diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
index 823bb56b9873..666788285255 100644
--- a/drivers/iio/light/hid-sensor-als.c
+++ b/drivers/iio/light/hid-sensor-als.c
@@ -120,9 +120,8 @@ static const struct iio_chan_spec als_channels[] = {
/* Channel read_raw handler */
static int als_read_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int *val, int *val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int *val, int *val2, long mask)
{
struct als_state *als_state = iio_priv(indio_dev);
struct hid_sensor_hub_device *hsdev = als_state->common_attributes.hsdev;
@@ -163,12 +162,12 @@ static int als_read_raw(struct iio_dev *indio_dev,
}
if (report_id >= 0) {
hid_sensor_power_state(&als_state->common_attributes,
- true);
+ true);
*val = sensor_hub_input_attr_get_raw_value(
hsdev, hsdev->usage, address, report_id,
SENSOR_HUB_SYNC, min < 0);
hid_sensor_power_state(&als_state->common_attributes,
- false);
+ false);
} else {
*val = 0;
return -EINVAL;
@@ -206,10 +205,8 @@ static int als_read_raw(struct iio_dev *indio_dev,
/* Channel write_raw handler */
static int als_write_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int val,
- int val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int val, int val2, long mask)
{
struct als_state *als_state = iio_priv(indio_dev);
int ret = 0;
@@ -241,8 +238,7 @@ static const struct iio_info als_info = {
/* Callback handler to send event after all samples are received and captured */
static int als_proc_event(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- void *priv)
+ u32 usage_id, void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct als_state *als_state = iio_priv(indio_dev);
@@ -263,9 +259,9 @@ static int als_proc_event(struct hid_sensor_hub_device *hsdev,
/* Capture samples in local storage */
static int als_capture_sample(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- size_t raw_len, char *raw_data,
- void *priv)
+ u32 usage_id,
+ size_t raw_len, char *raw_data,
+ void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct als_state *als_state = iio_priv(indio_dev);
@@ -304,9 +300,9 @@ static int als_capture_sample(struct hid_sensor_hub_device *hsdev,
/* Parse report which is specific to an usage id*/
static int als_parse_report(struct platform_device *pdev,
- struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- struct als_state *st)
+ struct hid_sensor_hub_device *hsdev,
+ u32 usage_id,
+ struct als_state *st)
{
struct iio_chan_spec *channels;
int ret, index = 0;
@@ -400,7 +396,7 @@ static int hid_als_probe(struct platform_device *pdev)
atomic_set(&als_state->common_attributes.data_ready, 0);
ret = hid_sensor_setup_trigger(indio_dev, name,
- &als_state->common_attributes);
+ &als_state->common_attributes);
if (ret < 0) {
dev_err(&pdev->dev, "trigger setup failed\n");
return ret;
diff --git a/drivers/iio/light/hid-sensor-prox.c b/drivers/iio/light/hid-sensor-prox.c
index 11609dc4c5dc..7541947f931c 100644
--- a/drivers/iio/light/hid-sensor-prox.c
+++ b/drivers/iio/light/hid-sensor-prox.c
@@ -70,9 +70,8 @@ static const struct iio_chan_spec prox_channels[] = {
/* Channel read_raw handler */
static int prox_read_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int *val, int *val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int *val, int *val2, long mask)
{
struct prox_state *prox_state = iio_priv(indio_dev);
struct hid_sensor_hub_device *hsdev;
@@ -135,10 +134,8 @@ static int prox_read_raw(struct iio_dev *indio_dev,
/* Channel write_raw handler */
static int prox_write_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int val,
- int val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int val, int val2, long mask)
{
struct prox_state *prox_state = iio_priv(indio_dev);
int ret = 0;
@@ -166,8 +163,7 @@ static const struct iio_info prox_info = {
/* Callback handler to send event after all samples are received and captured */
static int prox_proc_event(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- void *priv)
+ u32 usage_id, void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct prox_state *prox_state = iio_priv(indio_dev);
@@ -183,9 +179,9 @@ static int prox_proc_event(struct hid_sensor_hub_device *hsdev,
/* Capture samples in local storage */
static int prox_capture_sample(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- size_t raw_len, char *raw_data,
- void *priv)
+ u32 usage_id,
+ size_t raw_len, char *raw_data,
+ void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct prox_state *prox_state = iio_priv(indio_dev);
@@ -218,8 +214,8 @@ static int prox_capture_sample(struct hid_sensor_hub_device *hsdev,
/* Parse report which is specific to an usage id*/
static int prox_parse_report(struct platform_device *pdev,
- struct hid_sensor_hub_device *hsdev,
- struct prox_state *st)
+ struct hid_sensor_hub_device *hsdev,
+ struct prox_state *st)
{
struct iio_chan_spec *channels = st->channels;
int index = 0;
@@ -271,8 +267,7 @@ static int hid_prox_probe(struct platform_device *pdev)
struct iio_dev *indio_dev;
struct prox_state *prox_state;
- indio_dev = devm_iio_device_alloc(&pdev->dev,
- sizeof(struct prox_state));
+ indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(struct prox_state));
if (!indio_dev)
return -ENOMEM;
platform_set_drvdata(pdev, indio_dev);
@@ -306,7 +301,7 @@ static int hid_prox_probe(struct platform_device *pdev)
atomic_set(&prox_state->common_attributes.data_ready, 0);
ret = hid_sensor_setup_trigger(indio_dev, name,
- &prox_state->common_attributes);
+ &prox_state->common_attributes);
if (ret) {
dev_err(&pdev->dev, "trigger setup failed\n");
return ret;
diff --git a/drivers/iio/magnetometer/hid-sensor-magn-3d.c b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
index acae77273bd5..6c95ce84067d 100644
--- a/drivers/iio/magnetometer/hid-sensor-magn-3d.c
+++ b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
@@ -135,9 +135,8 @@ static const struct iio_chan_spec magn_3d_channels[] = {
/* Channel read_raw handler */
static int magn_3d_read_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int *val, int *val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int *val, int *val2, long mask)
{
struct magn_3d_state *magn_state = iio_priv(indio_dev);
int report_id = -1;
@@ -167,8 +166,7 @@ static int magn_3d_read_raw(struct iio_dev *indio_dev,
false);
return -EINVAL;
}
- hid_sensor_power_state(&magn_state->magn_flux_attributes,
- false);
+ hid_sensor_power_state(&magn_state->magn_flux_attributes, false);
ret_type = IIO_VAL_INT;
break;
case IIO_CHAN_INFO_SCALE:
@@ -229,10 +227,8 @@ static int magn_3d_read_raw(struct iio_dev *indio_dev,
/* Channel write_raw handler */
static int magn_3d_write_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int val,
- int val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int val, int val2, long mask)
{
struct magn_3d_state *magn_state = iio_priv(indio_dev);
int ret = 0;
@@ -270,8 +266,7 @@ static const struct iio_info magn_3d_info = {
/* Callback handler to send event after all samples are received and captured */
static int magn_3d_proc_event(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- void *priv)
+ u32 usage_id, void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct magn_3d_state *magn_state = iio_priv(indio_dev);
@@ -292,9 +287,9 @@ static int magn_3d_proc_event(struct hid_sensor_hub_device *hsdev,
/* Capture samples in local storage */
static int magn_3d_capture_sample(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- size_t raw_len, char *raw_data,
- void *priv)
+ u32 usage_id,
+ size_t raw_len, char *raw_data,
+ void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct magn_3d_state *magn_state = iio_priv(indio_dev);
@@ -368,18 +363,17 @@ static int magn_3d_parse_report(struct platform_device *pdev,
return -EINVAL;
}
- dev_dbg(&pdev->dev, "magn_3d Found %d usage attributes\n",
- attr_count);
+ dev_dbg(&pdev->dev, "magn_3d Found %d usage attributes\n", attr_count);
dev_dbg(&pdev->dev, "magn_3d X: %x:%x Y: %x:%x Z: %x:%x\n",
- st->magn[0].index,
- st->magn[0].report_id,
- st->magn[1].index, st->magn[1].report_id,
- st->magn[2].index, st->magn[2].report_id);
+ st->magn[0].index,
+ st->magn[0].report_id,
+ st->magn[1].index, st->magn[1].report_id,
+ st->magn[2].index, st->magn[2].report_id);
/* Setup IIO channel array */
_channels = devm_kcalloc(&pdev->dev, attr_count,
- sizeof(struct iio_chan_spec),
- GFP_KERNEL);
+ sizeof(struct iio_chan_spec),
+ GFP_KERNEL);
if (!_channels) {
dev_err(&pdev->dev,
"failed to allocate space for iio channels\n");
@@ -426,8 +420,7 @@ static int magn_3d_parse_report(struct platform_device *pdev,
*channels = _channels;
- dev_dbg(&pdev->dev, "magn_3d Setup %d IIO channels\n",
- *chan_count);
+ dev_dbg(&pdev->dev, "magn_3d Setup %d IIO channels\n", *chan_count);
st->magn_flux_attr.scale_precision = hid_sensor_format_scale(
HID_USAGE_SENSOR_COMPASS_3D,
@@ -491,8 +484,8 @@ static int hid_magn_3d_probe(struct platform_device *pdev)
magn_state->rot_attributes.sensitivity.index = -1;
ret = magn_3d_parse_report(pdev, hsdev,
- &channels, &chan_count,
- HID_USAGE_SENSOR_COMPASS_3D, magn_state);
+ &channels, &chan_count,
+ HID_USAGE_SENSOR_COMPASS_3D, magn_state);
if (ret) {
dev_err(&pdev->dev, "failed to parse report\n");
return ret;
@@ -507,7 +500,7 @@ static int hid_magn_3d_probe(struct platform_device *pdev)
atomic_set(&magn_state->magn_flux_attributes.data_ready, 0);
ret = hid_sensor_setup_trigger(indio_dev, name,
- &magn_state->magn_flux_attributes);
+ &magn_state->magn_flux_attributes);
if (ret < 0) {
dev_err(&pdev->dev, "trigger setup failed\n");
return ret;
@@ -517,7 +510,7 @@ static int hid_magn_3d_probe(struct platform_device *pdev)
magn_state->callbacks.capture_sample = magn_3d_capture_sample;
magn_state->callbacks.pdev = pdev;
ret = sensor_hub_register_callback(hsdev, HID_USAGE_SENSOR_COMPASS_3D,
- &magn_state->callbacks);
+ &magn_state->callbacks);
if (ret < 0) {
dev_err(&pdev->dev, "callback reg failed\n");
goto error_remove_trigger;
diff --git a/drivers/iio/orientation/hid-sensor-incl-3d.c b/drivers/iio/orientation/hid-sensor-incl-3d.c
index 5696e4ef3633..05c75e7246af 100644
--- a/drivers/iio/orientation/hid-sensor-incl-3d.c
+++ b/drivers/iio/orientation/hid-sensor-incl-3d.c
@@ -86,8 +86,7 @@ static const struct iio_chan_spec incl_3d_channels[] = {
};
/* Adjust channel real bits based on report descriptor */
-static void incl_3d_adjust_channel_bit_mask(struct iio_chan_spec *chan,
- int size)
+static void incl_3d_adjust_channel_bit_mask(struct iio_chan_spec *chan, int size)
{
chan->scan_type.sign = 's';
/* Real storage bits will change based on the report desc. */
@@ -98,9 +97,8 @@ static void incl_3d_adjust_channel_bit_mask(struct iio_chan_spec *chan,
/* Channel read_raw handler */
static int incl_3d_read_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int *val, int *val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int *val, int *val2, long mask)
{
struct incl_3d_state *incl_state = iio_priv(indio_dev);
int report_id = -1;
@@ -125,7 +123,7 @@ static int incl_3d_read_raw(struct iio_dev *indio_dev,
min < 0);
else {
hid_sensor_power_state(&incl_state->common_attributes,
- false);
+ false);
return -EINVAL;
}
hid_sensor_power_state(&incl_state->common_attributes, false);
@@ -158,10 +156,8 @@ static int incl_3d_read_raw(struct iio_dev *indio_dev,
/* Channel write_raw handler */
static int incl_3d_write_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int val,
- int val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int val, int val2, long mask)
{
struct incl_3d_state *incl_state = iio_priv(indio_dev);
int ret;
@@ -189,8 +185,7 @@ static const struct iio_info incl_3d_info = {
/* Callback handler to send event after all samples are received and captured */
static int incl_3d_proc_event(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- void *priv)
+ u32 usage_id, void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct incl_3d_state *incl_state = iio_priv(indio_dev);
@@ -212,9 +207,9 @@ static int incl_3d_proc_event(struct hid_sensor_hub_device *hsdev,
/* Capture samples in local storage */
static int incl_3d_capture_sample(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- size_t raw_len, char *raw_data,
- void *priv)
+ u32 usage_id,
+ size_t raw_len, char *raw_data,
+ void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct incl_3d_state *incl_state = iio_priv(indio_dev);
@@ -350,7 +345,7 @@ static int hid_incl_3d_probe(struct platform_device *pdev)
atomic_set(&incl_state->common_attributes.data_ready, 0);
ret = hid_sensor_setup_trigger(indio_dev, name,
- &incl_state->common_attributes);
+ &incl_state->common_attributes);
if (ret) {
dev_err(&pdev->dev, "trigger setup failed\n");
return ret;
@@ -360,8 +355,8 @@ static int hid_incl_3d_probe(struct platform_device *pdev)
incl_state->callbacks.capture_sample = incl_3d_capture_sample;
incl_state->callbacks.pdev = pdev;
ret = sensor_hub_register_callback(hsdev,
- HID_USAGE_SENSOR_INCLINOMETER_3D,
- &incl_state->callbacks);
+ HID_USAGE_SENSOR_INCLINOMETER_3D,
+ &incl_state->callbacks);
if (ret) {
dev_err(&pdev->dev, "callback reg failed\n");
goto error_remove_trigger;
diff --git a/drivers/iio/orientation/hid-sensor-rotation.c b/drivers/iio/orientation/hid-sensor-rotation.c
index 6773bb0ec204..bd918feb3617 100644
--- a/drivers/iio/orientation/hid-sensor-rotation.c
+++ b/drivers/iio/orientation/hid-sensor-rotation.c
@@ -81,9 +81,8 @@ static const struct iio_chan_spec dev_rot_channels[] = {
/* Channel read_raw handler */
static int dev_rot_read_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int size, int *vals, int *val_len,
- long mask)
+ struct iio_chan_spec const *chan,
+ int size, int *vals, int *val_len, long mask)
{
struct dev_rot_state *rot_state = iio_priv(indio_dev);
int ret_type;
@@ -129,10 +128,8 @@ static int dev_rot_read_raw(struct iio_dev *indio_dev,
/* Channel write_raw handler */
static int dev_rot_write_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int val,
- int val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int val, int val2, long mask)
{
