kernel/linux.git/drivers/hid/usbhid, branch v6.18.22

HID: pidff: Fix condition effect bit clearing

2026-03-12T11:09:36+00:00

commit 97d5c8f5c09a604c4873c8348f58de3cea69a7df upstream. As reported by MPDarkGuy on discord, NULL pointer dereferences were happening because not all the conditional effects bits were cleared. Properly clear all conditional effect bits from ffbit Fixes: 7f3d7bc0df4b ("HID: pidff: Better quirk assigment when searching for fields") Cc: stable@vger.kernel.org # 6.18.x Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman

HID: pidff: Do not set out of range trigger button

2026-03-04T12:19:54+00:00

[ Upstream commit e01a029654f7fb67d7151365410aa22be4e63dbe ] Some games (mainly observed with Kylotonn's WRC Serises) set trigger button to a random value, or always the same one, out of range. I observed 307 and other values but, for example, my Moza R9 only exposes 128 buttons AND it's trigger button field is 8-bit. This causes errors to appear in dmesg. Only set the trigger button and trigger interval in the trigger button is in range of the field. Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: usbhid: paper over wrong bNumDescriptor field

2026-01-23T10:21:23+00:00

commit f28beb69c51517aec7067dfb2074e7c751542384 upstream. Some faulty devices (ZWO EFWmini) have a wrong optional HID class descriptor count compared to the provided length. Given that we plainly ignore those optional descriptor, we can attempt to fix the provided number so we do not lock out those devices. Signed-off-by: Benjamin Tissoires Cc: Salvatore Bonaccorso Signed-off-by: Greg Kroah-Hartman

HID: pidff: Fix needs_playback check

2025-11-18T17:04:28+00:00

A small bug made it's way here when rewriting code to Linux quality. Currently, if an effect is not infinite and a program requests it's playback with the same number of loops, the play command won't be fired and if an effect is infinite, the spam will continue. We want every playback update for non-infinite effects and only some for infinite (detecting when a program requests stop with 0 which will be different than previous value which is usually 1 or 255). Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina

HID: pidff: Fix possible null pointer dereference

2025-09-12T15:29:19+00:00

As reported by Dan Carpenter, if the axes_enable field wasn't found, trying to find the axes themselves will result in a null pointer dereference. This could only occur with a broken PID descriptor, but it's worth protecting from. Exit early if the axes_enable wasn't found AND add a gate to the pidff_find_special_keys to exit early if the passed HID field is null. This will protect again null dereferencing in the future and properly return 0 found special keys. Fixes: 1d72e7bd340b ("HID: pidff: Add support for AXES_ENABLE field") Reported-by: Dan Carpenter Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina

HID: pidff: Reduce PID_EFFECT_OPERATION spam

2025-08-15T13:58:10+00:00

Keep track of effect's loop_count to reduce the spam of ffb play commands coming from some games. This should speed up normal magnitude etc updates and slightly increase max possible FFB refresh rate. Helps games like Dirt Rally 2.0, F1 2023, WRC from KT Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina

HID: pidff: clang-format pass

2025-08-15T13:58:10+00:00

Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina

HID: pidff: Define all cardinal directions

2025-08-15T13:58:10+00:00

Will be used by ff-effect based autocentering Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina

HID: pidff: Remove Anssi's email address from info msg

2025-08-15T13:58:09+00:00

Some users might try to contact him about issues and he's no longer active when it comes to the driver development/fixes. Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina

HID: pidff: PERMISSIVE_CONTROL quirk autodetection

2025-08-15T13:58:09+00:00

Fixes force feedback for devices built with MMOS firmware and many more not yet detected devices. Update quirks mask debug message to always contain all 32 bits of data. Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina