kernel/linux.git/drivers/input/mouse/alps.c, branch v6.18.21

Input: alps - fix use-after-free bugs caused by dev3_register_work

2026-01-02T11:56:56+00:00

commit bf40644ef8c8a288742fa45580897ed0e0289474 upstream. The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare PS/2 packet from an external PS/2 device connected to the ALPS touchpad. During device detachment, the original implementation calls flush_workqueue() in psmouse_disconnect() to ensure completion of dev3_register_work. However, the flush_workqueue() in psmouse_disconnect() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after flush_workqueue() has finished executing, the dev3_register_work could still be scheduled. Although the psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(), the scheduling of dev3_register_work remains unaffected. The race condition can occur as follows: CPU 0 (cleanup path) | CPU 1 (delayed work) psmouse_disconnect() | psmouse_set_state() | flush_workqueue() | alps_report_bare_ps2_packet() alps_disconnect() | psmouse_queue_work() kfree(priv); // FREE | alps_register_bare_ps2_mouse() | priv = container_of(work...); // USE | priv->dev3 // USE Add disable_delayed_work_sync() in alps_disconnect() to ensure that dev3_register_work is properly canceled and prevented from executing after the alps_data structure has been deallocated. This bug is identified by static analysis. Fixes: 04aae283ba6a ("Input: ALPS - do not mix trackstick and external PS/2 mouse data") Cc: stable@kernel.org Signed-off-by: Duoming Zhou Link: https://patch.msgid.link/b57b0a9ccca51a3f06be141bfc02b9ffe69d1845.1765939397.git.duoming@zju.edu.cn Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

Merge tag 'input-for-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2025-07-04T16:54:15+00:00

Pull input updates from Dmitry Torokhov: - support for Acer NGR 200 Controller added to xpad driver - xpad driver will no longer log errors about URBs at sudden disconnect - a fix for potential NULL dereference in cs40l50-vibra driver - several drivers have been switched to using scnprintf() to suppress warnings about potential output truncation * tag 'input-for-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() Input: alps - use scnprintf() to suppress truncation warning Input: iqs7222 - explicitly define number of external channels Input: xpad - support Acer NGR 200 Controller Input: xpad - return errors from xpad_try_sending_next_out_packet() up Input: xpad - adjust error handling for disconnect Input: apple_z2 - drop default ARCH_APPLE in Kconfig Input: Fully open-code compatible for grepping dt-bindings: HID: i2c-hid: elan: Introduce Elan eKTH8D18 Input: psmouse - switch to use scnprintf() to suppress truncation warning Input: lifebook - switch to use scnprintf() to suppress truncation warning Input: alps - switch to use scnprintf() to suppress truncation warning Input: atkbd - switch to use scnprintf() to suppress truncation warning Input: fsia6b - suppress buffer truncation warning for phys Input: iqs626a - replace snprintf() with scnprintf()

Input: alps - use scnprintf() to suppress truncation warning

2025-06-30T16:45:46+00:00

The commit 76c968e75715 ("Input: alps - switch to use scnprintf() to suppress truncation warning") converted one place in the driver while the other left untouched. Convert the other place as well. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250630082245.1416796-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08T07:07:37+00:00

Move this API to the canonical timer_*() namespace. [ tglx: Redone against pre rc1 ] Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com

Input: alps - switch to use scnprintf() to suppress truncation warning

2025-06-04T04:51:26+00:00

Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Reported-by: Andy Shevchenko Signed-off-by: Dmitry Torokhov

treewide: Switch/rename to timer_delete[_sync]()

2025-04-05T08:30:12+00:00

timer_delete[_sync]() replaces del_timer[_sync](). Convert the whole tree over and remove the historical wrapper inlines. Conversion was done with coccinelle plus manual fixups where necessary. Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar

Input: alps - use guard notation when pausing serio port

2024-10-04T07:58:15+00:00

Using guard notation makes the code more compact and error handling more robust by ensuring that serio ports are resumed in all code paths when control leaves critical section. Acked-by: Pali Rohár Link: https://lore.kernel.org/r/20240905041732.2034348-4-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov

Input: alps - use guard notation when acquiring mutex

2024-09-06T05:52:37+00:00

This makes the code more compact and error handling more robust by ensuring that mutexes are released in all code paths when control leaves critical section. Acked-by: Pali Rohár Link: https://lore.kernel.org/r/ZsrBkWIpyEqzClUG@google.com Signed-off-by: Dmitry Torokhov

Input: mouse - use sizeof(*pointer) instead of sizeof(type)

2024-06-03T04:32:02+00:00

It is preferred to use sizeof(*pointer) instead of sizeof(type) due to the type of the variable can change and one needs not change the former (unlike the latter). This patch has no effect on runtime behavior. Signed-off-by: Erick Archer Link: https://lore.kernel.org/r/AS8PR02MB7237FB736DBF67A58798FDF38BFE2@AS8PR02MB7237.eurprd02.prod.outlook.com Signed-off-by: Dmitry Torokhov

Input: alps - fix compatibility with -funsigned-char

2023-03-20T06:07:04+00:00

The AlpsPS/2 code previously relied on the assumption that `char` is a signed type, which was true on x86 platforms (the only place where this driver is used) before kernel 6.2. However, on 6.2 and later, this assumption is broken due to the introduction of -funsigned-char as a new global compiler flag. Fix this by explicitly specifying the signedness of `char` when sign extending the values received from the device. Fixes: f3f33c677699 ("Input: alps - Rushmore and v7 resolution support") Signed-off-by: msizanoen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230320045228.182259-1-msizanoen@qtmlabs.xyz Signed-off-by: Dmitry Torokhov