Linux kernel stable tree https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux-stable.git/atom?h=linux-7.1.y 2026-07-18T14:55:49+00:00 2026-07-18T14:55:49+00:00 Bryam Vargas hexlabsecurity@proton.me 2026-06-14T05:36:12+00:00 urn:sha1:bfe622efecd4ff0a792d0ecd1a8dce535a902f50 commit d577e46785d45484b2ab7e7309c49b18764bf56c upstream. rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f30_attention() iterates the full f30->gpioled_count (device query register, range 0..31) and dereferences gpioled_key_map[i], and input->keycodemax is set to the full gpioled_count while input->keycode points at the 6-entry allocation. A device that reports gpioled_count > 6 with GPIO support enabled therefore causes an out-of-bounds read on the attention interrupt and out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which bound the index only against keycodemax. This is the same defect as the F3A handler, which was copied from F30. Size the keymap for the full gpioled_count; the mapping loop still assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries. Fixes: 3e64fcbdbd10 ("Input: synaptics-rmi4 - limit the range of what GPIOs are buttons") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Link: https://patch.msgid.link/20260614-b4-disp-818d6bda-v1-2-cf39a3615085@proton.me Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2026-07-18T14:55:49+00:00 Bryam Vargas hexlabsecurity@proton.me 2026-06-14T05:36:11+00:00 urn:sha1:64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42 commit 57c10915f2c16c90e0d46ad00876bf39ece40fc2 upstream. rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gpios() then allocates gpio_key_map with min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], and input->keycodemax is set to the full gpio_count while input->keycode points at the 6-entry allocation. A device that reports gpio_count > 6 therefore causes an out-of-bounds read of gpio_key_map[] on every attention interrupt, and out-of-bounds accesses through the input core's default keymap ioctls: EVIOCGKEYCODE reads past the buffer (leaking adjacent slab memory to user space) and EVIOCSKEYCODE writes a caller-controlled value past it, for any process able to open the evdev node, since input_default_getkeycode() and input_default_setkeycode() only bound the index against keycodemax. Size the keymap for the full gpio_count. The mapping loop is unchanged: it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END) entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills) and are skipped when reporting. Fixes: 9e4c596bfd00 ("Input: synaptics-rmi4 - add support for F3A") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Link: https://patch.msgid.link/20260614-b4-disp-818d6bda-v1-1-cf39a3615085@proton.me Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2026-07-18T14:55:48+00:00 Haoxiang Li haoxiang_li2024@163.com 2026-06-10T23:41:16+00:00 urn:sha1:43d61346c0402e43a09c8996eed54c293a14ed72 commit 6251f7d3472c0409e30f8d6a24f10d33d12e3f9a upstream. If rmi_register_physical_driver() fails, the current error path unregisters only the RMI bus. The function handlers registered earlier remain registered with the driver core. Add a separate error path to unregister the function handlers before unregistering the bus in this failure case. Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices") Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260610064633.2837084-1-haoxiang_li2024@163.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2026-04-04T15:24:32+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-04-04T15:24:32+00:00 urn:sha1:3aae9383f42f687221c011d7ee87529398e826b3 Pull input fixes from Dmitry Torokhov: - new IDs for BETOP BTP-KP50B/C and Razer Wolverine V3 Pro added to xpad controller driver - another quirk for new TUXEDO InfinityBook added to i8042 - a small fixup for Synaptics RMI4 driver to properly unlock mutex when encountering an error in F54 - an update to bcm5974 touch controller driver to reliably switch into wellspring mode * tag 'input-for-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode Input: xpad - add support for Razer Wolverine V3 Pro Input: synaptics-rmi4 - fix a locking bug in an error path Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Input: bcm5974 - recover from failed mode switch 2026-02-23T23:07:58+00:00 Bart Van Assche bvanassche@acm.org 2026-02-23T23:05:15+00:00 urn:sha1:7adaaee5edd35a423ae199c41b86bd1ed60ed483 Lock f54->data_mutex when entering the function statement since jumping to the 'error' label when checking report_size fails causes that mutex to be unlocked. This bug has been detected by the Clang thread-safety checker. Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics") Signed-off-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260223215118.2154194-16-bvanassche@acm.org Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 2026-02-22T01:09:51+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-02-22T00:37:42+00:00 urn:sha1:bf4afc53b77aeaa48b5409da5c8da6bb4eff7f43 This was done entirely with mindless brute force, using git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' | xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/' to convert the new alloc_obj() users that had a simple GFP_KERNEL argument to just drop that argument. Note that due to the extreme simplicity of the scripting, any slightly more complex cases spread over multiple lines would not be triggered: they definitely exist, but this covers the vast bulk of the cases, and the resulting diff is also then easier to check automatically. For the same reason the 'flex' versions will be done as a separate conversion. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 2026-02-21T09:02:28+00:00 Kees Cook kees@kernel.org 2026-02-21T07:49:23+00:00 urn:sha1:69050f8d6d075dc01af7a5f2f550a8067510366f This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org> 2025-09-08T13:39:41+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2025-09-06T16:17:58+00:00 urn:sha1:8742bebb846009af7a22e489fe99aced5e195b51 Headers should include definitions for types that they use. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 2025-08-21T19:00:59+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2025-08-06T18:16:51+00:00 urn:sha1:df595059d54383c42607b59f1f9ea74dade280fe A number of modules in the input subsystem use EXPORT_SYMBOL() and friends without explicitly including the corresponding header <linux/export.h>. While the build currently succeeds due to this header being pulled in transitively, this is not guaranteed to be the case in the future. Let's add the explicit include to make the dependencies clear and prevent future build breakage. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 2025-08-04T06:28:48+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2025-08-04T06:28:48+00:00 urn:sha1:a7bee4e7f78089c101be2ad51f4b5ec64782053e Merge an immutable branch between MFD, GPIO, Input and PWM to resolve conflicts for the merge window pull request.