struct dev_rot_state *rot_state = iio_priv(indio_dev);
int ret;
@@ -176,8 +173,7 @@ static const struct iio_info dev_rot_info = {
/* Callback handler to send event after all samples are received and captured */
static int dev_rot_proc_event(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- void *priv)
+ u32 usage_id, void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct dev_rot_state *rot_state = iio_priv(indio_dev);
@@ -209,9 +205,9 @@ static int dev_rot_proc_event(struct hid_sensor_hub_device *hsdev,
/* Capture samples in local storage */
static int dev_rot_capture_sample(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- size_t raw_len, char *raw_data,
- void *priv)
+ u32 usage_id,
+ size_t raw_len, char *raw_data,
+ void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct dev_rot_state *rot_state = iio_priv(indio_dev);
@@ -326,7 +322,7 @@ static int hid_dev_rot_probe(struct platform_device *pdev)
atomic_set(&rot_state->common_attributes.data_ready, 0);
ret = hid_sensor_setup_trigger(indio_dev, name,
- &rot_state->common_attributes);
+ &rot_state->common_attributes);
if (ret) {
dev_err(&pdev->dev, "trigger setup failed\n");
return ret;
@@ -336,7 +332,7 @@ static int hid_dev_rot_probe(struct platform_device *pdev)
rot_state->callbacks.capture_sample = dev_rot_capture_sample;
rot_state->callbacks.pdev = pdev;
ret = sensor_hub_register_callback(hsdev, hsdev->usage,
- &rot_state->callbacks);
+ &rot_state->callbacks);
if (ret) {
dev_err(&pdev->dev, "callback reg failed\n");
goto error_remove_trigger;
diff --git a/drivers/iio/position/hid-sensor-custom-intel-hinge.c b/drivers/iio/position/hid-sensor-custom-intel-hinge.c
index 7d3f4907e083..eb6c59f81c3f 100644
--- a/drivers/iio/position/hid-sensor-custom-intel-hinge.c
+++ b/drivers/iio/position/hid-sensor-custom-intel-hinge.c
@@ -107,8 +107,8 @@ static void hinge_adjust_channel_realbits(struct iio_chan_spec *channels,
/* Channel read_raw handler */
static int hinge_read_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan, int *val, int *val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int *val, int *val2, long mask)
{
struct hinge_state *st = iio_priv(indio_dev);
struct hid_sensor_hub_device *hsdev;
@@ -154,8 +154,8 @@ static int hinge_read_raw(struct iio_dev *indio_dev,
/* Channel write_raw handler */
static int hinge_write_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan, int val, int val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int val, int val2, long mask)
{
struct hinge_state *st = iio_priv(indio_dev);
@@ -209,8 +209,9 @@ static int hinge_proc_event(struct hid_sensor_hub_device *hsdev,
/* Capture samples in local storage */
static int hinge_capture_sample(struct hid_sensor_hub_device *hsdev,
- u32 usage_id, size_t raw_len,
- char *raw_data, void *priv)
+ u32 usage_id,
+ size_t raw_len, char *raw_data,
+ void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct hinge_state *st = iio_priv(indio_dev);
diff --git a/drivers/iio/pressure/hid-sensor-press.c b/drivers/iio/pressure/hid-sensor-press.c
index 8f81a6d65b9f..c2be2a2eaa1b 100644
--- a/drivers/iio/pressure/hid-sensor-press.c
+++ b/drivers/iio/pressure/hid-sensor-press.c
@@ -56,9 +56,8 @@ static const struct iio_chan_spec press_channels[] = {
/* Channel read_raw handler */
static int press_read_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int *val, int *val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int *val, int *val2, long mask)
{
struct press_state *press_state = iio_priv(indio_dev);
int report_id = -1;
@@ -82,7 +81,7 @@ static int press_read_raw(struct iio_dev *indio_dev,
}
if (report_id >= 0) {
hid_sensor_power_state(&press_state->common_attributes,
- true);
+ true);
*val = sensor_hub_input_attr_get_raw_value(
press_state->common_attributes.hsdev,
HID_USAGE_SENSOR_PRESSURE, address,
@@ -90,7 +89,7 @@ static int press_read_raw(struct iio_dev *indio_dev,
SENSOR_HUB_SYNC,
min < 0);
hid_sensor_power_state(&press_state->common_attributes,
- false);
+ false);
} else {
*val = 0;
return -EINVAL;
@@ -124,10 +123,8 @@ static int press_read_raw(struct iio_dev *indio_dev,
/* Channel write_raw handler */
static int press_write_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int val,
- int val2,
- long mask)
+ struct iio_chan_spec const *chan,
+ int val, int val2, long mask)
{
struct press_state *press_state = iio_priv(indio_dev);
int ret = 0;
@@ -155,8 +152,7 @@ static const struct iio_info press_info = {
/* Callback handler to send event after all samples are received and captured */
static int press_proc_event(struct hid_sensor_hub_device *hsdev,
- u32 usage_id,
- void *priv)
+ u32 usage_id, void *priv)
{
struct iio_dev *indio_dev = platform_get_drvdata(priv);
struct press_state *press_state = iio_priv(indio_dev);
@@ -202,10 +198,10 @@ static int press_capture_sample(struct hid_sensor_hub_device *hsdev,
/* Parse report which is specific to an usage id*/
static int press_parse_report(struct platform_device *pdev,
- struct hid_sensor_hub_device *hsdev,
- struct iio_chan_spec *channels,
- u32 usage_id,
- struct press_state *st)
+ struct hid_sensor_hub_device *hsdev,
+ struct iio_chan_spec *channels,
+ u32 usage_id,
+ struct press_state *st)
{
int ret;
@@ -222,7 +218,7 @@ static int press_parse_report(struct platform_device *pdev,
};
dev_dbg(&pdev->dev, "press %x:%x\n", st->press_attr.index,
- st->press_attr.report_id);
+ st->press_attr.report_id);
st->scale_precision = hid_sensor_format_scale(
HID_USAGE_SENSOR_PRESSURE,
@@ -241,8 +237,7 @@ static int hid_press_probe(struct platform_device *pdev)
struct iio_dev *indio_dev;
struct press_state *press_state;
- indio_dev = devm_iio_device_alloc(&pdev->dev,
- sizeof(struct press_state));
+ indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(struct press_state));
if (!indio_dev)
return -ENOMEM;
platform_set_drvdata(pdev, indio_dev);
@@ -285,7 +280,7 @@ static int hid_press_probe(struct platform_device *pdev)
atomic_set(&press_state->common_attributes.data_ready, 0);
ret = hid_sensor_setup_trigger(indio_dev, name,
- &press_state->common_attributes);
+ &press_state->common_attributes);
if (ret) {
dev_err(&pdev->dev, "trigger setup failed\n");
return ret;
@@ -295,7 +290,7 @@ static int hid_press_probe(struct platform_device *pdev)
press_state->callbacks.capture_sample = press_capture_sample;
press_state->callbacks.pdev = pdev;
ret = sensor_hub_register_callback(hsdev, HID_USAGE_SENSOR_PRESSURE,
- &press_state->callbacks);
+ &press_state->callbacks);
if (ret < 0) {
dev_err(&pdev->dev, "callback reg failed\n");
goto error_remove_trigger;
diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c
index d3bc13b4258e..f4a09d941d31 100644
--- a/drivers/iio/temperature/hid-sensor-temperature.c
+++ b/drivers/iio/temperature/hid-sensor-temperature.c
@@ -45,7 +45,7 @@ static const struct iio_chan_spec temperature_channels[] = {
/* Adjust channel real bits based on report descriptor */
static void temperature_adjust_channel_bit_mask(struct iio_chan_spec *channels,
- int channel, int size)
+ int channel, int size)
{
channels[channel].scan_type.sign = 's';
/* Real storage bits will change based on the report desc. */
@@ -101,8 +101,8 @@ static int temperature_read_raw(struct iio_dev *indio_dev,
}
static int temperature_write_raw(struct iio_dev *indio_dev,
- struct iio_chan_spec const *chan,
- int val, int val2, long mask)
+ struct iio_chan_spec const *chan,
+ int val, int val2, long mask)
{
struct temperature_state *temp_st = iio_priv(indio_dev);
@@ -125,7 +125,7 @@ static const struct iio_info temperature_info = {
/* Callback handler to send event after all samples are received and captured */
static int temperature_proc_event(struct hid_sensor_hub_device *hsdev,
- u32 usage_id, void *pdev)
+ u32 usage_id, void *pdev)
{
struct iio_dev *indio_dev = platform_get_drvdata(pdev);
struct temperature_state *temp_st = iio_priv(indio_dev);
@@ -140,8 +140,9 @@ static int temperature_proc_event(struct hid_sensor_hub_device *hsdev,
/* Capture samples in local storage */
static int temperature_capture_sample(struct hid_sensor_hub_device *hsdev,
- u32 usage_id, size_t raw_len,
- char *raw_data, void *pdev)
+ u32 usage_id,
+ size_t raw_len, char *raw_data,
+ void *pdev)
{
struct iio_dev *indio_dev = platform_get_drvdata(pdev);
struct temperature_state *temp_st = iio_priv(indio_dev);
@@ -157,10 +158,10 @@ static int temperature_capture_sample(struct hid_sensor_hub_device *hsdev,
/* Parse report which is specific to an usage id*/
static int temperature_parse_report(struct platform_device *pdev,
- struct hid_sensor_hub_device *hsdev,
- struct iio_chan_spec *channels,
- u32 usage_id,
- struct temperature_state *st)
+ struct hid_sensor_hub_device *hsdev,
+ struct iio_chan_spec *channels,
+ u32 usage_id,
+ struct temperature_state *st)
{
int ret;
@@ -171,8 +172,7 @@ static int temperature_parse_report(struct platform_device *pdev,
if (ret < 0)
return ret;
- temperature_adjust_channel_bit_mask(channels, 0,
- st->temperature_attr.size);
+ temperature_adjust_channel_bit_mask(channels, 0, st->temperature_attr.size);
st->scale_precision = hid_sensor_format_scale(
HID_USAGE_SENSOR_TEMPERATURE,
@@ -219,7 +219,7 @@ static int hid_temperature_probe(struct platform_device *pdev)
return -ENOMEM;
ret = temperature_parse_report(pdev, hsdev, temp_chans,
- HID_USAGE_SENSOR_TEMPERATURE, temp_st);
+ HID_USAGE_SENSOR_TEMPERATURE, temp_st);
if (ret)
return ret;
@@ -232,7 +232,7 @@ static int hid_temperature_probe(struct platform_device *pdev)
atomic_set(&temp_st->common_attributes.data_ready, 0);
ret = hid_sensor_setup_trigger(indio_dev, name,
- &temp_st->common_attributes);
+ &temp_st->common_attributes);
if (ret)
return ret;
@@ -240,7 +240,7 @@ static int hid_temperature_probe(struct platform_device *pdev)
temperature_callbacks.pdev = pdev;
ret = sensor_hub_register_callback(hsdev, HID_USAGE_SENSOR_TEMPERATURE,
- &temperature_callbacks);
+ &temperature_callbacks);
if (ret)
goto error_remove_trigger;
--
2.34.1
^ permalink raw reply related
* [PATCH v3 2/2] iio: hid-sensors: Use implicit NULL pointer checks
From: Sanjay Chitroda via B4 Relay @ 2026-07-06 18:59 UTC (permalink / raw)
To: Jiri Kosina, Jonathan Cameron, Srinivas Pandruvada, David Lechner,
Nuno Sá, Andy Shevchenko
Cc: linux-input, linux-iio, linux-kernel, Sanjay Chitroda,
Maxwell Doose
In-Reply-To: <20260707-15-jun-hid-iio-alignment-v3-0-8791574ad0fe@gmail.com>
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Replace explicit NULL pointer comparisons with implicit checks across
HID sensor IIO drivers to fix kernel coding style.
CHECK: Comparison to NULL could be written ...
No functional change.
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Reviewed-by: Maxwell Doose <m32285159@gmail.com>
---
drivers/iio/accel/hid-sensor-accel-3d.c | 2 +-
drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 2 +-
drivers/iio/magnetometer/hid-sensor-magn-3d.c | 4 ++--
drivers/iio/orientation/hid-sensor-incl-3d.c | 2 +-
drivers/iio/orientation/hid-sensor-rotation.c | 2 +-
5 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
index 3986a0bdaf44..ccf27491d880 100644
--- a/drivers/iio/accel/hid-sensor-accel-3d.c
+++ b/drivers/iio/accel/hid-sensor-accel-3d.c
@@ -325,7 +325,7 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
indio_dev = devm_iio_device_alloc(&pdev->dev,
sizeof(struct accel_3d_state));
- if (indio_dev == NULL)
+ if (!indio_dev)
return -ENOMEM;
platform_set_drvdata(pdev, indio_dev);
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index fffaebe8c7f0..60808e2430ca 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -266,7 +266,7 @@ int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name,
trig = iio_trigger_alloc(indio_dev->dev.parent,
"%s-dev%d", name, iio_device_id(indio_dev));
- if (trig == NULL) {
+ if (!trig) {
dev_err(&indio_dev->dev, "Trigger Allocate Failed\n");
return -ENOMEM;
}
diff --git a/drivers/iio/magnetometer/hid-sensor-magn-3d.c b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
index 6c95ce84067d..bbe52d4e924b 100644
--- a/drivers/iio/magnetometer/hid-sensor-magn-3d.c
+++ b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
@@ -322,7 +322,7 @@ static int magn_3d_capture_sample(struct hid_sensor_hub_device *hsdev,
iio_val = magn_state->magn_val_addr[offset];
- if (iio_val != NULL)
+ if (iio_val)
*iio_val = *((u32 *)raw_data);
else
ret = -EINVAL;
@@ -461,7 +461,7 @@ static int hid_magn_3d_probe(struct platform_device *pdev)
indio_dev = devm_iio_device_alloc(&pdev->dev,
sizeof(struct magn_3d_state));
- if (indio_dev == NULL)
+ if (!indio_dev)
return -ENOMEM;
platform_set_drvdata(pdev, indio_dev);
diff --git a/drivers/iio/orientation/hid-sensor-incl-3d.c b/drivers/iio/orientation/hid-sensor-incl-3d.c
index 05c75e7246af..5cf0e6363811 100644
--- a/drivers/iio/orientation/hid-sensor-incl-3d.c
+++ b/drivers/iio/orientation/hid-sensor-incl-3d.c
@@ -302,7 +302,7 @@ static int hid_incl_3d_probe(struct platform_device *pdev)
indio_dev = devm_iio_device_alloc(&pdev->dev,
sizeof(struct incl_3d_state));
- if (indio_dev == NULL)
+ if (!indio_dev)
return -ENOMEM;
platform_set_drvdata(pdev, indio_dev);
diff --git a/drivers/iio/orientation/hid-sensor-rotation.c b/drivers/iio/orientation/hid-sensor-rotation.c
index bd918feb3617..412fb467a694 100644
--- a/drivers/iio/orientation/hid-sensor-rotation.c
+++ b/drivers/iio/orientation/hid-sensor-rotation.c
@@ -274,7 +274,7 @@ static int hid_dev_rot_probe(struct platform_device *pdev)
indio_dev = devm_iio_device_alloc(&pdev->dev,
sizeof(struct dev_rot_state));
- if (indio_dev == NULL)
+ if (!indio_dev)
return -ENOMEM;
platform_set_drvdata(pdev, indio_dev);
--
2.34.1
^ permalink raw reply related
* [PATCH v3 0/2] HID: iio: warning clean up and prefer kernel coding style
From: Sanjay Chitroda via B4 Relay @ 2026-07-06 18:59 UTC (permalink / raw)
To: Jiri Kosina, Jonathan Cameron, Srinivas Pandruvada, David Lechner,
Nuno Sá, Andy Shevchenko
Cc: linux-input, linux-iio, linux-kernel, Sanjay Chitroda,
Maxwell Doose
Hi all,
This series updates HID sensor IIO drivers to address checkpatch
warnings, improves readability and compliance with kernel coding style.
The changes are:
- replacing explicit NULL comparisons with implicit pointer checks;
- adjusting indentation and alignment;
- reformatting multi-line function declarations for improved
readability and consistency.
While updating alignment and line wrapping, function parameters are
grouped more logically and common callback signatures are formatted
consistently across HID sensor IIO drivers.
Testing:
- Compiled with W=1 for each patch in the series
---
Changes in v3:
- Rebase series on top of iio/testing where parital v2 series is added.
- Rectify commit message and resolve inconsistency highlighted by
Jonathan.
- Link to v2: https://patch.msgid.link/20260702-15-jun-hid-iio-alignment-v2-0-b87f01f5efbc@gmail.com
Changes in v2:
- Following input from Joshua and Maxwell squash all related changes
in single change as this is code churn.
- Following input from Andy (re-)split function argument/parameter
logically.
- Added review tag of Maxwell to implicit NULL check change while
drop for parenthesis alignemnt to have a fresh review.
- Link to v1: https://lore.kernel.org/20260616-15-jun-hid-iio-alignment-v1-0-0cd544286575@gmail.com
To: Jiri Kosina <jikos@kernel.org>
To: Jonathan Cameron <jic23@kernel.org>
To: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
To: David Lechner <dlechner@baylibre.com>
To: Nuno Sá <nuno.sa@analog.com>
To: Andy Shevchenko <andy@kernel.org>
Cc: linux-input@vger.kernel.org
Cc: linux-iio@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
---
Sanjay Chitroda (2):
iio: hid-sensors: align function parenthesis for readability
iio: hid-sensors: Use implicit NULL pointer checks
drivers/iio/accel/hid-sensor-accel-3d.c | 48 ++++++-------
.../iio/common/hid-sensors/hid-sensor-attributes.c | 80 +++++++++++-----------
.../iio/common/hid-sensors/hid-sensor-trigger.c | 4 +-
.../iio/common/hid-sensors/hid-sensor-trigger.h | 2 +-
drivers/iio/gyro/hid-sensor-gyro-3d.c | 35 ++++------
drivers/iio/humidity/hid-sensor-humidity.c | 33 ++++-----
drivers/iio/light/hid-sensor-als.c | 32 ++++-----
drivers/iio/light/hid-sensor-prox.c | 29 ++++----
drivers/iio/magnetometer/hid-sensor-magn-3d.c | 53 +++++++-------
drivers/iio/orientation/hid-sensor-incl-3d.c | 33 ++++-----
drivers/iio/orientation/hid-sensor-rotation.c | 26 +++----
.../iio/position/hid-sensor-custom-intel-hinge.c | 13 ++--
drivers/iio/pressure/hid-sensor-press.c | 35 ++++------
drivers/iio/temperature/hid-sensor-temperature.c | 30 ++++----
14 files changed, 208 insertions(+), 245 deletions(-)
---
base-commit: 4c0ecdbdc0d87570f74e656e21d56bae1ab6a8f1
change-id: 20260615-15-jun-hid-iio-alignment-46bba7279be3
Best regards,
--
Sanjay Chitroda <sanjayembeddedse@gmail.com>
^ permalink raw reply
* Re: [PATCH] Input: zinitix - support the 6-byte/count touch report used by bt532
From: sashiko-bot @ 2026-07-06 18:16 UTC (permalink / raw)
To: Kavan Smith; +Cc: dmitry.torokhov, linux-input
In-Reply-To: <20260706180826.408989-1-kavansmith82@gmail.com>
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [High] The `zinitix,mode` property is read and validated after `input_register_device()` is called. This creates a race condition where userspace can open and use the input device before its private state is fully configured, violating input subsystem initialization rules.
- [High] I2C transactions use stack-allocated buffers, which are unsafe for DMA.
--
commit 25626131785e9a530425fa65d2a03db62641f88e
Author: Kavan Smith <kavansmith82@gmail.com>
Input: zinitix - support the 6-byte/count touch report used by bt532
This commit adds a per-compatible struct zinitix_chip_data to select
the report stride and how byte[2] is interpreted. It provides support
for firmware packing contacts at a 6-byte stride and reporting a finger
count, fixing multitouch behavior on devices like the Samsung Galaxy Tab
A 8.0.
> diff --git a/drivers/input/touchscreen/zinitix.c b/drivers/input/touchscreen/zinitix.c
> index 0c36765bd79f8..04ee4d804b511 100644
> --- a/drivers/input/touchscreen/zinitix.c
> +++ b/drivers/input/touchscreen/zinitix.c
[ ... ]
> @@ -452,8 +475,11 @@ static irqreturn_t zinitix_ts_irq_handler(int irq, void *bt541_handler)
>
> memset(&touch_event, 0, sizeof(struct touch_event));
>
> + /* header (status, finger_mask, time_stamp) + one stride per contact */
> error = zinitix_read_data(bt541->client, ZINITIX_POINT_STATUS_REG,
> - &touch_event, sizeof(struct touch_event));
> + &touch_event,
> + offsetof(struct touch_event, coords) +
> + MAX_SUPPORTED_FINGER_NUM * stride);
[Severity: High]
This is a pre-existing issue, but does zinitix_read_data() perform safe I2C
transactions here?
The &touch_event pointer points to stack memory and is passed to
i2c_master_recv() inside zinitix_read_data(). Passing stack-allocated buffers
to I2C transfer functions can violate DMA safety rules. If the I2C host
controller driver maps these buffers for DMA, it can corrupt adjacent stack
variables on non-cache-coherent architectures.
This same issue seems to exist with ®_le in zinitix_read_data() and the
packet array in zinitix_write_u16(). Would it be possible to allocate these
buffers dynamically to avoid potential DMA stack corruption?
[ ... ]
> @@ -627,6 +671,7 @@ static int zinitix_ts_probe(struct i2c_client *client)
> return -ENOMEM;
>
> bt541->client = client;
> + bt541->chip = device_get_match_data(&client->dev);
> i2c_set_clientdata(client, bt541);
>
> error = zinitix_init_regulators(bt541);
[Severity: High]
This isn't a bug introduced by this patch, but looking further down in
zinitix_ts_probe(), zinitix_init_input_dev() is called to register the input
device before reading the zinitix,mode property:
error = zinitix_init_input_dev(bt541);
if (error) {
dev_err(&client->dev,
"Failed to initialize input device: %d\n", error);
return error;
}
error = device_property_read_u32(&client->dev, "zinitix,mode",
&bt541->zinitix_mode);
Does this create a race condition where userspace could open and use the
input device before its private state is fully configured?
If userspace opens the device in this window, zinitix_input_open() might use
bt541->zinitix_mode while it is still 0 (from kzalloc). This could configure
the hardware in an invalid state instead of the device-tree specified mode.
Should the property be read and validated before calling
input_register_device()?
[ ... ]
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260706180826.408989-1-kavansmith82@gmail.com?part=1
^ permalink raw reply
* Re: [PATCH] HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
From: sashiko-bot @ 2026-07-06 18:13 UTC (permalink / raw)
To: Andrei Fed; +Cc: dmitry.torokhov, linux-input
In-Reply-To: <20260706175507.47288-1-andfed.net@gmail.com>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [Critical] Unbounded recursion in `magicmouse_raw_event` when parsing malicious `DOUBLE_REPORT_ID` packets can cause a kernel stack overflow.
--
commit 58987e236bab550dc05b66346833ee21ed261110
Author: Andrei Fed <andfed.net@gmail.com>
HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
This commit fixes battery reporting for the Bluetooth Magic Trackpad USB-C by
avoiding the misparsing query path. It introduces a battery quirk to skip the
query and instead fetches the battery at the end of the device probe.
> diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
> index 802a3479e24b9..0c4e959322c3c 100644
> --- a/drivers/hid/hid-magicmouse.c
> +++ b/drivers/hid/hid-magicmouse.c
[ ... ]
[Severity: Critical]
This is a pre-existing issue, but while reviewing this file I noticed
that magicmouse_raw_event() doesn't seem to enforce a depth limit when
recursively calling itself to parse DOUBLE_REPORT_ID packets:
drivers/hid/hid-magicmouse.c:magicmouse_raw_event() {
...
case DOUBLE_REPORT_ID:
/* Sometimes the trackpad sends two touch reports in one
* packet.
*/
/* Ensure that we have at least 2 elements (report type and size) */
if (size < 2)
return 0;
if (size < data[1] + 2) {
hid_warn(hdev,
"received report length (%d) was smaller than specified (%d)",
size, data[1] + 2);
return 0;
}
magicmouse_raw_event(hdev, report, data + 2, data[1]);
magicmouse_raw_event(hdev, report, data + 2 + data[1],
size - 2 - data[1]);
return 0;
...
}
If a malicious Bluetooth or USB device sends a HID report starting with
DOUBLE_REPORT_ID (0xf7) and filled with the sequence [0xf7, 0x00], the inner
size byte data[1] evaluates to 0.
Could this cause magicmouse_raw_event() to recursively call itself with
size 0 (which returns immediately) and size - 2?
A 16KB malicious report could force ~8192 nested recursions, which might
overflow the standard kernel stack and lead to a denial of service panic.
Does this need an upper bound on recursion depth or an iterative approach
to prevent stack exhaustion?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260706175507.47288-1-andfed.net@gmail.com?part=1
^ permalink raw reply
* Re: [PATCH 02/26] Input: maple_keyb - fix key press detection
From: Florian Fuchs @ 2026-07-06 18:08 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Yoshinori Sato, Rich Felker, John Paul Adrian Glaubitz,
Adrian McMenamin, linux-kernel, Dmitry Torokhov, linux-input,
linux-mtd, linux-sh
In-Reply-To: <20260703-b4-maple-cleanup-v1-2-41e424964da5@gmail.com>
Hi Dmitry,
On 03 Jul 22:57, Dmitry Torokhov wrote:
> The key press detection logic was using ptr instead of !ptr (where ptr is
> the result of memchr searching for the new key in the old keys).
>
> If ptr is not NULL, it means the key was already pressed in the previous
> report, so it is not a new press. If ptr is NULL, it means the key was
> not pressed before, so it is a new press.
>
> Using ptr instead of !ptr caused new presses to be ignored in the first
> poll cycle (only reported in the second cycle if still held, because
> then it was in 'old'), and caused redundant press events to be sent
> on every subsequent poll while the key was held.
>
> Fix this by using !ptr for press detection, matching the release
> detection logic.
>
> Fixes: b11d2127c489 ("Input: add support for SEGA Dreamcast keyboard")
> Assisted-by: Antigravity:gemini-3.5-flash
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> ---
> drivers/input/keyboard/maple_keyb.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/input/keyboard/maple_keyb.c b/drivers/input/keyboard/maple_keyb.c
> index 3d5538dd4f23..623d7951405b 100644
> --- a/drivers/input/keyboard/maple_keyb.c
> +++ b/drivers/input/keyboard/maple_keyb.c
> @@ -107,7 +107,7 @@ static void dc_scan_kbd(struct dc_kbd *kbd)
> }
> ptr = memchr(kbd->old + 2, kbd->new[i], 6);
> code = kbd->new[i];
> - if (code > 3 && ptr) {
> + if (code > 3 && !ptr) {
> keycode = kbd->keycode[code];
> if (keycode) {
> input_event(dev, EV_MSC, MSC_SCAN, code);
>
> --
> 2.55.0.rc0.799.gd6f94ed593-goog
>
For patches 1-17, 21, 22, 24, 25 you can add:
Tested-by: Florian Fuchs <fuchsfl@gmail.com>
I applied the patches without the mutex-related ones, and dropped
the 18, 19 (the mutex ones) and the depending 20, 23, 26 (as didn't
apply then).
The mouse, keyboard, controller is still detected and working like
expected. All buttons, sticks, wheel and knobs work. Patch 2 seems
indeed to make the keyboard feel more reliable while typing.
Thank you,
Regards
Florian
^ permalink raw reply
* [PATCH] Input: zinitix - support the 6-byte/count touch report used by bt532
From: Kavan Smith @ 2026-07-06 18:08 UTC (permalink / raw)
To: dmitry.torokhov; +Cc: michael.srba, linux-input, linux-kernel, Kavan Smith
The driver assumes an 8-byte per-contact report stride with a per-finger
bitmask in report byte[2]. bt532 firmware (Samsung Galaxy Tab A 8.0,
msm8916-samsung-gt58) instead packs contacts at a 6-byte stride and reports
a finger COUNT in byte[2]. Under the 8-byte/bitmask assumption fingers 1+
are read misaligned, and a two-finger report (count 0x02) makes
for_each_set_bit() visit only slot 1, collapsing multitouch to a single
contact.
Add a per-compatible struct zinitix_chip_data that selects the report stride
and how byte[2] is interpreted, and attach it to the bt532 compatible (the
only in-tree user of it). All other compatibles keep the existing 8-byte,
bitmask behaviour unchanged. Contacts are parsed at the chip's stride, and
for count-style firmware every slot the chip marks with SUB_BIT_EXIST is
reported.
Signed-off-by: Kavan Smith <kavansmith82@gmail.com>
---
drivers/input/touchscreen/zinitix.c | 71 +++++++++++++++++++++++++++--
1 file changed, 58 insertions(+), 13 deletions(-)
diff --git a/drivers/input/touchscreen/zinitix.c b/drivers/input/touchscreen/zinitix.c
--- a/drivers/input/touchscreen/zinitix.c
+++ b/drivers/input/touchscreen/zinitix.c
@@ -135,26 +135,47 @@
#define CHIP_ON_DELAY 15 // ms
#define FIRMWARE_ON_DELAY 40 // ms
+/*
+ * Two Zinitix touch-report layouts exist in the wild. The default is an 8-byte
+ * per-contact stride with a per-finger bitmask in report byte[2]. Some firmware
+ * (e.g. bt532 on the Samsung Galaxy Tab A 8.0) packs contacts at a 6-byte stride
+ * and reports a finger COUNT in byte[2] instead of a bitmask. Selected per
+ * compatible via the of_device_id .data below.
+ */
+struct zinitix_chip_data {
+ unsigned int coord_stride; /* per-contact byte stride in the report */
+ bool finger_count; /* byte[2] is a finger count, not a bitmask */
+};
+
+static const struct zinitix_chip_data zinitix_bt532_data = {
+ .coord_stride = 6,
+ .finger_count = true,
+};
+
struct point_coord {
__le16 x;
__le16 y;
u8 width;
u8 sub_status;
- // currently unused, but needed as padding:
- u8 minor_width;
- u8 angle;
+ /*
+ * 8-byte-stride firmware appends two unused bytes here (minor_width,
+ * angle); the report is parsed at the chip's coord_stride, so on that
+ * firmware they are simply skipped rather than being part of this struct.
+ */
};
struct touch_event {
__le16 status;
u8 finger_mask;
u8 time_stamp;
- struct point_coord point_coord[MAX_SUPPORTED_FINGER_NUM];
+ /* raw per-contact bytes, parsed at the chip's coord_stride (max 8) */
+ u8 coords[MAX_SUPPORTED_FINGER_NUM * 8];
};
struct bt541_ts_data {
struct i2c_client *client;
struct input_dev *input_dev;
+ const struct zinitix_chip_data *chip;
struct touchscreen_properties prop;
struct regulator_bulk_data supplies[2];
u32 zinitix_mode;
@@ -444,6 +465,8 @@
{
struct bt541_ts_data *bt541 = bt541_handler;
struct i2c_client *client = bt541->client;
+ unsigned int stride = bt541->chip ? bt541->chip->coord_stride : 8;
+ bool finger_count = bt541->chip ? bt541->chip->finger_count : false;
struct touch_event touch_event;
unsigned long finger_mask;
__le16 icon_events;
@@ -452,8 +475,11 @@
memset(&touch_event, 0, sizeof(struct touch_event));
+ /* header (status, finger_mask, time_stamp) + one stride per contact */
error = zinitix_read_data(bt541->client, ZINITIX_POINT_STATUS_REG,
- &touch_event, sizeof(struct touch_event));
+ &touch_event,
+ offsetof(struct touch_event, coords) +
+ MAX_SUPPORTED_FINGER_NUM * stride);
if (error) {
dev_err(&client->dev, "Failed to read in touchpoint struct\n");
goto out;
@@ -470,13 +496,31 @@
zinitix_report_keys(bt541, le16_to_cpu(icon_events));
}
- finger_mask = touch_event.finger_mask;
- for_each_set_bit(i, &finger_mask, MAX_SUPPORTED_FINGER_NUM) {
- const struct point_coord *p = &touch_event.point_coord[i];
-
- /* Only process contacts that are actually reported */
- if (p->sub_status & SUB_BIT_EXIST)
- zinitix_report_finger(bt541, i, p);
+ if (finger_count) {
+ /*
+ * On this firmware byte[2] is a finger COUNT, not a bitmask: a
+ * 2-finger report carries 0x02, so for_each_set_bit() would look
+ * only at slot 1 and silently drop slot 0. The chip marks every
+ * populated contact with SUB_BIT_EXIST, so iterate all slots and
+ * report the present ones.
+ */
+ for (i = 0; i < MAX_SUPPORTED_FINGER_NUM; i++) {
+ const struct point_coord *p =
+ (const struct point_coord *)&touch_event.coords[i * stride];
+
+ if (p->sub_status & SUB_BIT_EXIST)
+ zinitix_report_finger(bt541, i, p);
+ }
+ } else {
+ /* default: byte[2] is a per-finger bitmask */
+ finger_mask = touch_event.finger_mask;
+ for_each_set_bit(i, &finger_mask, MAX_SUPPORTED_FINGER_NUM) {
+ const struct point_coord *p =
+ (const struct point_coord *)&touch_event.coords[i * stride];
+
+ if (p->sub_status & SUB_BIT_EXIST)
+ zinitix_report_finger(bt541, i, p);
+ }
}
input_mt_sync_frame(bt541->input_dev);
@@ -627,6 +671,7 @@
return -ENOMEM;
bt541->client = client;
+ bt541->chip = device_get_match_data(&client->dev);
i2c_set_clientdata(client, bt541);
error = zinitix_init_regulators(bt541);
@@ -741,7 +786,7 @@
{ .compatible = "zinitix,bt431" },
{ .compatible = "zinitix,bt432" },
{ .compatible = "zinitix,bt531" },
- { .compatible = "zinitix,bt532" },
+ { .compatible = "zinitix,bt532", .data = &zinitix_bt532_data },
{ .compatible = "zinitix,bt538" },
{ .compatible = "zinitix,bt541" },
{ .compatible = "zinitix,bt548" },
^ permalink raw reply
* [PATCH] HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
From: Andrei Fed @ 2026-07-06 17:55 UTC (permalink / raw)
To: Jiri Kosina, Benjamin Tissoires, linux-input
Cc: linux-kernel, Andrei Fed, stable
The Apple Magic Trackpad 2 (USB-C) reports a wildly wrong battery
capacity over Bluetooth, for example a constant 4% for a pack that is
actually at 74%.
The device's battery input report (0x90) is laid out as
[report-id][status][charge]. hid-input's synchronous capacity query,
hidinput_query_battery_capacity(), assumes the common
[report-id][capacity] layout and returns buf[1], which for this device
is the status byte rather than the charge (buf[2]).
magicmouse_fetch_battery(), which requests the battery report through
hid_hw_request() so the reply is decoded via the report descriptor at
the correct field offset, is gated to the USB models and never runs
over Bluetooth. The device does not push battery reports on its own
either, except a single one at connect time, which is delivered while
probe holds driver_input_lock and is silently dropped. All userspace
reads therefore go through the misparsing query, and the device is
stuck reporting its status byte as the capacity.
Enabling the fetch for Bluetooth is not sufficient on its own: user
space reacts to the power_supply registration immediately, so a query
is typically already in flight when the fetch reply is parsed.
hidinput_get_battery_property() stores the query result and marks the
battery as queried without rechecking whether a report arrived while
it was waiting, clobbering the just-reported correct value with the
misparsed one.
Fix this by adding HID_BATTERY_QUIRK_AVOID_QUERY for the Bluetooth
Magic Trackpad USB-C so the misparsing query path is never used, and
by fetching the battery at the end of probe for this device. hidp has
no asynchronous request() callback, so the fetch is serviced
synchronously via __hid_request() while probe still holds
driver_input_lock; call hid_device_io_start() first so the reply is
processed instead of being discarded.
Tested with a Magic Trackpad USB-C (004c:0324) over Bluetooth on
6.18.37: the reported capacity now matches the device (verified against
a raw GET_REPORT of report 0x90) and updates on reconnect.
Fixes: 87a2f10395c8 ("HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support")
Cc: stable@vger.kernel.org
Signed-off-by: Andrei Fed <andfed.net@gmail.com>
---
drivers/hid/hid-input.c | 3 +++
drivers/hid/hid-magicmouse.c | 19 ++++++++++++++++++-
2 files changed, 21 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 3487600..f78166f 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -375,6 +375,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
USB_DEVICE_ID_APPLE_MAGICTRACKPAD),
HID_BATTERY_QUIRK_IGNORE },
+ { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE,
+ USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC),
+ HID_BATTERY_QUIRK_AVOID_QUERY },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM,
USB_DEVICE_ID_ELECOM_BM084),
HID_BATTERY_QUIRK_IGNORE },
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index 802a347..0c4e959 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -828,6 +828,12 @@ static bool is_usb_magictrackpad2(__u32 vendor, __u32 product)
product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC;
}
+static bool is_bt_magictrackpad2(__u32 vendor, __u32 product)
+{
+ return vendor == BT_VENDOR_ID_APPLE &&
+ product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC;
+}
+
static int magicmouse_fetch_battery(struct hid_device *hdev)
{
#ifdef CONFIG_HID_BATTERY_STRENGTH
@@ -838,7 +844,8 @@ static int magicmouse_fetch_battery(struct hid_device *hdev)
bat = hid_get_battery(hdev);
if (!bat ||
(!is_usb_magicmouse2(hdev->vendor, hdev->product) &&
- !is_usb_magictrackpad2(hdev->vendor, hdev->product)))
+ !is_usb_magictrackpad2(hdev->vendor, hdev->product) &&
+ !is_bt_magictrackpad2(hdev->vendor, hdev->product)))
return -1;
report_enum = &hdev->report_enum[bat->report_type];
@@ -971,6 +978,16 @@ static int magicmouse_probe(struct hid_device *hdev,
schedule_delayed_work(&msc->work, msecs_to_jiffies(500));
}
+ /*
+ * Query the Bluetooth Magic Trackpad USB-C battery as done for USB.
