| Age | Commit message (Collapse) | Author |
|---|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc/IIO/etc driver updates from Greg KH:
"Here is the big set of char, misc, iio, counter, fpga, and other small
driver subsystems for 7.3-rc1.
Overall, due to some driver removals we only added a bit more code
than removed, which was a nice change. Highlights in this merge
request are:
- Loads of IIO driver updates and additions
- binder driver updates (more on that below...)
- Removal of the SGI XP and GRU drivers as they are not used anymore
and turn out to be pretty insecure overall
- Removal of the obsolete ibmasm driver as it's not being used
anymore
- Coresight driver updates and additions
- Mei driver udpates
- Counter driver updates
- FPGA driver updates
- ICC driver updates
- lots and lots of other tiny driver updates to resolve reported
issues
All of these have been in linux-next for a while"
* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
iio: adc: pac1921: fix wrong channel used in trigger handler read
iio: light: gp2ap002: re-enable irq if runtime suspend fails
iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
iio: light: apds9306: fix PM reference leak in apds9306_read_data()
iio: gyro: mpu3050: fix sign of raw angular velocity readings
iio: srf04: fix pm_runtime handling on probe error path
iio: adc: ad4080: configure backend data size
iio: adc: adi-axi-adc: add data size support for AD408X backend
iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
iio: dac: ad5446: fix OF module device table
iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
iio: light: opt4001: Reject integration times with a non-zero seconds part
iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
iio: light: opt4001: Fix power down clearing bits of the wrong register
iio: light: opt4060: Fix incorrect register name in threshold read error message
iio: light: opt4060: Fix pointer type passed to div_u64_rem()
iio: light: opt4060: Reject integration times with a non-zero seconds part
iio: light: ltrf216a: fix runtime PM reference leak in error path
iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
Pull HID updates from Jiri Kosina:
"Core:
- fix long-standing force-feedback initialization race across the
subsystem (Dmitry Torokhov)
- switch to system_dfl_wq (Marco Crivellari)
AMD-SFH:
- support for tablet-mode switch for AMD SFH-based systems (Basavaraj
Natikar)
HyperX:
- support for HyperX QuadCast 2 (Benjamin Blume)
I2C-HID:
- support for devices that provide HID descriptor solely through
the ACPI _DSM method (XIE Zhibang)
Intel-THC-HID:
- support for full I2C bus config parameters (Even Xu)
Logitech:
- HID++ 2.0 repogrammable button support (Elliot Douglas)
- Bolt receiver support for HID++ devices (Erik Håkansson)
MSI:
- support for MSI Claw (Derek J. Clark)
Steam:
- initial support for 2026 Steam Controller (Vicki Pfau)
- support for sensor events on the 2025 Steam Controller (Vicki Pfau)
And many, many other fixes for various long standing issues that were
found by new modern tools, and quite a few device ID additions"
* tag 'hid-for-linus-2026081901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (146 commits)
HID: tmff: Use 64-bit arithmetic for force feedback scaling
HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU
HID: sensor: custom: Fix field sysfs group cleanup on failure
HID: sensor: custom: Fix use-after-free in enable_sensor
HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
HID: haptic: don't write an uninitialized value to unhandled usages
HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown
HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown
HID: steam: Zero out inputs when disabling gamepad mode
HID: steam: Clean up locking
HID: steam: Don't set feature reports when disconnecting
HID: steam: Fix wording of connect/disconnect logs
HID: steam: Initial 2026 Steam Controller support
HID: steam: Refactor registration
HID: logitech: add Bolt receiver support for Logitech HID++ devices
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
HID: universal-pidff: stop the device when force-feedback init fails
HID: haptic: move FF initialization into .input_configured()
HID: logitech-hidpp: move FF initialization to .input_configured()
HID: megaworld: move FF initialization to .input_configured()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio updates from Bartosz Golaszewski:
"GPIO core:
- extend the gpio-regmap abstraction layer with more features
allowing users to override configuration setting, translate
register values and masks and enable/disable interrupts
- extend GPIO kunit tests with suites verifying probe ordering by
software node devlink support and software node hogs
- shrink GPIO kunit initialization code
- coding style updates (remove commas from sentinels where
applicable)
- with all users now converted treewide to using real firmware node
links for software node GPIO lookup: remove the deprecated
label-matching mechanism from from GPIO core
- drop redundant return value check of nonseekable_open() in
gpiolib-cdev
- use IRQ trigger helpers where applicable
Driver updates:
- refactor error paths and logging in gpio-nomadik
- use more modern interfaces for getting resources in gpio-rockchip,
gpio-bt8xx and gpio-pca9570
- add missing MODULE_DEVICE_TABLE() to gpio-sifive and gpio-vf610
- drop unused FILONOFF macro from gpio-rcar
- extend build coverage of ioport GPIO drivers with COMPILE_TEST=y
- only enable the gpio-rtd driver by default with ARCH_REALTEK=y to
avoid bloating the build
- refactor coding style in several drivers
- use correct endianess translation in gpio-pcf85x
- add wake-up interrupt support to gpio-mvebu
- apply initial value in direction output setter in gpio-by-pinctrl
Misc:
- replace linux/gpio.h inclusions treewide with linux/gpio/legacy.h
which now exports all the deprecated APIs
- select GPIOLIB_LEGACY in Kconfig where required treewide
- use software nodes for gpio-keys in MFD drivers
Devicetree bindings:
- describe the realtek rtd1625 GPIO controller
- document new models for gpio-pca95xx and gpio-cadence
- document new property in gpio-rockchip"
* tag 'gpio-updates-for-v7.3-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (61 commits)
gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper
dt-bindings: gpio: rockchip,gpio-bank: Add rockchip,grf property
gpio: Use IRQ trigger mask helpers
gpio: allow COMPILE_TEST for IOPORT drivers
gpio: realtek: Add driver for Realtek DHC RTD1625 SoC
gpio: regmap: Add IRQ enable/disable helpers
gpio: regmap: Add set_config callback
gpio: regmap: Add value_xlate callback
gpio: regmap: Add gpio_regmap_operation to extend reg_mask_xlate callback
gpio: regmap: Order kernel-doc descriptions with the actual appearance
gpio: regmap: Apply default resource callbacks for regmap IRQ chip
gpio: regmap: Provide default IRQ resource request and release callbacks
Revert "gpio: realtek: Add driver for Realtek DHC RTD1625 SoC"
gpib: gpio: replace linux/gpio.h inclusion
Input: matrix_keyboard - replace linux/gpio.h inclusion
phy: replace linux/gpio.h inclusions
pcmcia: replace linux/gpio.h inclusions
ASoC: replace linux/gpio.h inclusions
mfd: replace linux/gpio.h inclusions
sh: replace linux/gpio.h inclusions
...
