public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-18 22:14:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

hid-for-linus-2025051501

Browse source 
-----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCAAxFiEEoEVH9lhNrxiMPSyI7MXwXhnZSjYFAmgl/f0THGJlbnRpc3NA
 a2VybmVsLm9yZwAKCRDsxfBeGdlKNhJYEACLoUmRvcWxcAqwYj3G0mbydD2Wgy/9
 zXHRJWpYpBsunoyROh3zopkb5mVWeLyED3w0bC4bLt8/pzqh73Yvm7HPJxq8FaTN
 csKl2uBfw04WrVOT28S8s1lcG8NOFWVRodv/hTSeNF/WH7ykJNjEvCC38NjZaWQG
 NI+UjsGzVzvXn+ih0jP1SXAQ5BpmYKB+a4dSFzkPhM2f7fWGRlOlvgt6r/YYs0WG
 Bv/LilQ8Z0SwnCEAtsp2MCypP3rcbQ8PsEN8YwYFHlLVb8dkpkGMkOil4qJrtNCr
 LFHOJl15Evz+rfdXPFicD6jSyQoFnKxLXnIRkuE8aJsNo5urcYZlTRQqIz+FDTrS
 HUDWheJtImYq29ywGHLXPfydKXl3e87QPWr8FCAxR0cAyQIDbNwVOh/GNw2NNBup
 XB1DWsZBBJwVQNfP/wS3dMAHFINYnENB+wj0e+A96e1BrsZQaTGcBtgFl93qkBT4
 wsG2lipRMoBS88jkTpXcIaGi8E76pOjNwKd3lKgvuXQlpEoS/+BicV9+En6QuKGv
 RveCJzp/9+UpPlBVBp3bvIqQUxPOtwnnE78+krdfb8C3kTwQs1TlXvBXRfeZHRAg
 mMGhzwrvTdfyjUMgbawczs4k12puxjGPOBTyArN0PDOG5i9On5B28VJKYpKLkOYD
 EmAVGyfV9cOvBg==
 =dfYw
 -----END PGP SIGNATURE-----

Merge tag 'hid-for-linus-2025051501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

Pull HID fixes from Benjamin Tissoires:

 - fix a few potential memory leaks in the wacom driver (Qasim Ijaz)

 - AMD SFH fixes when there is only one SRA sensor (Mario Limonciello)

 - HID-BPF dispatch UAF fix that happens on removal of the Logitech DJ
   receiver (Rong Zhang)

 - various minor fixes and usual device ID additions

* tag 'hid-for-linus-2025051501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: bpf: abort dispatch if device destroyed
  HID: quirks: Add ADATA XPG alpha wireless mouse support
  HID: hid-steam: Remove the unused variable connected
  HID: amd_sfh: Avoid clearing reports for SRA sensor
  HID: amd_sfh: Fix SRA sensor when it's the only sensor
  HID: wacom: fix shift OOB in kfifo allocation for zero pktlen
  HID: uclogic: Add NULL check in uclogic_input_configured()
  HID: wacom: fix memory leak on size mismatch in wacom_wac_queue_flush()
  HID: wacom: handle kzalloc() allocation failure in wacom_wac_queue_flush()
  HID: thrustmaster: fix memory leak in thrustmaster_interrupts()
  HID: hid-appletb-kbd: Fix wrong date and kernel version in sysfs interface docs
  HID: bpf: fix BTN_STYLUS for the XP Pen ACK05 remote
This commit is contained in:
Linus Torvalds 2025-05-15 10:57:24 -07:00
commit fe661d01ab
10 changed files with 41 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
Documentation/ABI/testing/sysfs-driver-hid-appletb-kbd
View file

@ -1,6 +1,6 @@
What: /sys/bus/hid/drivers/hid-appletb-kbd/<dev>/mode
Date: September, 2023
KernelVersion: 6.5
Date: March, 2025
KernelVersion: 6.15
Contact: linux-input@vger.kernel.org
Description:
The set of keys displayed on the Touch Bar.

12
drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c
View file

@ -83,6 +83,9 @@ static int amd_sfh_hid_client_deinit(struct amd_mp2_dev *privdata)
case ALS_IDX:
privdata->dev_en.is_als_present = false;
break;
case SRA_IDX:
privdata->dev_en.is_sra_present = false;
break;
}
if (cl_data->sensor_sts[i] == SENSOR_ENABLED) {
@ -134,9 +137,6 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata)
for (i = 0; i < cl_data->num_hid_devices; i++) {
cl_data->sensor_sts[i] = SENSOR_DISABLED;
if (cl_data->num_hid_devices == 1 && cl_data->sensor_idx[0] == SRA_IDX)
break;
if (cl_data->sensor_idx[i] == SRA_IDX) {
info.sensor_idx = cl_data->sensor_idx[i];
writel(0, privdata->mmio + amd_get_p2c_val(privdata, 0));
@ -145,8 +145,10 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata)
(privdata, cl_data->sensor_idx[i], ENABLE_SENSOR);
cl_data->sensor_sts[i] = (status == 0) ? SENSOR_ENABLED : SENSOR_DISABLED;
if (cl_data->sensor_sts[i] == SENSOR_ENABLED)
if (cl_data->sensor_sts[i] == SENSOR_ENABLED) {
cl_data->is_any_sensor_enabled = true;
privdata->dev_en.is_sra_present = true;
}
continue;
}
@ -238,6 +240,8 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata)
cleanup:
amd_sfh_hid_client_deinit(privdata);
for (i = 0; i < cl_data->num_hid_devices; i++) {
if (cl_data->sensor_idx[i] == SRA_IDX)
continue;
devm_kfree(dev, cl_data->feature_report[i]);
devm_kfree(dev, in_data->input_report[i]);
devm_kfree(dev, cl_data->report_descr[i]);

9
drivers/hid/bpf/hid_bpf_dispatch.c
View file

@ -38,6 +38,9 @@ dispatch_hid_bpf_device_event(struct hid_device *hdev, enum hid_report_type type
struct hid_bpf_ops *e;
int ret;
if (unlikely(hdev->bpf.destroyed))
return ERR_PTR(-ENODEV);
if (type >= HID_REPORT_TYPES)
return ERR_PTR(-EINVAL);
@ -93,6 +96,9 @@ int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
struct hid_bpf_ops *e;
int ret, idx;
if (unlikely(hdev->bpf.destroyed))
return -ENODEV;
if (rtype >= HID_REPORT_TYPES)
return -EINVAL;
@ -130,6 +136,9 @@ int dispatch_hid_bpf_output_report(struct hid_device *hdev,
struct hid_bpf_ops *e;
int ret, idx;
if (unlikely(hdev->bpf.destroyed))
return -ENODEV;
idx = srcu_read_lock(&hdev->bpf.srcu);
list_for_each_entry_srcu(e, &hdev->bpf.prog_list, list,
srcu_read_lock_held(&hdev->bpf.srcu)) {

1
drivers/hid/bpf/progs/XPPen__ACK05.bpf.c
View file

@ -157,6 +157,7 @@ static const __u8 fixed_rdesc_vendor[] = {
ReportCount(5) // padding
Input(Const)
// Byte 4 in report - just exists so we get to be a tablet pad
UsagePage_Digitizers
Usage_Dig_BarrelSwitch // BTN_STYLUS
ReportCount(1)
ReportSize(1)

4
drivers/hid/hid-ids.h
View file

@ -41,6 +41,10 @@
#define USB_VENDOR_ID_ACTIONSTAR 0x2101
#define USB_DEVICE_ID_ACTIONSTAR_1011 0x1011
#define USB_VENDOR_ID_ADATA_XPG 0x125f
#define USB_VENDOR_ID_ADATA_XPG_WL_GAMING_MOUSE 0x7505
#define USB_VENDOR_ID_ADATA_XPG_WL_GAMING_MOUSE_DONGLE 0x7506
#define USB_VENDOR_ID_ADS_TECH 0x06e1
#define USB_DEVICE_ID_ADS_TECH_RADIO_SI470X 0xa155

2
drivers/hid/hid-quirks.c
View file

@ -27,6 +27,8 @@
static const struct hid_device_id hid_quirks[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_AASHIMA, USB_DEVICE_ID_AASHIMA_GAMEPAD), HID_QUIRK_BADPAD },
{ HID_USB_DEVICE(USB_VENDOR_ID_AASHIMA, USB_DEVICE_ID_AASHIMA_PREDATOR), HID_QUIRK_BADPAD },
{ HID_USB_DEVICE(USB_VENDOR_ID_ADATA_XPG, USB_VENDOR_ID_ADATA_XPG_WL_GAMING_MOUSE), HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_ADATA_XPG, USB_VENDOR_ID_ADATA_XPG_WL_GAMING_MOUSE_DONGLE), HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_AFATECH, USB_DEVICE_ID_AFATECH_AF9016), HID_QUIRK_FULLSPEED_INTERVAL },
{ HID_USB_DEVICE(USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS), HID_QUIRK_NOGET },
{ HID_USB_DEVICE(USB_VENDOR_ID_AKAI_09E8, USB_DEVICE_ID_AKAI_09E8_MIDIMIX), HID_QUIRK_NO_INIT_REPORTS },

2
drivers/hid/hid-steam.c
View file

@ -1150,11 +1150,9 @@ static void steam_client_ll_close(struct hid_device *hdev)
struct steam_device *steam = hdev->driver_data;
unsigned long flags;
bool connected;
spin_lock_irqsave(&steam->lock, flags);
steam->client_opened--;
connected = steam->connected && !steam->client_opened;
spin_unlock_irqrestore(&steam->lock, flags);
schedule_work(&steam->unregister_work);

1
drivers/hid/hid-thrustmaster.c
View file

@ -174,6 +174,7 @@ static void thrustmaster_interrupts(struct hid_device *hdev)
u8 ep_addr[2] = {b_ep, 0};
if (!usb_check_int_endpoints(usbif, ep_addr)) {
kfree(send_buf);
hid_err(hdev, "Unexpected non-int endpoint\n");
return;
}

7
drivers/hid/hid-uclogic-core.c
View file

@ -142,11 +142,12 @@ static int uclogic_input_configured(struct hid_device *hdev,
suffix = "System Control";
break;
}
}
if (suffix)
} else {
hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
"%s %s", hdev->name, suffix);
if (!hi->input->name)
return -ENOMEM;
}
return 0;
}

11
drivers/hid/wacom_sys.c
View file

@ -70,10 +70,16 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
{
while (!kfifo_is_empty(fifo)) {
int size = kfifo_peek_len(fifo);
u8 *buf = kzalloc(size, GFP_KERNEL);
u8 *buf;
unsigned int count;
int err;
buf = kzalloc(size, GFP_KERNEL);
if (!buf) {
kfifo_skip(fifo);
continue;
}
count = kfifo_out(fifo, buf, size);
if (count != size) {
// Hard to say what is the "right" action in this
@ -81,6 +87,7 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
// to flush seems reasonable enough, however.
hid_warn(hdev, "%s: removed fifo entry with unexpected size\n",
__func__);
kfree(buf);
continue;
}
err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, false);
@ -2361,6 +2368,8 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
unsigned int connect_mask = HID_CONNECT_HIDRAW;
features->pktlen = wacom_compute_pktlen(hdev);
if (!features->pktlen)
return -ENODEV;
if (!devres_open_group(&hdev->dev, wacom, GFP_KERNEL))
return -ENOMEM;