kernel/linux.git/drivers/input/tablet, branch master

Input: aiptek - validate raw macro indices before updating state

2026-04-07T05:10:55+00:00

aiptek_irq() derives macro key indices directly from tablet reports and then uses them to index macroKeyEvents[]. Report types 4 and 5 also save the derived value in aiptek->lastMacro and later use that state to release the previous key. Validate the raw macro index once before it enters that state machine, so lastMacro only ever stores an in-range macro key. Keep direct bounds checks for report type 6, which reads the macro number from the packet body and uses it immediately. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260329001711.88076-1-pengpeng@iscas.ac.cn [dtor: fix macro fallback in report 5s to use -1] Signed-off-by: Dmitry Torokhov

Input: pegasus_notetaker - use HID defines

2026-03-25T16:09:51+00:00

The driver uses its own definitions for HID requests. This leads to duplication and obfuscation. Use HID's definitions. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260325143256.371854-2-oneukum@suse.com Signed-off-by: Dmitry Torokhov

Input: aiptek - use HID headers

2026-03-25T16:09:51+00:00

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

Input: pegasus-notetaker - fix potential out-of-bounds access

2025-10-18T01:04:15+00:00

In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buffer. Subsequently, if the device sends an interrupt packet with a specific pattern (e.g., where the first byte is 0x80 or 0x42), the pegasus_parse_packet() function parses the packet without checking the allocated buffer size. This leads to an out-of-bounds memory access. Fixes: 1afca2b66aac ("Input: add Pegasus Notetaker tablet driver") Signed-off-by: Seungjin Bae Link: https://lore.kernel.org/r/20251007214131.3737115-2-eeodqql09@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov

Merge tag 'input-for-v6.13-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2024-11-25T18:31:39+00:00

Pull input updates from Dmitry Torokhov: - support for NT36672A touchscreen added to novatek-nvt-ts driver - a change to ads7846 driver to prevent XPT2046 from locking up - a change switching platform input dirves back to using remove() method (from remove_new()) - updates to a number of input drivers to use the new cleanup facilities (__free(...), guard(), and scoped-guard()) which ensure that the resources and locks are released properly and automatically - other assorted driver cleanups and fixes. * tag 'input-for-v6.13-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (109 commits) Input: mpr121 - use devm_regulator_get_enable_read_voltage() Input: sun4i-lradc-keys - don't include 'pm_wakeup.h' directly Input: spear-keyboard - don't include 'pm_wakeup.h' directly Input: cypress-sf - constify struct i2c_device_id Input: ads7846 - increase xfer array size in 'struct ser_req' Input: fix the input_event struct documentation Input: i8042 - fix typo dublicate to duplicate Input: ads7846 - add dummy command register clearing cycle Input: cs40l50 - fix wrong usage of INIT_WORK() Input: introduce notion of passive observers for input handlers Input: maple_keyb - use guard notation when acquiring mutex Input: locomokbd - use guard notation when acquiring spinlock Input: hilkbd - use guard notation when acquiring spinlock Input: synaptics-rmi4 - switch to using cleanup functions in F34 Input: synaptics - fix a typo dt-bindings: input: rotary-encoder: Fix "rotary-encoder,rollover" type Input: omap-keypad - use guard notation when acquiring mutex Input: imagis - fix warning regarding 'imagis_3038_data' being unused Input: userio - remove unneeded semicolon Input: sparcspkr - use cleanup facility for device_node ...

Input: pegasus_notetaker - use guard notation when acquiring mutex

2024-10-03T16:10:37+00:00

Using guard notation makes the code more compact and error handling more robust by ensuring that mutexes are released in all code paths when control leaves critical section. Reviewed-by: Javier Carrasco Link: https://lore.kernel.org/r/ZtjKJsArLu3byTU6@google.com Signed-off-by: Dmitry Torokhov

move asm/unaligned.h to linux/unaligned.h

2024-10-02T21:23:23+00:00

asm/unaligned.h is always an include of asm-generic/unaligned.h; might as well move that thing to linux/unaligned.h and include that - there's nothing arch-specific in that header. auto-generated by the following: for i in `git grep -l -w asm/unaligned.h`; do sed -i -e "s/asm\/unaligned.h/linux\/unaligned.h/" $i done for i in `git grep -l -w asm-generic/unaligned.h`; do sed -i -e "s/asm-generic\/unaligned.h/linux\/unaligned.h/" $i done git mv include/asm-generic/unaligned.h include/linux/unaligned.h git mv tools/include/asm-generic/unaligned.h tools/include/linux/unaligned.h sed -i -e "/unaligned.h/d" include/asm-generic/Kbuild sed -i -e "s/__ASM_GENERIC/__LINUX/" include/linux/unaligned.h tools/include/linux/unaligned.h

Input: tablet - use sizeof(*pointer) instead of sizeof(type)

2024-06-03T04:32:03+00:00

It is preferred to use sizeof(*pointer) instead of sizeof(type) due to the type of the variable can change and one needs not change the former (unlike the latter). This patch has no effect on runtime behavior. Signed-off-by: Erick Archer Link: https://lore.kernel.org/r/AS8PR02MB7237B05083487507CFAF96B08BFE2@AS8PR02MB7237.eurprd02.prod.outlook.com Signed-off-by: Dmitry Torokhov