|
|
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next
Jonathan writes:
IIO new device support, features, cleanup for 7.3
Includes a merge of 7.2-rc2 to pick up the changes around
mod_devicetable.h and reduce resulting conflicts around includes.
New device support
------------------
adi,ad3530R
- Add support for the AD3532R and AD3532 16 channel DACs.
adi,ad4080
- Add support for the AD4883 ADC.
adi,ad5686
- Add support for AD5313R, AD5317R, AD5674, AD5687R, AD5689, AD5689R DACs
over SPI
- Add support for AD5316R, AD5674, AD5697R and AD5696 DACs over I2C
- Significant driver refactoring prior to these additions, partly to reduce
bus traffic and to add triggered buffer and gain control support. An
earlier set added support for missing supplies, reset and LDAC GPIO.
adi,adf41513
- New driver to support this PLL frequency synthesizer that runs up to
26.5 GHz.
- Included infrastructure to handle higher precision attributes with
extensive tests
adi,ltc2378-20
- New driver supporting LTC2338, LTC2364, LTC2367, LTC2368, LT2369, LTC2370
LTC2376, LTC2377, LTC2378, LTC2379 and LTC23980 ADCs with both high speed
capture via appropriate backend and conventional triggered buffer SPI
capture.
invensense,icm42607
- New driver for this IMU.
mediateck,mt6323
- New driver for this PMIC ADC.
microchip,mcp47a1
- New driver for this I2C 6 bit DAC.
nxp,mcf54415-dac
- New driver for this DAC found in NXP SoCs.
qst,qmc5884l
- New driver for this 3 axis magnetometer. Included dt vendor entry for qst.
qst,qmc6308
- New driver for this 3 axis magnetometer.
sensiron,slf3s
- New driver for this liquid flow sensor. Includes adding IIO_VOLUMEFLOW
channel type.
st,vl53l1x
- Refactors to improve readability.
ti,ads112c14
- New driver supporting the ADS112C14 and ADS122C14 ADCs. These bring
some new ABI for input chopping, particular useful for resistive sensors
like thermocouples or Wheatstone bridges.
- Support CRC8 detection of corruption on the bus.
- Support buffered reads.
ti,tmp117
- (trivial) Add support for the tmp119 temperature sensor.
xilinx,versal-sysmon
- New ADC driver for this block found on various FPGAs including various
bus interfaces, threshold and oversampling support.
dt binding updates
------------------
new shared bindings
- excitation-channels and excitation-current-nanoamp allow per channel
specification of currents used for resistive sensor measurement.
- reference-sources property to allow selection of a per channel reference.
rockchip,saradc
- Add RV1106 which is compatible with the RV3588.
Features
--------
buffer-dmaengine
- Allow cyclic buffers, useful for repeating sequence generation with DACs.
devantech,dmard09
- Implement read back of channel scale - previously interface always
returned an error.
hid,sensors-als
- Enable separate channel scaling for hardware that supports it.
invensense,timestamp library
- Various precision improvements.
invensense,icm42600
- Add support for hwfifo watermark interfaces.
taos,tcs3472
- Support wait time and sampling frequency control.
Cleanups, minor fixes
---------------------
Minor cleanups not mentioned at all in this summary such
as white space fixes or typos.
Affecting various drivers
- Cleanup of conditionals that had no affect.
- Drop some runtime pm local wrappers as now runtime_pm does the
mark_last_busy part inside the put, these provide no useful code
deduplication or readability advantages over directly calling the
runtime_pm functions.
- Return 0 from write_raw() on success.
- Use of dev_err_probe() to simplify code and sometimes provide useful
info for deferred probe debugging.
- Drop some redundant error prints where the called function already
provides information on errors.
- Make some read only arrays in functions static.
- Fix up missing handling of regcache_sync() errors.
- Drop some false kernel-doc markings.
- Add missing MODULE_DEVICE_TABLE for some of_match_id tables.
- Use local variables for things like the struct device to shorten and
improve readability of code.
- Drop some unused structure elements.
- Reorder dds.h macro parameters to be inline with others.
- Header reorders and IWYU. Often part of a more significant series.
- Remove abstractions designed to allow a driver to support multiple device
types, when they have been around a long time and only the original part
showed up.
- Initialize spi_device_id arrays using member names following dropping of
driver data from drivers that didn't actually use it.
- Catch up with i2c_device_id tables added since previous effort to use
named initializers for all those.
- Use kernel types in a few places instead of standard C ones or bare
unsigned.
Misc
- Update Xilinx AMS maintainer.
- Update email address for Maxwell Doose.
- Update email address for Siratul Islam.
- Update email address for Tomasz Duszynski and re-add Tomasz to
various maintainer entries.
Docs
- Encourage use of differential channel naming even when there is no
flexibility in input to differential pair mapping. Intended to
provide a strong signal to userspace that a channel is differential.
adi,ad_sigma_delta
- Allow COMPILE_TEST without any users.
adi,ad2s1201
- Refactor trigger handler to avoid mix of guard() and goto.
adi,ad5686
- Avoid potential NULL dereference is user forces a driver bind.
adi,ad5696
- Add a couple of missing entries to the of_match_id table and update
binding to match.
atmel,ad91_adc
- Use const char * for DT string property allowing a cast to be dropped.
avia,hx711
- Various refactors and cleanup to enable support of additional parts
(to come)
- Add missing supply and gpio dt-bindings.
bosch,bmc150
- Harden against device reporting too large a FIFO sample count.
- Use FIELD_PREP() / FIELD_GET() to improve readability.
freescale,fxls8962af
- Harden against device reporting too large a FIFO sample count.
hid-sensors-*
- Reorder probe to not expose userspace interfaces until the rest of
the setup is done to avoid potentially dropping data.
honeywell,abp2030pa
- Drop an unreachable return.
invensens,icm45600
- Harden against bad value of FIFO sample count from device.
- Use i2c_match_data if firmware table sourced match data isn't available.
nxp,mpl1115
- Ensure runtime_pm is balanced on error in probe.
rohm,bm1390
- Make the driver slightly more likely to recover from transient errors.
sensiron,sgp30
- Handle thread creation errors.
st,lsm6dsx
- Update the enable mask when doing sensor fusion to avoid incorrect fifo
data handling.
st,stm32-dfsdm
- Treat dt flags as booleans.
ti,ads1015
- Switch to devm helpers which simplified code and closed a resource leak.
ti,opt3001
- Split complicated opt3001_get_processed() logic into irq an no irq
helper functions.
- Use devm to simplify code.
- Use guard() to simplify code.
- Reorder probe so final call exposes userspace interfaces.
- Various other more minor cleanup
taos,tsl2772
- Fix calibscale readback to check right channel type.
taos,tsl2583
- Use sysfs_emit() and sysfs_emit_at() to replace open coded equivalents.
* tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (232 commits)
iio: dac: mcp47a1: add support for new device
dt-bindings: iio: dac: add support for mcp47a1
iio: Update email for Maxwell Doose
iio: imu: st_lsm6dsx: Update enable mask when using sensor fusion
iio: light: cm32181: return zero after writing calibscale
iio: flow: add Sensirion SLF3S liquid flow sensor driver
iio: core: add IIO_VAL_DECIMAL64_FEMTO format type
dt-bindings: iio: flow: add Sensirion SLF3S liquid flow sensor
iio: types: add IIO_VOLUMEFLOW channel type
iio: ABI: Encourage differential voltage ABI usage
iio: adc: ltc2378: Add support for LTC2338-18
iio: adc: ltc2378: Enable triggered buffer data capture
iio: adc: ltc2378: Enable high-speed data capture
iio: adc: ltc2378: Add support for LTC2378-20 and similar ADCs
dt-bindings: iio: adc: Add ltc2378
iio: magnetometer: ak8974: remove conditional return with no effect
iio: light: tsl2583: remove conditional return with no effect
iio: adc: rcar-gyroadc: remove rcar_gyroadc_set_power() helper
iio: light: vcnl4000: remove vcnl4000_set_pm_runtime_state() helper
iio: light: vcnl4035: remove vcnl4035_set_pm_runtime_state() helper
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-next
Linux 7.2
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:
- A couple of fixes to the sur40 touchscreen driver to correct
registration and teardown ordering, and to fix error path
unwinding when video device registration fails.
* tag 'input-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: sur40 - fix V4L error path cleanup
Input: sur40 - fix input device registration ordering
|
|
Prepare input updates for 7.3 merge window.
|
|
Report whether an AMD convertible is in laptop or tablet mode using the
operating-mode sensor provided by the Sensor Fusion Hub, and expose it
to userspace as SW_TABLET_MODE, so userspace can react to the device
being folded into tablet posture.
Cc: Helge Bahmann <hcb@chaoticmind.net>
Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
Platform data may define touchscreen-x-mm and touchscreen-y-mm, but
these were quietly overridden by data provided by sensor.
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260731-respect-x-y-mm-v1-0-3e85a4bec745@ixit.cz
Link: https://patch.msgid.link/20260806-respect-x-y-mm-v2-1-e0681ed3d63c@ixit.cz
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
In sur40_probe(), if video_register_device() fails, the error path jumps to
err_unreg_video. This incorrectly attempts to unregister a video device
that was never successfully registered, and fails to free the V4L2 control
handler (v4l2_ctrl_handler_free) that was initialized immediately prior.
Fix this by introducing an err_free_ctrl label to properly free the V4L2
control handler and bypass video_unregister_device() when video device
registration fails.
Reported-by: sashiko-bot@kernel.org
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260616051235.1549517-2-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
In sur40_probe(), input_register_device() was previously called early before
the V4L2 video device and vb2_queue components were fully initialized. If
userspace opened the input device immediately upon registration, sur40_open()
would trigger and start the sur40_poll() worker thread. This worker thread
invokes sur40_process_video() and accesses the uninitialized vb2_queue
structure, leading to a data race and potential system crash.
Furthermore, if V4L2 or video registration failed after input_register_device()
succeeded, the error path fell through to calling input_free_device() on a
successfully registered device instead of input_unregister_device(), corrupting
input core state.
Move input_register_device() to the very end of sur40_probe(). This ensures
the V4L2 and video queue structures are fully initialized before polling can
start, and naturally resolves the error path bug since input_free_device()
is now only called when input registration has not yet occurred.
To maintain strict LIFO (Last-In, First-Out) teardown ordering, also move
input_unregister_device() to the very beginning of sur40_disconnect(). This
guarantees that the input polling worker thread is stopped before V4L2
video components or control handlers are unregistered.
Reported-by: sashiko-bot@kernel.org
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260616051235.1549517-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Sort the include statements before adding new ones in the next change.
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://patch.msgid.link/20260811122011.3539250-3-wenst@chromium.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Reduce update time by optimizing the update sequence and removing
unnecessary delays.
Signed-off-by: jingle.wu@emc.com.tw
Link: https://patch.msgid.link/KL1PR01MB5116A253A126179473EDB7ACDCCA2@KL1PR01MB5116.apcprd01.prod.exchangelabs.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input updates from Dmitry Torokhov:
- Fixes for information leaks and OOB accesses across several drivers,
including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra
- Improvements to the synaptics-rmi4 driver to properly handle F54
worker errors and prevent buffer overflows
- Input validation fixes in the hynitron_cstxxx touchscreen driver to
prevent issues with invalid finger IDs and touch counts
- Fixes for use-after-free and initialization bugs in the byd mouse and
psxpad-spi drivers
- New quirks for the atkbd driver to make keyboard work on HONOR and
Xiaomi laptops
- Support for the ZENAIM LEVERLESS controller in the xpad driver.
* tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: evdev - sanitize event type index when fetching event masks
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
Input: synaptics-rmi4 - zero report size on F54 work error
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
Input: hynitron_cstxxx - validate touch count and finger IDs
Input: evdev - fix information leak in evdev_pass_values()
fixp-arith: convert comments to kernel-doc format
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Input: atkbd - skip deactivate for HONOR ZQC-P
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
Input: iforce - validate input packet lengths
Input: psxpad-spi - set driver data before use
Input: cs40l50-vibra - validate custom data from user space
Input: xpad - add support for ZENAIM LEVERLESS
Input: edt-ft5x06 - ignore contacts with an out-of-range slot id
Input: byd - synchronize timer deletion before freeing private data
|
|
The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK
ioctls is used to index the static counts array in evdev_get_mask_cnt()
and client evmasks array in evdev_get_mask().
While the event type is architecturally bounded by EV_CNT, speculative
execution may mispredict bounds checks and perform out-of-bounds loads.
Sanitize the event type index in evdev_get_mask_cnt() branchlessly using
array_index_mask_nospec(). This clamps the index to 0 for safe array
access and forces the returned count to 0 speculatively when the index
is out of bounds.
We do not need additional array_index_nospec() calls in evdev_get_mask()
because evdev_get_mask_cnt() speculatively forces the count (and
resulting xfer_size) to 0 for out-of-bounds types, preventing any
speculative memory access to client evmasks array.
Reported-by: "Wagenaar, C.C.J. (Chris)" <c.c.j.wagenaar@vu.nl>
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.6-flash
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/anFCAfvxwXB5eJF1@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
When an input device is being unregistered via input_unregister_device(),
input_disconnect_device() sets dev->going_away = true under dev->mutex
and releases the mutex.
If a concurrent sysfs write to the inhibited attribute executes
input_inhibit_device() or input_uninhibit_device(), it acquires
dev->mutex. Because neither function checks dev->going_away (unlike
input_open_device()), input_uninhibit_device() proceeds to call
dev->open() and start polling on a device that is in the middle of being
unregistered and torn down.
Fix this by checking dev->going_away in input_inhibit_device() and
input_uninhibit_device() under dev->mutex and returning -ENODEV if the
device is going away.
Fixes: a181616487db ("Input: Add "inhibited" property")
Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.6-flash
Link: https://patch.msgid.link/anEolqA35rGei9ql@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
When registering an input handle, handler->start() is currently called
immediately. However, the input device might not be fully opened or
ready to process events at this stage, meaning any state synchronization
events (like setting LED states) injected by the handler's start method
might be dropped.
Move the handler->start() invocation to input_open_device(). If it is
the first handle opening the device, start() is called after the driver's
open() method has successfully completed and the device is fully prepared.
To facilitate this, factor out the device startup logic (calling driver's
open and starting polling) into input_start_device().
For passive observer handlers, their start() method is also deferred
until the handle is opened. Since opening a passive observer handle does
not start the underlying hardware device, their start() method is called
immediately upon opening, regardless of whether the device is active.
Fixes: c7e8dc6ee6d5 ("Input: add start() method to input handlers")
Link: https://patch.msgid.link/20260803005210.1251102-4-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
When an input device is inhibited via input_inhibit_device(), the driver
is closed and physical feedback (like LEDs and sounds) is toggled off.
However, from the input core's perspective, the handles remain open.
When the device is later uninhibited, the driver is re-opened. While the
core restores simple LED states via input_dev_toggle(), complex handlers
(such as vt/keyboard) may need to re-synchronize their broader logical
state with the hardware.
Fixes: a181616487db ("Input: Add "inhibited" property")
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260803005210.1251102-3-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
When uninhibiting a device, we previously called dev->open() and started
the poller before clearing dev->inhibited. Since drivers (like
gpio_keys) often report initial state during open(), and pollers report
events immediately upon starting, these initial events were dropped by
input_get_disposition() because dev->inhibited was still true.
Fix this by clearing dev->inhibited before calling dev->open(), ensuring
initial events are delivered to handlers, and restoring dev->inhibited =
true if dev->open() fails.
Fixes: a181616487db ("Input: Add "inhibited" property")
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260803005210.1251102-2-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
When a device is opened via input_open_device(), the driver's open()
callback is invoked. Some drivers, like cm109, submit URBs or perform
other hardware initialization in their open() callbacks.
However, the input core does not prevent dev->event() from being called
concurrently during the driver's open() execution. For instance, if a
console beep occurs, the kbd handler might inject an EV_SND event. This
can lead to double list_add BUGs if the driver submits the same URB in
both open() and event() paths without adequate synchronization.
To fix this, introduce a ready flag in the input_dev structure.
For complex devices (where dev->open is defined), this flag is set to true
only after the driver's open() method successfully completes. The core now
checks ready in input_event_dispose() and input_dev_toggle()
to prevent events from reaching the hardware before it is fully prepared.
For simple devices (no open callback), events are delivered immediately.
We also replay the logical state in input_open_device() by calling
input_dev_toggle() right after marking the device ready, ensuring no
events are permanently lost.
In the inhibit path, we ensure that physical feedback (LEDs/sounds) is
turned off before the device is closed, and we synchronize the inhibited
state transition under the event lock to prevent races with incoming events.
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260803005210.1251102-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Instead of hardcoding PA-RISC specific keycode tables into atkbd via
compile-time inclusion, have the gscps2 PS/2 port driver attach a
linux,keymap software node device property to the serio device when
a keyboard port is registered. This allows atkbd to dynamically fetch
and apply the custom keymap when probing the port using generic
firmware property helpers, removing architecture-specific hacks from
generic keyboard driver code.
Co-locate the keymap definitions with the serio port driver by moving
hpps2atkbd.h from drivers/input/keyboard/ to drivers/input/serio/.
To handle the five conflicting keys on RDI PrecisionBook laptops without
runtime model string checks or duplicate keymap tables in memory, add
CONFIG_SERIO_GSCPS2_RDI_KEYCODES to drivers/input/serio/Kconfig and
resolve the conflicting keycodes at compile time via preprocessor
macros.
Link: https://patch.msgid.link/am_9BvmZu9g4RlUM@google.com
Acked-by: Helge Deller <deller@gmx.de>
Tested-by: Helge Deller <deller@gmx.de>
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Previously, rmi_f54_buffer_queue() waited for the worker thread to
finish but ignored whether it succeeded. If the worker failed (e.g.,
due to a timeout or register read failure), the queue thread would
silently return success, delivering stale or uninitialized memory to
userspace.
Add a 'report_error' field to struct f54_data to store the worker's exit
status. Check this field in rmi_f54_buffer_queue() after the worker
finishes, and mark the buffer as VB2_BUF_STATE_ERROR if an error
occurred.
Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics")
Reported-by: sashiko-bot@kernel.org
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260626051802.4033172-6-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
error is always zero at the last return in synaptics_i2c_reg_set().
Explicitly return 0 on the success path instead of returning error,
which is the preferred way when there are multiple failure points.
No functional change.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Link: https://patch.msgid.link/20260729171001.260698-4-ekffu200098@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Both branches of the check return the same value, so the check has no
effect. Remove it and return the value directly.
This is the result of running the Coccinelle script from
scripts/coccinelle/misc/cond_return_no_effect.cocci.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Link: https://patch.msgid.link/20260729171001.260698-3-ekffu200098@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Both branches of the check return the same value, so the check has no
effect. Remove it and return the value directly.
This is the result of running the Coccinelle script from
scripts/coccinelle/misc/cond_return_no_effect.cocci.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Link: https://patch.msgid.link/20260729171001.260698-2-ekffu200098@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Changing the input (diagnostic report type) mid-stream changes the
report size. Since V4L2 buffers are allocated based on the size at
stream start, changing the input while streaming could lead to a
heap buffer overflow if the new size is larger than the allocated
buffers.
Prevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue
is busy (streaming).
Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics")
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Link: https://patch.msgid.link/20260626051802.4033172-5-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
rmi_f54_work() reads a diagnostics report from the device into
f54->report_data, sizing the transfer with rmi_f54_get_report_size():
report_size = rmi_f54_get_report_size(f54);
...
for (i = 0; i < report_size; i += F54_REPORT_DATA_SIZE) {
int size = min(F54_REPORT_DATA_SIZE, report_size - i);
...
rmi_read_block(.., f54->report_data + i, size);
}
report_data is allocated once at probe from F54's own electrode counts
(array3_size(f54->num_tx_electrodes, f54->num_rx_electrodes, sizeof(u16))),
but rmi_f54_get_report_size() computes the size from
drv_data->num_*_electrodes when those are set, i.e. from the F55
function's electrode counts. Both counts come straight from device
queries (F54 and F55 each report up to 255 electrodes) and nothing
constrains the F55 counts to the F54 ones.
A malicious or malfunctioning RMI4 device that reports larger F55
electrode counts than its F54 counts makes report_size exceed the
allocation, so the read loop writes past report_data (and the V4L2
dequeue memcpy() then reads past it). On conforming hardware the F55
configured electrodes are a subset of the F54 physical electrodes, so
report_size never exceeds the buffer and well-behaved devices are
unaffected.
Record the allocation size and reject a report that does not fit,
mirroring the existing zero-size check.
Fixes: c762cc68b6a1 ("Input: synaptics-rmi4 - propagate correct number of rx and tx electrodes to F54")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260626051802.4033172-3-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
In rmi_f54_work(), if an error occurs during report request or command
verification, the code jumped directly to the 'error' label, bypassing
the 'abort' label where f54->report_size was normally zeroed out.
This left f54->report_size containing its previous successful payload
size. If a user then altered the V4L2 format to a smaller size, and a
subsequent run failed, rmi_f54_buffer_queue() would copy the stale,
larger payload size into the shrunken V4L2 buffer, causing a heap
buffer overflow.
Fix this by merging the 'abort' and 'error' labels into a single 'out'
exit path, and ensuring that f54->report_size is always set to 0 on
failure by checking for error and zeroing the local report_size first.
Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics")
Cc: stable@vger.kernel.org
Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260626051802.4033172-2-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
During F55 sensor detection, the transmitter (TX) electrode count was
incorrectly assigned the value of the receiver (RX) electrode count
due to copy-paste typos.
This incorrect value was then propagated to the driver data and used
by F54 to determine the diagnostics report size. On devices with more
RX than TX electrodes, this inflated the perceived TX count, leading
to incorrect report size calculations and potential out-of-bounds
buffer accesses.
Fix the typos by correctly assigning the TX electrode counts.
Fixes: 6adba43fd222 ("Input: synaptics-rmi4 - add support for F55 sensor tuning")
Fixes: c762cc68b6a1 ("Input: synaptics-rmi4 - propagate correct number of rx and tx electrodes to F54")
Reported-by: sashiko-bot@kernel.org
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260626051802.4033172-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
focaltech_finger_state stores finger coordinates x and y as unsigned
int. When processing relative packets, negative deltas can cause
unsigned integer underflow if the finger moves past the left or bottom
boundary of the touchpad, wrapping the coordinates to values near
UINT_MAX.
When clamping the coordinates in focaltech_report_state(), these
underflowed values are clamped against priv->x_max / priv->y_max instead
of 0, causing the cursor to jump erratically to the opposite edge of the
touchpad.
Change the coordinate variables and limits to signed int so that
negative values resulting from relative movements clamp correctly to 0,
and write the clamped values back to state in focaltech_report_state()
to prevent coordinate wind-up accumulation at the touchpad boundaries.
Fixes: 05be1d079ec0 ("Input: psmouse - support for the FocalTech PS/2 protocol extensions")
Reported-by: sashiko-bot@kernel.org
Link: https://patch.msgid.link/am_tH_F938rK6ask@google.com
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
The driver allocates max_touch_num input slots, which are indexed from
zero through max_touch_num - 1. The current check allows a finger ID
equal to max_touch_num to reach cst3xx_report_contact(). While the input
core ignores out-of-range slot indices, reporting touch data without a
valid slot change corrupts the touch state of the previously active slot.
The touch count is read from the controller's report and is used to
index the fixed-size report buffer without first checking its range.
Reject counts larger than the supported number of touch slots before
checking the trailing byte or parsing touch data.
Reject finger IDs equal to or greater than max_touch_num, and return
immediately when an invalid finger ID is encountered so that corrupt
touch frames are discarded instead of reporting partial contact state.
The V821 Avaota F1 board configures the vendor driver with one touch
slot, so finger ID 1 is already invalid on that device.
Fixes: 66603243f528 ("Input: add driver for Hynitron cstxxx touchscreens")
Signed-off-by: Jianing Li <m13940358460@163.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260804031339.2379-1-m13940358460@163.com
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
In evdev_pass_values(), the input_event structure is allocated on the
kernel stack and populated field-by-field. However, it is never fully
initialized. On architectures where struct input_event contains explicit
or implicit padding (such as the 32-bit __pad field on SPARC64), these
padding bytes are left uninitialized.
When this event structure is subsequently passed to the client buffer
and later copied to userspace, the uninitialized padding bytes leak
kernel stack memory, potentially exposing sensitive information.
Similar issues exist in __evdev_queue_syn_dropped and __pass_event.
Fix this by explicitly zeroing the entire event structure with memset()
before populating its fields. This ensures all padding bytes are cleared
before the data crosses the security boundary.
Reported-by: sashiko-bot@kernel.org
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/ampGGKo4UMKru6f5@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Replace manual serialization with guard(mutex) and guard(serio_pause_rx)
where appropriate. This eliminates the need for explicit goto-based error
paths.
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260727050803.1269941-4-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Rewrite psmouse_matches_pnp_id() to parse and match the space-separated
PNP ID string directly in place without dynamic memory allocation.
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260727050803.1269941-3-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
In the past, psmouse_disconnect() used cancel_work_sync(). Because
cancel_work_sync() must be called with the psmouse_mutex dropped, and we
needed to prevent psmouse_receive_byte() from re-queueing the work
behind our back, the code transitioned the device to PSMOUSE_CMD_MODE
while holding the mutex, then dropped the mutex and cancelled the work.
When cancel_work_sync() was replaced with disable_work_sync() in this
path, the mutex juggling remained. However, disable_work_sync()
inherently prevents the work from being executed or re-queued, making
the mutex juggling unnecessary.
Clean this up by moving disable_work_sync() to the very top of
psmouse_disconnect(), before we acquire psmouse_mutex.
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260727050803.1269941-2-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
When a PS/2 mouse is disconnected or unbound, psmouse_disconnect() calls
the protocol disconnect handler (psmouse->disconnect()). During this time,
stray bytes arriving from the physical controller can still be passed to
psmouse_handle_byte(), which will invoke psmouse->protocol_handler().
This creates an asynchronous race condition with vendor disconnect handlers
(such as synaptics_disconnect()), which free vendor-specific private
structures (psmouse->private). If a byte arrives while the structures
are being freed, it leads to a use-after-free or NULL pointer
dereference in the protocol handler.
Fix this by explicitly setting psmouse->protocol_handler to NULL
safely wrapped in scoped_guard(serio_pause_rx, serio) immediately before
calling the vendor disconnect handler. We also add an unlikely check
in psmouse_handle_byte() to safely drop incoming bytes if the protocol
handler is NULL.
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260727050803.1269941-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Simplify the driver by using the block-scope guard(pm_runtime_active)
instead of manually invoking pm_runtime_get_sync() and
pm_runtime_put().
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260713-samsung-kp-irq-v2-3-acc84b6daf9a@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
The driver requests the interrupt during probe, which by default enables
it. If the bootloader left the keypad interrupts enabled, or if a
spurious interrupt fires early before the driver is fully initialized
and clocks are enabled, the interrupt handler will attempt to read
registers and may cause a synchronous external abort.
Fix this by requesting the interrupt with IRQF_NO_AUTOEN, keeping it
disabled during probe. Enable the interrupt in samsung_keypad_start()
when the device is opened and ready, and disable it in
samsung_keypad_stop() when the device is closed. Remove the redundant
re-enabling of the interrupt at the end of samsung_keypad_stop().
Additionally, manually clear the pending interrupt status during system
resume when the device is closed to avoid immediate resume.
Fixes: 0fffed27f92d ("Input: samsung-keypad - Add samsung keypad driver")
Assisted-by: Antigravity:gemini-3.1-pro
Link: https://patch.msgid.link/20260713-samsung-kp-irq-v2-2-acc84b6daf9a@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
When checking if the device can wake the system, we should pull the
device_may_wakeup() check to the caller instead of repeating it inside
the toggle_wakeup() handler. Furthermore, when configuring the wakeup,
we should safely ensure we write to the registers in the correct order:
configure the interrupt receiver before enabling the peripheral's wake
functionality, and vice-versa.
Assisted-by: Antigravity:gemini-3.1-pro
Link: https://patch.msgid.link/20260713-samsung-kp-irq-v2-1-acc84b6daf9a@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Make finger2 (and also finger1) unsigned, so that if the finger index in
the packet is 0 then subtracting 1 creates an array index which overflows
above the existing check for FOC_MAX_FINGERS, as the existing comment says
it should, instead of writing to state->fingers[-1].
Fixes: 05be1d079ec0 ("Input: psmouse - support for the FocalTech PS/2 protocol extensions")
Signed-off-by: Richard Davies <richard@arachsys.com>
Link: https://patch.msgid.link/20260701190932.14960-1-richard@arachsys.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
The internal keyboard on the HONOR ZQC-P (HONOR MagicBook Pro 14 2026)
does not work after boot.
Using the kernel command line 'i8042.dumbkbd=1' makes the keyboard
functional, but the CapsLock LED does not work. Adding the
'atkbd_deactivate_fixup' quirk fixes the keyboard and CapsLock LED
natively without requiring boot parameters.
DMI: HONOR ZQC-P/ZQC-P-PCB, BIOS 1.09 03/19/2026
Fixes: 9cf6e24c9fbf ("Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID")
Signed-off-by: Donglin Lyu <donglin_lyu@outlook.com>
Tested-by: Ruslan Shevchenko <adefka@gmail.com>
Link: https://patch.msgid.link/20260801151115.52709-1-donglin_lyu@outlook.com
Cc: stable@vger.kernel.org
[dtor: keep all HONOR entries together]
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
The internal keyboard of the Xiaomi Book Pro 14 does not work unless
atkbd skips deactivating it at the end of atkbd_probe().
Using 'i8042.dumbkbd=1' also makes the keyboard work, but then the driver
never writes to the keyboard at all, so the Caps Lock LED is lost. The
atkbd_deactivate_fixup quirk fixes both without a boot parameter.
DMI: XIAOMI Xiaomi Book Pro 14/TM2424, BIOS XMAPT4B0P0909 05/06/2026
Signed-off-by: Zhefu Zhang <a723356@gmail.com>
Reviewed-by: Andrew Zhou <zhoulol888@gmail.com>
Link: https://patch.msgid.link/20260802031559.19701-1-a723356@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground into gpio/for-next
gpio: legacy interface cleanups for 7.3
These are the remaining patches for legacy gpio interface
cleanup, ensuring that files referencing them are sure to
have CONFIG_GPIOLIB_LEGACY set, and use linux/gpio/legacy.h
instead of the old linux/gpio.h header.
There are a few more patches already merged in other
branches for 7.3, including soc, led, net and media. Once
everything is in, we can apply the final patches to turn
off CONFIG_GPIOLIB_LEGACY by default and remove the obsolete
header file.
This branch is based on the immutable ib-mfd-legacy-gpio-7.3
branch from mfd.git to avoid a conflict in the rohm drivers.
|
|
Replace printk(KERN_DEBUG) with dev_dbg() using the serio device,
which is the correct logging style for driver code. Also fix missing
space after comma in the function argument, and remove the redundant
'inexio.c:' filename prefix from the message.
Signed-off-by: Bivash Kumar Singh <bivashraj750@gmail.com>
Link: https://patch.msgid.link/20260725130803.6763-1-bivashraj750@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Fix two checkpatch warnings in elo_setup_10():
- Add missing space around '-' operator in array index expression
- Add missing 'const' qualifier to elo_types pointer array, since
the array is never modified after initialization
Signed-off-by: Bivash Kumar Singh <bivashraj750@gmail.com>
Link: https://patch.msgid.link/20260725113638.5147-1-bivashraj750@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
iforce_process_packet() reads fixed fields from joystick, wheel and
status packets without first checking their lengths. In particular, the
shared hats-and-buttons helper unconditionally reads data[6]. The status
tail is a sequence of 16-bit effect addresses, but an incomplete final
address is also consumed. A successful zero-length USB URB additionally
reads the packet ID before the common parser is called.
Reject the zero-length USB transfer, require the seven-byte joystick and
wheel prefixes and the two-byte status prefix, and consume only complete
status-tail addresses.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260720115018.75045-1-pengpeng@iscas.ac.cn
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
psxpad_spi_suspend() retrieves the controller state with
spi_get_drvdata(), but probe never stores it, so suspend dereferences a
NULL pointer. Store it during probe.
Fixes: 8be193c7b1f4 ("Input: add support for PlayStation 1/2 joypads connected via SPI")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260721055551.1714965-1-lilinmao@kylinos.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
charlieplex_keypad_scan_line() currently ignores the return value of
gpiod_direction_output() when setting the active output line for scanning.
If setting the GPIO direction fails (e.g. on I2C/SPI GPIO expanders or
hardware errors), the function continues to sleep and read input values
from an improperly configured GPIO line.
Fix this by capturing the return value of gpiod_direction_output() and
returning the error code immediately if it fails.
Fixes: 2ca45e57ea02 ("Input: charlieplex_keypad - add GPIO charlieplex keypad")
Signed-off-by: Surendra Singh Chouhan <kr494167@gmail.com>
Link: https://patch.msgid.link/20260723022943.9337-1-kr494167@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
The firmware record parser checks that the record address starts within
the programmable map, but does not check that the complete record data
fits in that map. A record near the end of the map can therefore make
the copy to pmap exceed its destination span.
Check the record length against the remaining programmable map range
before copying the record data.
Fixes: 7b5bb55d0dad ("Input: add support for Azoteq IQS550/572/525")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260715083850.32155-1-pengpeng@iscas.ac.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
cs40l50_add() copies the custom data of an FF_PERIODIC/FF_CUSTOM effect
straight from the ff_effect the user passed to EVIOCSFF, without
requiring it to hold anything:
work_data.custom_data = memdup_array_user(periodic->custom_data,
periodic->custom_len,
sizeof(s16));
work_data.custom_len = periodic->custom_len;
The driver then reads two words out of that buffer: custom_data[0] as the
waveform bank in cs40l50_effect_bank_set(), and custom_data[1] as the
index within the bank in cs40l50_effect_index_set(). Neither read is
covered by a length check, and custom_len is fully user controlled:
- custom_len == 0 makes memdup_array_user() call memdup_user() with a
length of zero, which returns ZERO_SIZE_PTR rather than an error, so
custom_data[0] dereferences it.
- custom_len == 1 allocates two bytes. A bank of ROM or RAM keeps
effect->type out of the OWT case, and custom_data[1] is then read one
word past the allocation.
The bank value itself is also mishandled. It is masked with
CS40L50_CUSTOM_DATA_MASK (0xffff) but stored in an s16, so a
custom_data[0] of 0x8000 or above wraps to a negative value that passes
the "bank_type >= CS40L50_WVFRM_BANK_NUM" test.
cs40l50_effect_index_set() indexes vib->dsp.banks[] with it before the
switch statement's default case gets a chance to reject it:
base_index = vib->dsp.banks[effect->type].base_index;
max_index = vib->dsp.banks[effect->type].max_index;
Require the two words the driver reads to be present, and hold the masked
bank in a u32 so the existing upper-bound test covers the whole range.
The da7280 haptic driver already range checks custom_len this way.
Fixes: c38fe1bb5d21 ("Input: cs40l50 - Add support for the CS40L50 haptic driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260718074032.1864861-1-sammiee5311@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