+ * Start io first: probe holds driver_input_lock and the synchronous
+ * GET_REPORT reply would otherwise be dropped.
+ */
+ if (is_bt_magictrackpad2(id->vendor, id->product)) {
+ hid_device_io_start(hdev);
+ magicmouse_fetch_battery(hdev);
+ }
+
return 0;
err_stop_hw:
if (is_usb_magicmouse2(id->vendor, id->product) ||
--
2.54.0
^ permalink raw reply related
* Re: [PATCH v7 4/4] Input: Add TouchNetix aXiom I2C Touchscreen support
From: Uwe Kleine-König @ 2026-07-06 17:19 UTC (permalink / raw)
To: Marco Felsch
Cc: andrew.thomas, Luis Chamberlain, Russ Weight, Greg Kroah-Hartman,
Rafael J. Wysocki, Andrew Morton, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Dmitry Torokhov, Kamel Bouhara,
Marco Felsch, Henrik Rydberg, Danilo Krummrich, linux-kernel,
devicetree, linux-input, Mamta Shukla
In-Reply-To: <20260703-v6-10-topic-touchscreen-axiom-v7-4-0d2a550a7ee8@pengutronix.de>
[-- Attachment #1: Type: text/plain, Size: 237 bytes --]
Hallo Marco,
On Fri, Jul 03, 2026 at 12:32:25AM +0200, Marco Felsch wrote:
> +#include <linux/mod_devicetable.h>
Please don't add new users for this header file. Only use those
<linux/device-id/*.h> that you actually need.
Thanks
Uwe
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply
* Re: [PATCH] HID: bpf: Fix signedness bug in hid_bpf_hw_request
From: Emil Tsalapatis @ 2026-07-06 15:58 UTC (permalink / raw)
To: Guangshuo Li, Jiri Kosina, Benjamin Tissoires, Kees Cook,
Puranjay Mohan, Johan Hovold, linux-input, linux-kernel, bpf
In-Reply-To: <20260704160703.156298-1-lgs201920130244@gmail.com>
On Sat Jul 4, 2026 at 12:07 PM EDT, Guangshuo Li wrote:
> hid_bpf_hw_request() clamps the return value of hid_hw_raw_request() to
> the size of the caller supplied buffer before copying data back to the
> BPF buffer.
>
> However, ret is signed while size is unsigned. If hid_hw_raw_request()
> returns a negative error code, the comparison promotes ret to size_t.
> This makes the negative value look like a very large positive value, so
> the error is clamped to size. The following memcpy() then treats the
> failed request as a successful transfer and copies stale data back to
> the caller.
>
> Only clamp positive return values. This preserves negative error codes
> while still preventing oversized successful returns from overflowing the
> caller supplied buffer.
>
> Fixes: 2b658c1c442e ("HID: bpf: prevent buffer overflow in hid_hw_request")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
> drivers/hid/bpf/hid_bpf_dispatch.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hid/bpf/hid_bpf_dispatch.c b/drivers/hid/bpf/hid_bpf_dispatch.c
> index d0130658091b..b13f911e5944 100644
> --- a/drivers/hid/bpf/hid_bpf_dispatch.c
> +++ b/drivers/hid/bpf/hid_bpf_dispatch.c
> @@ -446,7 +446,7 @@ hid_bpf_hw_request(struct hid_bpf_ctx *ctx, __u8 *buf, size_t buf__sz,
> (u64)(long)ctx,
> true); /* prevent infinite recursions */
>
> - if (ret > size)
> + if (ret > 0 && ret > size)
> ret = size;
I think this is making the code more difficult to write. Why not add a
label right before the cleanup at the end of the function, then
jump to it on error like so:
if (ret < 0)
goto done;
if (ret > size)
ret = size;
if (ret > 0)
memcpy(...);
done:
kfree(dma_data);
return ret;
> if (ret > 0)
> memcpy(buf, dma_data, ret);
^ permalink raw reply
* Re: [PATCH] HID: i2c-hid: Fix "(null)" device name error logs in i2c_hid_parse
From: Mario Limonciello @ 2026-07-06 13:15 UTC (permalink / raw)
To: Ai Chao, jikos, bentiss, dianders, treapking, kenkinming2002,
raoxu
Cc: linux-input, linux-kernel
In-Reply-To: <20260706122910.3943372-1-aichao@kylinos.cn>
On 7/6/26 07:29, Ai Chao wrote:
> When i2c-hid fails to read the HID report descriptor during device
> initialization, the error message prints as:
>
> hid (null): reading report descriptor failed
>
> The HID device name is set in hid_add_device() after calling
> hdev->ll_driver->parse(), so when i2c_hid_parse() fails and calls
> hid_err(), the device name has not been set yet, resulting in "(null)"
> output.
>
> Use dev_err(&client->dev, ...) instead of hid_err(hid, ...) because
> the I2C client device is fully initialized with a proper name, providing
> meaningful error messages for debugging.
>
> Before: hid (null): reading report descriptor failed
> After: i2c_hid i2c-TPD0001:00: reading report descriptor failed
>
> Signed-off-by: Ai Chao <aichao@kylinos.cn>
I think it would be good to track down the Fixes tag that this goes with.
> ---
> drivers/hid/i2c-hid/i2c-hid-core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
> index 3adb16366e93..0e725a0f0abe 100644
> --- a/drivers/hid/i2c-hid/i2c-hid-core.c
> +++ b/drivers/hid/i2c-hid/i2c-hid-core.c
> @@ -792,7 +792,7 @@ static int i2c_hid_parse(struct hid_device *hid)
> ihid->hdesc.wReportDescRegister,
> rdesc, rsize);
> if (ret) {
> - hid_err(hid, "reading report descriptor failed\n");
> + dev_err(&client->dev, "reading report descriptor failed\n");
> goto out;
> }
> }
^ permalink raw reply
* [PATCH] HID: i2c-hid: Fix "(null)" device name error logs in i2c_hid_parse
From: Ai Chao @ 2026-07-06 12:29 UTC (permalink / raw)
To: jikos, bentiss, dianders, treapking, kenkinming2002, raoxu,
superm1
Cc: linux-input, linux-kernel, Ai Chao
When i2c-hid fails to read the HID report descriptor during device
initialization, the error message prints as:
hid (null): reading report descriptor failed
The HID device name is set in hid_add_device() after calling
hdev->ll_driver->parse(), so when i2c_hid_parse() fails and calls
hid_err(), the device name has not been set yet, resulting in "(null)"
output.
Use dev_err(&client->dev, ...) instead of hid_err(hid, ...) because
the I2C client device is fully initialized with a proper name, providing
meaningful error messages for debugging.
Before: hid (null): reading report descriptor failed
After: i2c_hid i2c-TPD0001:00: reading report descriptor failed
Signed-off-by: Ai Chao <aichao@kylinos.cn>
---
drivers/hid/i2c-hid/i2c-hid-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 3adb16366e93..0e725a0f0abe 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -792,7 +792,7 @@ static int i2c_hid_parse(struct hid_device *hid)
ihid->hdesc.wReportDescRegister,
rdesc, rsize);
if (ret) {
- hid_err(hid, "reading report descriptor failed\n");
+ dev_err(&client->dev, "reading report descriptor failed\n");
goto out;
}
}
--
2.34.1
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox