kernel/linux.git/drivers/input/touchscreen, branch v7.0.12

Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem

2026-06-09T10:32:41+00:00

commit baa0210fb6a9dc3882509a9411b6d284d88fe30e upstream. When a configuration file provides an object size that is larger than the driver's known mxt_obj_size(object), the driver intends to discard the extra bytes. The loop iterates using for (i = 0; i < size; i++). Inside the loop, the condition to skip processing extra bytes is: if (i > mxt_obj_size(object)) continue; Since i is a 0-based index, the valid indices for the object are 0 through mxt_obj_size(object) - 1. When i == mxt_obj_size(object), the condition evaluates to false, and the code processes the byte instead of discarding it. This causes the code to calculate byte_offset = reg + i - cfg->start_ofs and writes the byte there, overwriting exactly one byte of the adjacent instance or object. Update the boundary check to skip extra bytes correctly by using >=. Fixes: 50a77c658b80 ("Input: atmel_mxt_ts - download device config using firmware loader") Cc: stable@vger.kernel.org Assisted-by: Gemini:gemini-3.1-pro Reviewed-by: Ricardo Ribalda Link: https://patch.msgid.link/20260504185448.4055973-1-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size

2026-06-09T10:32:19+00:00

commit 2905281cbda52ec9df540113b35b835feb5fafd3 upstream. nexio_read_data() pulls data_len and x_len from a packed __be16 header in the device's interrupt packet and then walks packet->data[0..x_len) and packet->data[x_len..data_len) comparing each byte against a threshold. Both fields are 16-bit on the wire (max 65535). The existing adjustments shave at most 0x100 / 0x80 off, so the loop bound can still reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size (1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the packed header — so packet->data[] has 1017 valid bytes. read_data() callbacks are not given urb->actual_length, and nothing else bounds the walk. A device that lies about its length can get a ~64 KiB out-of-bounds read past the coherent DMA allocation. The first index whose byte exceeds NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the reported touch coordinates, so adjacent kernel memory contents leak to userspace as ABS_X / ABS_Y events. Far enough out, the read can also hit an unmapped page and fault. Fix this all by clamping data_len to the buffer's data[] capacity and x_len to data_len. Cc: Dmitry Torokhov Fixes: 5197424cdccc ("Input: usbtouchscreen - add NEXIO (or iNexio) support") Cc: stable Assisted-by: gkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026042026-chlorine-epidermis-fd6d@gregkh Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

Input: edt-ft5x06 - fix use-after-free in debugfs teardown

2026-05-07T04:13:44+00:00

commit f5f9e07060519e2287e99019a6de1eb3ebb65c37 upstream. The commit 68743c500c6e ("Input: edt-ft5x06 - use per-client debugfs directory") removed the manual debugfs teardown, relying on the I2C core to handle it. However, this creates a window where debugfs files are still accessible after edt_ft5x06_ts_teardown_debugfs() frees tsdata->raw_buffer. To prevent a use-after-free, protect the freeing of raw_buffer with the device mutex and set raw_buffer to NULL. The debugfs read function already checks if raw_buffer is NULL under the same mutex, so this safely avoids the use-after-free. Fixes: 68743c500c6e ("Input: edt-ft5x06 - use per-client debugfs directory") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/adnJicDh-bTUaWXP@google.com Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

Merge tag 'input-for-v7.0-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2026-02-15T16:24:19+00:00

Pull input updates from Dmitry Torokhov: - support for FocalTech FT8112 added to i2c-hid driver - support for FocalTech FT3518 added to edt-ft5x06 driver - support for power buttons in TWL603x chips added to twl4030-pwrbutton driver - an update to gpio-decoder driver to make it usable on non-OF platforms and to clean up the code - an update to synaptics_i2c driver switching it to use managed resources and a fix to restarting polling after resume - an update to gpio-keys driver to fall back to getting IRQ from resources if not specified using other means - an update to ili210x driver to support polling mode - a number of input drivers switched to scnprintf() to suppress truncation warnings - a number of updates and conversions of device tree bindings to yaml format - fixes to spelling in comments and messages in several drivers - other assorted fixups * tag 'input-for-v7.0-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (57 commits) dt-bindings: input: qcom,pm8941-pwrkey: Document PMM8654AU dt-bindings: input: touchscreen: imagis: allow linux,keycodes for ist3038 Input: apbps2 - fix comment style and typos Input: gpio_keys - fall back to platform_get_irq() for interrupt-only keys Input: novatek-nvt-ts - drop wake_type check dt-bindings: input: touchscreen: tsc2007: document '#io-channel-cells' Input: ili210x - add support for polling mode dt-bindings: touchscreen: trivial-touch: Drop 'interrupts' requirement for old Ilitek Input: appletouch - fix potential race between resume and open HID: i2c-hid: Add FocalTech FT8112 dt-bindings: input: i2c-hid: Introduce FocalTech FT8112 Input: synaptics_i2c - switch to using managed resources Input: synaptics_i2c - guard polling restart in resume Input: gpio_decoder - don't use "proxy" headers Input: gpio_decoder - make use of the macros from bits.h Input: gpio_decoder - replace custom loop by gpiod_get_array_value_cansleep() Input: gpio_decoder - unify messages with help of dev_err_probe() Input: gpio_decoder - make use of device properties Input: serio - complete sizeof(*pointer) conversions Input: wdt87xx_i2c - switch to use dev_err_probe() ...

Merge branch 'next' into for-linus

2026-02-14T21:06:51+00:00

Prepare input updates for 7.0 merge window.

Input: novatek-nvt-ts - drop wake_type check

2026-01-25T05:42:31+00:00

The wake_type parameter from touchscreen registers is not used for anything functional - the driver only validates that it matches a hard-coded expected value per chip variant. This causes probe to fail on touchscreens that report a different wake_type despite being otherwise compatible. Drop the wake_type check and the associated chip data member to allow the existing compatibles to work with more touchscreen variants. Signed-off-by: Gianluca Boiano Suggested-by: Hans de Goede Link: https://patch.msgid.link/20260122001040.76869-1-morf3089@gmail.com Signed-off-by: Dmitry Torokhov

Input: ili210x - add support for polling mode

2026-01-22T00:17:51+00:00

There are designs incorporating Ilitek ILI2xxx touch controller that do not connect interrupt pin, for example Waveshare 13.3" DSI display. To support such systems use polling mode for the input device when I2C client does not have interrupt assigned to it. Factor out ili210x_firmware_update_noirq() to allow conditional scoped guard around this code. The scoped guard has to be applied only in case the IRQ line is connected, and not applied otherwise. Reviewed-by: Frank Li Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260121230736.114623-2-marek.vasut+renesas@mailbox.org Signed-off-by: Dmitry Torokhov

kernel.h: drop hex.h and update all hex.h users

2026-01-21T03:44:19+00:00

Remove from and update all users/callers of hex.h interfaces to directly #include as part of the process of putting kernel.h on a diet. Removing hex.h from kernel.h means that 36K C source files don't have to pay the price of parsing hex.h for the roughly 120 C source files that need it. This change has been build-tested with allmodconfig on most ARCHes. Also, all users/callers of in the entire source tree have been updated if needed (if not already #included). Link: https://lkml.kernel.org/r/20251215005206.2362276-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Reviewed-by: Andy Shevchenko Cc: Ingo Molnar Cc: Yury Norov (NVIDIA) Signed-off-by: Andrew Morton