kernel/git/stable/linux.git/drivers/input/touchscreen, branch master

Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-08-25T16:38:50+00:00

Pull char/misc/IIO/etc driver updates from Greg KH: "Here is the big set of char, misc, iio, counter, fpga, and other small driver subsystems for 7.3-rc1. Overall, due to some driver removals we only added a bit more code than removed, which was a nice change. Highlights in this merge request are: - Loads of IIO driver updates and additions - binder driver updates (more on that below...) - Removal of the SGI XP and GRU drivers as they are not used anymore and turn out to be pretty insecure overall - Removal of the obsolete ibmasm driver as it's not being used anymore - Coresight driver updates and additions - Mei driver udpates - Counter driver updates - FPGA driver updates - ICC driver updates - lots and lots of other tiny driver updates to resolve reported issues All of these have been in linux-next for a while" * tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits) iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF iio: adc: pac1921: fix wrong channel used in trigger handler read iio: light: gp2ap002: re-enable irq if runtime suspend fails iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes iio: light: apds9306: fix PM reference leak in apds9306_read_data() iio: gyro: mpu3050: fix sign of raw angular velocity readings iio: srf04: fix pm_runtime handling on probe error path iio: adc: ad4080: configure backend data size iio: adc: adi-axi-adc: add data size support for AD408X backend iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable iio: dac: ad5446: fix OF module device table iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask iio: light: opt4001: Reject integration times with a non-zero seconds part iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() iio: light: opt4001: Fix power down clearing bits of the wrong register iio: light: opt4060: Fix incorrect register name in threshold read error message iio: light: opt4060: Fix pointer type passed to div_u64_rem() iio: light: opt4060: Reject integration times with a non-zero seconds part iio: light: ltrf216a: fix runtime PM reference leak in error path iio: pressure: dps310: fix NULL pointer dereference on ACPI probe ...

Merge tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next

2026-08-19T07:45:01+00:00

Jonathan writes: IIO new device support, features, cleanup for 7.3 Includes a merge of 7.2-rc2 to pick up the changes around mod_devicetable.h and reduce resulting conflicts around includes. New device support ------------------ adi,ad3530R - Add support for the AD3532R and AD3532 16 channel DACs. adi,ad4080 - Add support for the AD4883 ADC. adi,ad5686 - Add support for AD5313R, AD5317R, AD5674, AD5687R, AD5689, AD5689R DACs over SPI - Add support for AD5316R, AD5674, AD5697R and AD5696 DACs over I2C - Significant driver refactoring prior to these additions, partly to reduce bus traffic and to add triggered buffer and gain control support. An earlier set added support for missing supplies, reset and LDAC GPIO. adi,adf41513 - New driver to support this PLL frequency synthesizer that runs up to 26.5 GHz. - Included infrastructure to handle higher precision attributes with extensive tests adi,ltc2378-20 - New driver supporting LTC2338, LTC2364, LTC2367, LTC2368, LT2369, LTC2370 LTC2376, LTC2377, LTC2378, LTC2379 and LTC23980 ADCs with both high speed capture via appropriate backend and conventional triggered buffer SPI capture. invensense,icm42607 - New driver for this IMU. mediateck,mt6323 - New driver for this PMIC ADC. microchip,mcp47a1 - New driver for this I2C 6 bit DAC. nxp,mcf54415-dac - New driver for this DAC found in NXP SoCs. qst,qmc5884l - New driver for this 3 axis magnetometer. Included dt vendor entry for qst. qst,qmc6308 - New driver for this 3 axis magnetometer. sensiron,slf3s - New driver for this liquid flow sensor. Includes adding IIO_VOLUMEFLOW channel type. st,vl53l1x - Refactors to improve readability. ti,ads112c14 - New driver supporting the ADS112C14 and ADS122C14 ADCs. These bring some new ABI for input chopping, particular useful for resistive sensors like thermocouples or Wheatstone bridges. - Support CRC8 detection of corruption on the bus. - Support buffered reads. ti,tmp117 - (trivial) Add support for the tmp119 temperature sensor. xilinx,versal-sysmon - New ADC driver for this block found on various FPGAs including various bus interfaces, threshold and oversampling support. dt binding updates ------------------ new shared bindings - excitation-channels and excitation-current-nanoamp allow per channel specification of currents used for resistive sensor measurement. - reference-sources property to allow selection of a per channel reference. rockchip,saradc - Add RV1106 which is compatible with the RV3588. Features -------- buffer-dmaengine - Allow cyclic buffers, useful for repeating sequence generation with DACs. devantech,dmard09 - Implement read back of channel scale - previously interface always returned an error. hid,sensors-als - Enable separate channel scaling for hardware that supports it. invensense,timestamp library - Various precision improvements. invensense,icm42600 - Add support for hwfifo watermark interfaces. taos,tcs3472 - Support wait time and sampling frequency control. Cleanups, minor fixes --------------------- Minor cleanups not mentioned at all in this summary such as white space fixes or typos. Affecting various drivers - Cleanup of conditionals that had no affect. - Drop some runtime pm local wrappers as now runtime_pm does the mark_last_busy part inside the put, these provide no useful code deduplication or readability advantages over directly calling the runtime_pm functions. - Return 0 from write_raw() on success. - Use of dev_err_probe() to simplify code and sometimes provide useful info for deferred probe debugging. - Drop some redundant error prints where the called function already provides information on errors. - Make some read only arrays in functions static. - Fix up missing handling of regcache_sync() errors. - Drop some false kernel-doc markings. - Add missing MODULE_DEVICE_TABLE for some of_match_id tables. - Use local variables for things like the struct device to shorten and improve readability of code. - Drop some unused structure elements. - Reorder dds.h macro parameters to be inline with others. - Header reorders and IWYU. Often part of a more significant series. - Remove abstractions designed to allow a driver to support multiple device types, when they have been around a long time and only the original part showed up. - Initialize spi_device_id arrays using member names following dropping of driver data from drivers that didn't actually use it. - Catch up with i2c_device_id tables added since previous effort to use named initializers for all those. - Use kernel types in a few places instead of standard C ones or bare unsigned. Misc - Update Xilinx AMS maintainer. - Update email address for Maxwell Doose. - Update email address for Siratul Islam. - Update email address for Tomasz Duszynski and re-add Tomasz to various maintainer entries. Docs - Encourage use of differential channel naming even when there is no flexibility in input to differential pair mapping. Intended to provide a strong signal to userspace that a channel is differential. adi,ad_sigma_delta - Allow COMPILE_TEST without any users. adi,ad2s1201 - Refactor trigger handler to avoid mix of guard() and goto. adi,ad5686 - Avoid potential NULL dereference is user forces a driver bind. adi,ad5696 - Add a couple of missing entries to the of_match_id table and update binding to match. atmel,ad91_adc - Use const char * for DT string property allowing a cast to be dropped. avia,hx711 - Various refactors and cleanup to enable support of additional parts (to come) - Add missing supply and gpio dt-bindings. bosch,bmc150 - Harden against device reporting too large a FIFO sample count. - Use FIELD_PREP() / FIELD_GET() to improve readability. freescale,fxls8962af - Harden against device reporting too large a FIFO sample count. hid-sensors-* - Reorder probe to not expose userspace interfaces until the rest of the setup is done to avoid potentially dropping data. honeywell,abp2030pa - Drop an unreachable return. invensens,icm45600 - Harden against bad value of FIFO sample count from device. - Use i2c_match_data if firmware table sourced match data isn't available. nxp,mpl1115 - Ensure runtime_pm is balanced on error in probe. rohm,bm1390 - Make the driver slightly more likely to recover from transient errors. sensiron,sgp30 - Handle thread creation errors. st,lsm6dsx - Update the enable mask when doing sensor fusion to avoid incorrect fifo data handling. st,stm32-dfsdm - Treat dt flags as booleans. ti,ads1015 - Switch to devm helpers which simplified code and closed a resource leak. ti,opt3001 - Split complicated opt3001_get_processed() logic into irq an no irq helper functions. - Use devm to simplify code. - Use guard() to simplify code. - Reorder probe so final call exposes userspace interfaces. - Various other more minor cleanup taos,tsl2772 - Fix calibscale readback to check right channel type. taos,tsl2583 - Use sysfs_emit() and sysfs_emit_at() to replace open coded equivalents. * tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (232 commits) iio: dac: mcp47a1: add support for new device dt-bindings: iio: dac: add support for mcp47a1 iio: Update email for Maxwell Doose iio: imu: st_lsm6dsx: Update enable mask when using sensor fusion iio: light: cm32181: return zero after writing calibscale iio: flow: add Sensirion SLF3S liquid flow sensor driver iio: core: add IIO_VAL_DECIMAL64_FEMTO format type dt-bindings: iio: flow: add Sensirion SLF3S liquid flow sensor iio: types: add IIO_VOLUMEFLOW channel type iio: ABI: Encourage differential voltage ABI usage iio: adc: ltc2378: Add support for LTC2338-18 iio: adc: ltc2378: Enable triggered buffer data capture iio: adc: ltc2378: Enable high-speed data capture iio: adc: ltc2378: Add support for LTC2378-20 and similar ADCs dt-bindings: iio: adc: Add ltc2378 iio: magnetometer: ak8974: remove conditional return with no effect iio: light: tsl2583: remove conditional return with no effect iio: adc: rcar-gyroadc: remove rcar_gyroadc_set_power() helper iio: light: vcnl4000: remove vcnl4000_set_pm_runtime_state() helper iio: light: vcnl4035: remove vcnl4035_set_pm_runtime_state() helper ...

Merge branch 'next' into for-linus

2026-08-15T04:26:07+00:00

Prepare input updates for 7.3 merge window.

Input: sur40 - fix V4L error path cleanup

2026-08-13T00:51:54+00:00

In sur40_probe(), if video_register_device() fails, the error path jumps to err_unreg_video. This incorrectly attempts to unregister a video device that was never successfully registered, and fails to free the V4L2 control handler (v4l2_ctrl_handler_free) that was initialized immediately prior. Fix this by introducing an err_free_ctrl label to properly free the V4L2 control handler and bypass video_unregister_device() when video device registration fails. Reported-by: sashiko-bot@kernel.org Cc: stable@vger.kernel.org Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/20260616051235.1549517-2-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov

Input: sur40 - fix input device registration ordering

2026-08-13T00:51:48+00:00

In sur40_probe(), input_register_device() was previously called early before the V4L2 video device and vb2_queue components were fully initialized. If userspace opened the input device immediately upon registration, sur40_open() would trigger and start the sur40_poll() worker thread. This worker thread invokes sur40_process_video() and accesses the uninitialized vb2_queue structure, leading to a data race and potential system crash. Furthermore, if V4L2 or video registration failed after input_register_device() succeeded, the error path fell through to calling input_free_device() on a successfully registered device instead of input_unregister_device(), corrupting input core state. Move input_register_device() to the very end of sur40_probe(). This ensures the V4L2 and video queue structures are fully initialized before polling can start, and naturally resolves the error path bug since input_free_device() is now only called when input registration has not yet occurred. To maintain strict LIFO (Last-In, First-Out) teardown ordering, also move input_unregister_device() to the very beginning of sur40_disconnect(). This guarantees that the input polling worker thread is stopped before V4L2 video components or control handlers are unregistered. Reported-by: sashiko-bot@kernel.org Cc: stable@vger.kernel.org Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/20260616051235.1549517-1-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov

Input: hynitron_cstxxx - validate touch count and finger IDs

2026-08-04T04:51:42+00:00

The driver allocates max_touch_num input slots, which are indexed from zero through max_touch_num - 1. The current check allows a finger ID equal to max_touch_num to reach cst3xx_report_contact(). While the input core ignores out-of-range slot indices, reporting touch data without a valid slot change corrupts the touch state of the previously active slot. The touch count is read from the controller's report and is used to index the fixed-size report buffer without first checking its range. Reject counts larger than the supported number of touch slots before checking the trailing byte or parsing touch data. Reject finger IDs equal to or greater than max_touch_num, and return immediately when an invalid finger ID is encountered so that corrupt touch frames are discarded instead of reporting partial contact state. The V821 Avaota F1 board configures the vendor driver with one touch slot, so finger ID 1 is already invalid on that device. Fixes: 66603243f528 ("Input: add driver for Hynitron cstxxx touchscreens") Signed-off-by: Jianing Li Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260804031339.2379-1-m13940358460@163.com Assisted-by: Antigravity:gemini-3.6-flash Signed-off-by: Dmitry Torokhov

Input: inexio - replace printk with dev_dbg and fix missing space

2026-07-26T01:16:12+00:00

Replace printk(KERN_DEBUG) with dev_dbg() using the serio device, which is the correct logging style for driver code. Also fix missing space after comma in the function argument, and remove the redundant 'inexio.c:' filename prefix from the message. Signed-off-by: Bivash Kumar Singh Link: https://patch.msgid.link/20260725130803.6763-1-bivashraj750@gmail.com Signed-off-by: Dmitry Torokhov

Input: elo - fix coding style issues in elo_setup_10()

2026-07-26T01:13:53+00:00

Fix two checkpatch warnings in elo_setup_10(): - Add missing space around '-' operator in array index expression - Add missing 'const' qualifier to elo_types pointer array, since the array is never modified after initialization Signed-off-by: Bivash Kumar Singh Link: https://patch.msgid.link/20260725113638.5147-1-bivashraj750@gmail.com Signed-off-by: Dmitry Torokhov

Input: iqs5xx - validate firmware record destination span

2026-07-25T01:18:47+00:00

The firmware record parser checks that the record address starts within the programmable map, but does not check that the complete record data fits in that map. A record near the end of the map can therefore make the copy to pmap exceed its destination span. Check the record length against the remaining programmable map range before copying the record data. Fixes: 7b5bb55d0dad ("Input: add support for Azoteq IQS550/572/525") Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260715083850.32155-1-pengpeng@iscas.ac.cn Signed-off-by: Dmitry Torokhov

Input: edt-ft5x06 - ignore contacts with an out-of-range slot id

2026-07-23T17:41:54+00:00

The per-contact slot id is taken from the top nibble of the third report byte, so it can be any value from 0 to 15. The driver only allocates max_support_points MT slots (2 to 10 depending on the variant), so a report that carries an id at or above that count - be it a genuinely higher-numbered contact or a corrupted byte - is outside the range the input core was told about. input_mt_slot() silently ignores an ABS_MT_SLOT beyond num_slots and leaves the current slot unchanged, so the following input_mt_report_slot_state()/touchscreen_report_pos() pair is applied to whichever slot happened to be selected last, reporting the contact at the wrong position. Skip such entries instead. Signed-off-by: Alexandre Hamamdjian Link: https://patch.msgid.link/20260723-b4-ft5426-v2-1-cd2bed168051@gmail.com Signed-off-by: Dmitry Torokhov