kernel/linux.git/drivers/hid/hid-magicmouse.c, branch v5.15.208

HID: magicmouse: avoid memory leak in magicmouse_report_fixup()

2026-04-18T08:33:23+00:00

[ Upstream commit 91e8c6e601bdc1ccdf886479b6513c01c7e51c2c ] The magicmouse_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller. Assisted-by: Gemini-CLI:Google Gemini 3 Signed-off-by: Günther Noack Signed-off-by: Benjamin Tissoires Signed-off-by: Sasha Levin

HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2

2026-04-18T08:33:23+00:00

[ Upstream commit 5f3518d77419255f8b12bb23c8ec22acbeb6bc5b ] Battery reporting does not work for the Apple Magic Trackpad 2 if it is connected via USB. The current hid descriptor fixup code checks for a hid descriptor length of exactly 83 bytes. If the hid descriptor is larger, which is the case for newer apple mice, the fixup is not applied. This fix checks for hid descriptor sizes greater/equal 83 bytes which applies the fixup for newer devices as well. Signed-off-by: Julius Lehmann Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: magicmouse: Do not crash on missing msc->input

2026-03-04T12:20:26+00:00

[ Upstream commit 17abd396548035fbd6179ee1a431bd75d49676a7 ] Fake USB devices can send their own report descriptors for which the input_mapping() hook does not get called. In this case, msc->input stays NULL, leading to a crash at a later time. Detect this condition in the input_configured() hook and reject the device. This is not supposed to happen with actual magic mouse devices, but can be provoked by imposing as a magic mouse USB device. Cc: stable@vger.kernel.org Signed-off-by: Günther Noack Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: magicmouse: avoid setting up battery timer when not needed

2025-08-28T14:24:27+00:00

commit 9bdc30e35cbc1aa78ccf01040354209f1e11ca22 upstream. Currently, the battery timer is set up for all devices using hid-magicmouse, irrespective of whether they actually need it or not. The current implementation requires the battery timer for Magic Mouse 2 and Magic Trackpad 2 when connected via USB only. Add checks to ensure that the battery timer is only set up when they are connected via USB. Fixes: 0b91b4e4dae6 ("HID: magicmouse: Report battery level over USB") Cc: stable@vger.kernel.org Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman

HID: magicmouse: Do not set BTN_MOUSE on double report

2022-10-29T08:12:55+00:00

[ Upstream commit bb5f0c855dcfc893ae5ed90e4c646bde9e4498bf ] Under certain conditions the Magic Trackpad can group 2 reports in a single packet. The packet is split and the raw event function is invoked recursively for each part. However, after processing each part, the BTN_MOUSE status is updated, sending multiple click events. [1] Return after processing double reports to avoid this issue. Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/811 # [1] Fixes: a462230e16ac ("HID: magicmouse: enable Magic Trackpad support") Reported-by: Nulo Signed-off-by: José Expósito Signed-off-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20221009182747.90730-1-jose.exposito89@gmail.com Signed-off-by: Sasha Levin

HID: magicmouse: Fix an error handling path in magicmouse_probe()

2022-01-27T10:05:08+00:00

commit 33812fc7c8d77a43b7e2bf36a0d5a57c277a4b0c upstream. If the timer introduced by the commit below is started, then it must be deleted in the error handling of the probe. Otherwise it would trigger once the driver is no more. Fixes: 0b91b4e4dae6 ("HID: magicmouse: Report battery level over USB") Signed-off-by: Christophe JAILLET Tested-by: José Expósito Reported-by: Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman

HID: magicmouse: Report battery level over USB

2022-01-27T10:04:27+00:00

[ Upstream commit 0b91b4e4dae63cd43871fc2012370b86ee588f91 ] When connected over USB, the Apple Magic Mouse 2 and the Apple Magic Trackpad 2 register multiple interfaces, one of them is used to report the battery level. However, unlike when connected over Bluetooth, the battery level is not reported automatically and it is required to fetch it manually. Fix the battery report descriptor and add a timer to fetch the battery level. Signed-off-by: José Expósito Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: magicmouse: prevent division by 0 on scroll

2021-12-01T08:04:48+00:00

[ Upstream commit a1091118e0d6d84c2fdb94e6c397ac790bfb9dd6 ] In hid_magicmouse, if the user has set scroll_speed to a value between 55 and 63 and scrolls seven times in quick succession, the step_hr variable in the magicmouse_emit_touch function becomes 0. That causes a division by zero further down in the function when it does `step_x_hr /= step_hr`. To reproduce, create `/etc/modprobe.d/hid_magicmouse.conf` with the following content: ``` options hid_magicmouse scroll_acceleration=1 scroll_speed=55 ``` Then reboot, connect a Magic Mouse and scroll seven times quickly. The system will freeze for a minute, and after that `dmesg` will confirm that a division by zero occurred. Enforce a minimum of 1 for the variable so the high resolution step count can never reach 0 even at maximum scroll acceleration. Fixes: d4b9f10a0eb6 ("HID: magicmouse: enable high-resolution scroll") Signed-off-by: Claudia Pellegrino Tested-by: José Expósito Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: magicmouse: high-resolution scroll threshold

2021-07-15T19:16:39+00:00

In order to avoid triggering involuntary high-resolution scroll events due to tiny touch movement deltas, add a movement threshold. The value chosen for the threshold, about 1.5 ~ 2 mm, is similar to the threshold used on touchpads by libinput (see libinput evdev-mt-touchpad-gestures.c) to try to keep the scroll experience consistent. Signed-off-by: José Expósito Signed-off-by: Jiri Kosina

HID: magicmouse: enable high-resolution scroll

2021-07-15T19:16:39+00:00

The Magic Mouse, generations 1 and 2, doesn't have a physical scroll wheel, instead, the REL_WHEEL and REL_HWHEEL events are emulated when sliding a finger on the surface of the mouse. However, the smooth movement of the finger is transformed into a step based scroll on the screen, leading to a suboptimal user experience. Emulate high-resolution scroll by sending REL_WHEEL_HI_RES and REL_HWHEEL_HI_RES events so the scroll on the screen is closer to the finger movement. Signed-off-by: José Expósito Signed-off-by: Jiri Kosina