kernel/linux.git/drivers/hid/bpf, branch v6.19.11

HID: bpf: prevent buffer overflow in hid_hw_request

2026-03-25T10:13:15+00:00

commit 2b658c1c442ec1cd9eec5ead98d68662c40fe645 upstream. right now the returned value is considered to be always valid. However, when playing with HID-BPF, the return value can be arbitrary big, because it's the return value of dispatch_hid_bpf_raw_requests(), which calls the struct_ops and we have no guarantees that the value makes sense. Fixes: 8bd0488b5ea5 ("HID: bpf: add HID-BPF hooks for hid_hw_raw_requests") Cc: stable@vger.kernel.org Acked-by: Jiri Kosina Signed-off-by: Benjamin Tissoires Signed-off-by: Greg Kroah-Hartman

HID: bpf: fix bpf compilation with -fms-extensions

2026-01-07T14:03:48+00:00

Similar to commit 835a50753579 ("selftests/bpf: Add -fms-extensions to bpf build flags") and commit 639f58a0f480 ("bpftool: Fix build warnings due to MS extensions") The kernel is now built with -fms-extensions, therefore generated vmlinux.h contains types like: struct slab { .. struct freelist_counters; }; Use -fms-extensions and -Wno-microsoft-anon-tag flags to build bpf programs that #include "vmlinux.h" Signed-off-by: Benjamin Tissoires

HID: bpf: fix typo in HID usage table

2025-11-20T15:45:59+00:00

We could go to the USB consortium, but it's probably easier that way. And update HID usage table json generated file from https://usb.org/sites/default/files/hut1_6.pdf updated: 01/30/2025 Reported-by: Colin Ian King Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/191 Signed-off-by: Benjamin Tissoires Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: bpf: add the Huion Kamvas 27 Pro

2025-11-20T15:45:59+00:00

Same issues with a secondary tip switch instead of secondary barrel switch as the Kamvas 19. Copy the stable Kamvas 19 support back into testing and add the vid/pid for the Kamvas 27. Signed-off-by: Peter Hutterer Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/189 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: bpf: add heuristics to the Huion Inspiroy 2S eraser button

2025-11-20T15:45:59+00:00

When pressing the phsyical eraser button (remapped by us to the Secondary Barrel Switch) while the tip is down, the device gives us several false reports with a Tip Switch 0: press| |release SBS: [0 0 ... 1 1 1 ... 1 0 0 0 0 0 0 ...] TS: [1 1 ... 1 0 1 ... 1 1 0 0 0 1 1 ...] In both press/release the number of Tip Switch 0 reports can be up to 4 and *sometimes* the Tip Switch is released in the same report as the button press/release event. Paper over this by forcing the tip down for a few reports if it was down before the button toggled. Signed-off-by: Peter Hutterer Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/195 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: bpf: Add support for XP-Pen Deco02

2025-11-20T15:45:59+00:00

Modifies report to have tablet buttons report as buttons, rather than as keyboard key combinations. The dial is also converted to a relative input, using the dedicated bit previously reserved for modifier key information. Signed-off-by: Hannah Pittman Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/203 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: bpf: Add support for the XP-Pen Deco 01 V3

2025-11-20T15:45:58+00:00

This device needs a fix for the tilt range on the pen report descriptor and the usual conversion of the pad keys from the firmware's hardcoded keyboard shortcuts to actual pad buttons. Signed-off-by: Peter Hutterer Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/185 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: bpf: Add support for the Waltop Batteryless Tablet

2025-11-20T15:45:58+00:00

Several bugs as outlined in udev-hid-bpf#66 and udev-hid-bpf!198: - pressure curve is far from linear - tilt range is ±60, not ±127 - pressing the second button sets both tip down and barrel switch Fix the second button by adding a Secondary Barrel Switch in the existing padding and check for the tip down/barrel switch down combo. When both values become true at the same time, set the Secondary Barrel Switch instead. Implement a custom pressure curve that maps the hardware range 0-102 linearly to the logical range 0-1224, and maps the hardware range 103-2047 logarithmically to the logical range 1232-2047. This mapping isn’t perfect, but it’s way more natural than the stock configuration. Signed-off-by: Peter Hutterer Signed-off-by: Jan Felix Langenbach Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/200 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: bpf: Add fixup for Logitech SpaceNavigator variants

2025-11-20T15:45:58+00:00

The 3Dconnexion SpaceNavigator HID report descriptor declares its axis data to be "relative" when it is actually "absolute". This quirk was addressed in the kernel in 2.6.33, but some SpaceNavigator variants have a slightly different report descriptor whose axis input items are at different offsets than those assumed by the kernel fixup. Add a BPF fixup to handle both sets of offsets for known SpaceNavigator variants if the descriptor has not already been fixed by the kernel. Signed-off-by: Curran Muhlberger Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/181 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina

HID: bpf: support for Huion Kamvas 16 Gen 3

2025-11-20T15:45:58+00:00

Another Huion Kamvas tablet support. Again it's safer to duplicate the code source in a separate file to ensure we are not breaking any existing device. Signed-off-by: Higgins Dragon Signed-off-by: Benjamin Tissoires Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/207 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina