summaryrefslogtreecommitdiff
path: root/drivers/hid
AgeCommit message (Collapse)AuthorFilesLines
2023-02-01HID: betop: check shape of output reportsPietro Borrello1-8/+9
[ Upstream commit 3782c0d6edf658b71354a64d60aa7a296188fc90 ] betopff_init() only checks the total sum of the report counts for each report field to be at least 4, but hid_betopff_play() expects 4 report fields. A device advertising an output report with one field and 4 report counts would pass the check but crash the kernel with a NULL pointer dereference in hid_betopff_play(). Fixes: 52cd7785f3cd ("HID: betop: add drivers/hid/hid-betopff.c") Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-02-01HID: revert CHERRY_MOUSE_000C quirkJiri Kosina2-2/+0
[ Upstream commit cbf44580ce6b310272a73e3e794233fd064330bd ] This partially reverts commit f6d910a89a2391 ("HID: usbhid: Add ALWAYS_POLL quirk for some mice"), as it turns out to break reboot on some platforms for reason yet to be understood. Fixes: f6d910a89a2391 ("HID: usbhid: Add ALWAYS_POLL quirk for some mice") Reported-by: Christian Zigotzky <chzigotzky@xenosoft.de> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-02-01HID: check empty report_list in bigben_probe()Pietro Borrello1-0/+5
[ Upstream commit c7bf714f875531f227f2ef1fdcc8f4d44e7c7d9d ] Add a check for empty report_list in bigben_probe(). The missing check causes a type confusion when issuing a list_entry() on an empty report_list. The problem is caused by the assumption that the device must have valid report_list. While this will be true for all normal HID devices, a suitably malicious device can violate the assumption. Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad") Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-02-01HID: check empty report_list in hid_validate_values()Pietro Borrello1-2/+2
[ Upstream commit b12fece4c64857e5fab4290bf01b2e0317a88456 ] Add a check for empty report_list in hid_validate_values(). The missing check causes a type confusion when issuing a list_entry() on an empty report_list. The problem is caused by the assumption that the device must have valid report_list. While this will be true for all normal HID devices, a suitably malicious device can violate the assumption. Fixes: 1b15d2e5b807 ("HID: core: fix validation of report id 0") Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-02-01HID: amd_sfh: Fix warning unwind gotoBasavaraj Natikar2-2/+2
[ Upstream commit 2a33ad4a0ba5a527b92aeef9a313aefec197fe28 ] Return directly instead of using existing goto will not cleanup previously allocated resources. Hence replace return with goto to fix warning unwind goto which cleanups previously allocated resources. Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality") Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-02-01HID: intel_ish-hid: Add check for ishtp_dma_tx_mapJiasheng Jiang1-0/+10
[ Upstream commit b3d40c3ec3dc4ad78017de6c3a38979f57aaaab8 ] As the kcalloc may return NULL pointer, it should be better to check the ishtp_dma_tx_map before use in order to avoid NULL pointer dereference. Fixes: 3703f53b99e4 ("HID: intel_ish-hid: ISH Transport layer") Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-01-07HID: Ignore HP Envy x360 eu0009nv stylus batteryJosé Expósito2-0/+3
[ Upstream commit cec827d658dd5c287ea8925737d45f0a60e47422 ] Battery status is reported for the HP Envy x360 eu0009nv stylus even though it does not have battery. Prevent it from always reporting the battery as low (1%). Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/823 Reported-by: Ioannis Iliopoulos <jxftw2424@gmail.com> Tested-by: Ioannis Iliopoulos <jxftw2424@gmail.com> Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-01-04HID: plantronics: Additional PIDs for double volume key presses quirkTerry Junge2-0/+12
[ Upstream commit 3d57f36c89d8ba32b2c312f397a37fd1a2dc7cfc ] I no longer work for Plantronics (aka Poly, aka HP) and do not have access to the headsets in order to test. However, as noted by Maxim, the other 32xx models that share the same base code set as the 3220 would need the same quirk. This patch adds the PIDs for the rest of the Blackwire 32XX product family that require the quirk. Plantronics Blackwire 3210 Series (047f:c055) Plantronics Blackwire 3215 Series (047f:c057) Plantronics Blackwire 3225 Series (047f:c058) Quote from previous patch by Maxim Mikityanskiy Plantronics Blackwire 3220 Series (047f:c056) sends HID reports twice for each volume key press. This patch adds a quirk to hid-plantronics for this product ID, which will ignore the second volume key press if it happens within 5 ms from the last one that was handled. The patch was tested on the mentioned model only, it shouldn't affect other models, however, this quirk might be needed for them too. Auto-repeat (when a key is held pressed) is not affected, because the rate is about 3 times per second, which is far less frequent than once in 5 ms. End quote Signed-off-by: Terry Junge <linuxhid@cosmicgizmosystems.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-01-04HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpointJosé Expósito1-0/+4
[ Upstream commit 4eab1c2fe06c98a4dff258dd64800b6986c101e9 ] The HID descriptor of this device contains two mouse collections, one for mouse emulation and the other for the trackpoint. Both collections get merged and, because the first one defines X and Y, the movemenent events reported by the trackpoint collection are ignored. Set the MT_CLS_WIN_8_FORCE_MULTI_INPUT class for this device to be able to receive its reports. This fix is similar to/based on commit 40d5bb87377a ("HID: multitouch: enable multi-input as a quirk for some devices"). Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/825 Reported-by: Akito <the@akito.ooo> Tested-by: Akito <the@akito.ooo> Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31HID: mcp2221: don't connect hidrawEnrik Berkhan1-3/+9
commit 67c90d14018775556d5420382ace86521421f9ff upstream. The MCP2221 driver should not connect to the hidraw userspace interface, as it needs exclusive access to the chip. If you want to use /dev/hidrawX with the MCP2221, you need to avoid binding this driver to the device and use the hid generic driver instead (e.g. using udev rules). Cc: stable@vger.kernel.org Reported-by: Sven Zühlsdorf <sven.zuehlsdorf@vigem.de> Signed-off-by: Enrik Berkhan <Enrik.Berkhan@inka.de> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20221103222714.21566-2-Enrik.Berkhan@inka.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-12-31HID: wacom: Ensure bootloader PID is usable in hidraw modeJason Gerecke3-0/+13
commit 1db1f392591aff13fd643f0ec7c1d5e27391d700 upstream. Some Wacom devices have a special "bootloader" mode that is used for firmware flashing. When operating in this mode, the device cannot be used for input, and the HID descriptor is not able to be processed by the driver. The driver generates an "Unknown device_type" warning and then returns an error code from wacom_probe(). This is a problem because userspace still needs to be able to interact with the device via hidraw to perform the firmware flash. This commit adds a non-generic device definition for 056a:0094 which is used when devices are in "bootloader" mode. It marks the devices with a special BOOTLOADER type that is recognized by wacom_probe() and wacom_raw_event(). When we see this type we ensure a hidraw device is created and otherwise keep our hands off so that userspace is in full control. Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Tested-by: Tatsunosuke Tobita <tatsunosuke.tobita@wacom.com> Cc: <stable@vger.kernel.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-12-31HID: logitech-hidpp: Guard FF init code against non-USB devicesBastien Nocera1-2/+9
commit 0e13e7b448005612972eae36c0f698c21d1e2f8a upstream. The Force Feedback code assumes that all the devices passed to it will be USB devices, but that might not be the case for emulated devices. Guard against a crash by checking the device type before poking at USB properties. Cc: stable@vger.kernel.org # v5.16+ Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Bastien Nocera <hadess@hadess.net> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20221215154416.111704-1-hadess@hadess.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-12-31HID: uclogic: Add support for XP-PEN Deco LWJosé Expósito3-0/+114
[ Upstream commit f9ce4db0ec2b6301f4264ba8627863e2632c922b ] The XP-PEN Deco LW is a UGEE v2 device with a frame with 8 buttons. Its pen has 2 buttons, supports tilt and pressure. It can be connected by USB cable or using a USB Bluetooth dongle to use it in wireless mode. When it is connected using the dongle, the device battery is used to power it. Its vendor, product and version are identical to the Deco L. The only difference reported by its firmware is the product name. In order to add support for battery reporting, add a new HID descriptor and a quirk to detect the wireless version of the tablet. Link: https://github.com/DIGImend/digimend-kernel-drivers/issues/635 Tested-by: Mia Kanashi <chad@redpilled.dev> Tested-by: Andreas Grosse <andig.mail@t-online.de> Tested-by: Mia Kanashi <chad@redpilled.dev> Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31HID: input: do not query XP-PEN Deco LW batteryJosé Expósito1-0/+6
[ Upstream commit 037c1aaeb96fe5f778026f4c1ef28b26cf600bfa ] The XP-PEN Deco LW drawing tablet can be connected by USB cable or using a USB Bluetooth dongle. When it is connected using the dongle, there might be a small delay until the tablet is paired with the dongle. Fetching the device battery during this delay results in random battery percentage values. Add a quirk to avoid actively querying the battery percentage and wait for the device to report it on its own. Reported-by: Mia Kanashi <chad@redpilled.dev> Tested-by: Mia Kanashi <chad@redpilled.dev> Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31HID: apple: enable APPLE_ISO_TILDE_QUIRK for the keyboards of Macs with the ↵Kerem Karabay1-8/+8
T2 chip [ Upstream commit 084bc074c231e716cbcb9e8f9db05b17fd3563cf ] The iso_layout parameter must be manually set to get the driver to swap KEY_102ND and KEY_GRAVE. This patch eliminates the need to do that. This is safe to do, as Macs with keyboards that do not need the quirk will keep working the same way as the value of hid->country will be different than HID_COUNTRY_INTERNATIONAL_ISO. This was tested by one person with a Mac with the WELLSPRINGT2_J152F keyboard with a layout that does not require the quirk to be set. Signed-off-by: Kerem Karabay <kekrby@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31HID: apple: fix key translations where multiple quirks attempt to translate ↵Kerem Karabay1-58/+44
the same key [ Upstream commit 5476fcf7f7b901db1cea92acb1abdd12609e30e1 ] The hid-apple driver does not support chaining translations or dependencies on other translations. This creates two problems: 1 - In Non-English keyboards of Macs, KEY_102ND and KEY_GRAVE are swapped and the APPLE_ISO_TILDE_QUIRK is used to work around this problem. The quirk is not set for the Macs where these bugs happen yet (see the 2nd patch for that), but this can be forced by setting the iso_layout parameter. Unfortunately, this only partially works. KEY_102ND gets translated to KEY_GRAVE, but KEY_GRAVE does not get translated to KEY_102ND, so both of them end up functioning as KEY_GRAVE. This is because the driver translates the keys as if Fn was pressed and the original is sent if it is not pressed, without any further translations happening on the key[#463]. KEY_GRAVE is present at macbookpro_no_esc_fn_keys[#195], so this is what happens: - KEY_GRAVE -> KEY_ESC (as if Fn is pressed) - KEY_GRAVE is returned (Fn isn't pressed, so translation is discarded) - KEY_GRAVE -> KEY_102ND (this part is not reached!) ... 2 - In case the touchbar does not work, the driver supports sending Escape when Fn+KEY_GRAVE is pressed. As mentioned previously, KEY_102ND is actually KEY_GRAVE and needs to be translated before this happens. Normally, these are the steps that should happen: - KEY_102ND -> KEY_GRAVE - KEY_GRAVE -> KEY_ESC (Fn is pressed) - KEY_ESC is returned Though this is what happens instead, as dependencies on other translations are not supported: - KEY_102ND -> KEY_ESC (Fn is pressed) - KEY_ESC is returned This patch fixes both bugs by ordering the translations correctly and by making the translations continue and not return immediately after translating a key so that chained translations work and translations can depend on other ones. This patch also simplifies the implementation of the swap_fn_leftctrl option a little bit, as it makes it simply use a normal translation instead adding extra code to translate a key to KEY_FN[#381]. This change wasn't put in another patch as the code that translates the Fn key needs to be changed because of the changes in the patch, and those changes would be discarded with the next patch anyway (the part that originally translates KEY_FN to KEY_LEFTCTRL needs to be made an else-if branch of the part that transltes KEY_LEFTCTRL to KEY_FN). Note: Line numbers (#XYZ) are for drivers/hid/hid-apple.c at commit 20afcc462579 ("HID: apple: Add "GANSS" to the non-Apple list"). Note: These bugs are only present on Macs with a keyboard with no dedicated escape key and a non-English layout. Signed-off-by: Kerem Karabay <kekrby@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31HID: amd_sfh: Add missing check for dma_alloc_coherentJiasheng Jiang1-0/+4
[ Upstream commit 53ffa6a9f83b2170c60591da1ead8791d5a42e81 ] Add check for the return value of the dma_alloc_coherent since it may return NULL pointer if allocation fails. Fixes: 4b2c53d93a4b ("SFH:Transport Driver to add support of AMD Sensor Fusion Hub (SFH)") Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Acked-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20221220024921.21992-1-jiasheng@iscas.ac.cn Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31HID: hid-sensor-custom: set fixed size for custom attributesMarcus Folkesson1-1/+1
[ Upstream commit 9d013910df22de91333a0acc81d1dbb115bd76f6 ] This is no bugfix (so no Fixes: tag is necessary) as it is taken care of in hid_sensor_custom_add_attributes(). The motivation for this patch is that: hid_sensor_custom_field.attr_name and hid_sensor_custom_field.attrs has the size of HID_CUSTOM_TOTAL_ATTRS and used in same context. We compare against HID_CUSTOM_TOTAL_ATTRS when looping through hid_custom_attrs. We will silent the smatch error: hid_sensor_custom_add_attributes() error: buffer overflow 'hid_custom_attrs' 8 <= 10 Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com> Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31HID: i2c: let RMI devices decide what constitutes wakeup eventDmitry Torokhov2-1/+4
[ Upstream commit 9984fbf55b9bd998b4ff66395cbb118020c1effa ] HID-RMI is special in the sense that it does not carry HID events directly, but rather uses HID protocol as a wrapper/transport for RMI protocol. Therefore we should not assume that all data coming from the device via interrupt is associated with user activity and report wakeup event indiscriminately, but rather let HID-RMI do that when appropriate. HID-RMI devices tag responses to the commands issued by the host as RMI_READ_DATA_REPORT_ID whereas motion and other input events from the device are tagged as RMI_ATTN_REPORT_ID. Change hid-rmi to report wakeup events when receiving the latter packets. This allows ChromeOS to accurately identify wakeup source and make correct decision on the mode of the resume the system should take ("dark" where the display stays off vs normal one). Fixes: d951ae1ce803 ("HID: i2c-hid: Report wakeup events") Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-08Merge tag 'for-linus-2022120801' of ↵Linus Torvalds9-22/+34
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: "A regression fix for handling Logitech HID++ devices and memory corruption fixes: - regression fix (revert) for catch-all handling of Logitech HID++ Bluetooth devices; there are devices that turn out not to work with this, and the root cause is yet to be properly understood. So we are dropping it for now, and it will be revisited for 6.2 or 6.3 (Benjamin Tissoires) - memory corruption fix in HID core (ZhangPeng) - memory corruption fix in hid-lg4ff (Anastasia Belova) - Kconfig fix for I2C_HID (Benjamin Tissoires) - a few device-id specific quirks that piggy-back on top of the important fixes above" * tag 'for-linus-2022120801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: Revert "HID: logitech-hidpp: Enable HID++ for all the Logitech Bluetooth devices" Revert "HID: logitech-hidpp: Remove special-casing of Bluetooth devices" HID: usbhid: Add ALWAYS_POLL quirk for some mice HID: core: fix shift-out-of-bounds in hid_report_raw_event HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk HID: fix I2C_HID not selected when I2C_HID_OF_ELAN is HID: hid-lg4ff: Add check for empty lbuf HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 HID: uclogic: Fix frame templates for big endian architectures
2022-12-08Revert "HID: logitech-hidpp: Enable HID++ for all the Logitech Bluetooth ↵Benjamin Tissoires1-19/+0
devices" This reverts commit 532223c8ac57605a10e46dc0ab23dcf01c9acb43. As reported in [0], hid-logitech-hidpp now binds on all bluetooth mice, but there are corner cases where hid-logitech-hidpp just gives up on the mouse. This leads the end user with a dead mouse. Given that we are at -rc8, we are definitively too late to find a proper fix. We already identified 2 issues less than 24 hours after the bug report. One in that ->match() was never designed to be used anywhere else than in hid-generic, and the other that hid-logitech-hidpp has corner cases where it gives up on devices it is not supposed to. So we have no choice but postpone this patch to the next kernel release. [0] https://lore.kernel.org/linux-input/CAJZ5v0g-_o4AqMgNwihCb0jrwrcJZfRrX=jv8aH54WNKO7QB8A@mail.gmail.com/ Reported-by: Rafael J . Wysocki <rjw@rjwysocki.net> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-12-08Revert "HID: logitech-hidpp: Remove special-casing of Bluetooth devices"Benjamin Tissoires1-0/+9
This reverts commit 8544c812e43ab7bdf40458411b83987b8cba924d. We need to revert commit 532223c8ac57 ("HID: logitech-hidpp: Enable HID++ for all the Logitech Bluetooth devices") because that commit might make hid-logitech-hidpp bind on mice that are not well enough supported by hid-logitech-hidpp, and the end result is that the probe of those mice is now returning -ENODEV, leaving the end user with a dead mouse. Given that commit 8544c812e43a ("HID: logitech-hidpp: Remove special-casing of Bluetooth devices") is a direct dependency of 532223c8ac57, revert it too. Note that this also adapt according to commit 908d325e1665 ("HID: logitech-hidpp: Detect hi-res scrolling support") to re-add support of the devices that were removed from that commit too. I have locally an MX Master and I tested this device with that revert, ensuring we still have high-res scrolling. Reported-by: Rafael J . Wysocki <rjw@rjwysocki.net> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-11-22HID: usbhid: Add ALWAYS_POLL quirk for some miceAnkit Patel2-0/+6
Some additional USB mouse devices are needing ALWAYS_POLL quirk without which they disconnect and reconnect every 60s. Add below devices to the known quirk list. CHERRY VID 0x046a, PID 0x000c MICROSOFT VID 0x045e, PID 0x0783 PRIMAX VID 0x0461, PID 0x4e2a Signed-off-by: Ankit Patel <anpatel@nvidia.com> Signed-off-by: Haotien Hsu <haotienh@nvidia.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-11-22HID: core: fix shift-out-of-bounds in hid_report_raw_eventZhangPeng1-0/+3
Syzbot reported shift-out-of-bounds in hid_report_raw_event. microsoft 0003:045E:07DA.0001: hid_field_extract() called with n (128) > 32! (swapper/0) ====================================================================== UBSAN: shift-out-of-bounds in drivers/hid/hid-core.c:1323:20 shift exponent 127 is too large for 32-bit type 'int' CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rc4-syzkaller-00159-g4bbf3422df78 #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_shift_out_of_bounds+0x3a6/0x420 lib/ubsan.c:322 snto32 drivers/hid/hid-core.c:1323 [inline] hid_input_fetch_field drivers/hid/hid-core.c:1572 [inline] hid_process_report drivers/hid/hid-core.c:1665 [inline] hid_report_raw_event+0xd56/0x18b0 drivers/hid/hid-core.c:1998 hid_input_report+0x408/0x4f0 drivers/hid/hid-core.c:2066 hid_irq_in+0x459/0x690 drivers/hid/usbhid/hid-core.c:284 __usb_hcd_giveback_urb+0x369/0x530 drivers/usb/core/hcd.c:1671 dummy_timer+0x86b/0x3110 drivers/usb/gadget/udc/dummy_hcd.c:1988 call_timer_fn+0xf5/0x210 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers+0x76a/0x980 kernel/time/timer.c:1790 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1803 __do_softirq+0x277/0x75b kernel/softirq.c:571 __irq_exit_rcu+0xec/0x170 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1107 ====================================================================== If the size of the integer (unsigned n) is bigger than 32 in snto32(), shift exponent will be too large for 32-bit type 'int', resulting in a shift-out-of-bounds bug. Fix this by adding a check on the size of the integer (unsigned n) in snto32(). To add support for n greater than 32 bits, set n to 32, if n is greater than 32. Reported-by: syzbot+8b1641d2f14732407e23@syzkaller.appspotmail.com Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split") Signed-off-by: ZhangPeng <zhangpeng362@huawei.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-11-21HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirkJosé Expósito1-0/+1
Commit f7d8e387d9ae ("HID: uclogic: Switch to Digitizer usage for styluses") changed the usage used in UCLogic from "Pen" to "Digitizer". However, the IS_INPUT_APPLICATION() macro evaluates to false for HID_DG_DIGITIZER causing issues with the XP-Pen Star G640 tablet. Add the HID_QUIRK_HIDINPUT_FORCE quirk to bypass the IS_INPUT_APPLICATION() check. Reported-by: Torge Matthies <openglfreak@googlemail.com> Reported-by: Alexander Zhang <alex@alexyzhang.dev> Tested-by: Alexander Zhang <alex@alexyzhang.dev> Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-11-15HID: fix I2C_HID not selected when I2C_HID_OF_ELAN isBenjamin Tissoires1-2/+2
When I2C_HID_OF_ELAN is set, we need to turn on I2C_HID_CORE to ensure we get all the HID requirements. Fixes: bd3cba00dcc6 ("HID: i2c-hid: elan: Add support for Elan eKTH6915 i2c-hid touchscreens") Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-11-15HID: hid-lg4ff: Add check for empty lbufAnastasia Belova1-0/+6
If an empty buf is received, lbuf is also empty. So lbuf is accessed by index -1. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: f31a2de3fe36 ("HID: hid-lg4ff: Allow switching of Logitech gaming wheels between compatibility modes") Signed-off-by: Anastasia Belova <abelova@astralinux.ru> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-11-15HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10Hans de Goede2-0/+6
The Acer Aspire Switch V 10 (SW5-017)'s keyboard-dock uses the same ITE controller setup as other Acer Switch 2-in-1's. This needs special handling for the wifi on/off toggle hotkey as well as to properly report touchpad on/off keypresses. Add the USB-ids for the SW5-017's keyboard-dock with a quirk setting of QUIRK_TOUCHPAD_ON_OFF_REPORT to fix both issues. Cc: Rudolf Polzer <rpolzer@google.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-11-14HID: uclogic: Fix frame templates for big endian architecturesJosé Expósito1-1/+1
When parsing a frame template with a placeholder indicating the number of buttons present on the frame its value was incorrectly set on big endian architectures due to double little endian conversion. In order to reproduce the issue and verify the fix, run the HID KUnit tests on the PowerPC architecture: $ ./tools/testing/kunit/kunit.py run --kunitconfig=drivers/hid \ --arch=powerpc --cross_compile=powerpc64-linux-gnu- Fixes: 867c89254425 ("HID: uclogic: Allow to generate frame templates") Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-11-11Merge tag 'for-linus-2022111101' of ↵Linus Torvalds3-9/+8
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - fix for memory leak (on error path) in Hyper-V driver (Yang Yingliang) - regression fix for handling 3rd barrel switch emulation in Wacom driver (Jason Gerecke) * tag 'for-linus-2022111101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: wacom: Fix logic used for 3rd barrel switch emulation HID: hyperv: fix possible memory leak in mousevsc_probe() HID: asus: Remove unused variable in asus_report_tool_width()
2022-11-04HID: wacom: Fix logic used for 3rd barrel switch emulationJason Gerecke1-5/+6
When support was added for devices using an explicit 3rd barrel switch, the logic used by devices emulating this feature was broken. The 'if' statement / block that was introduced only handles the case where the button is pressed (i.e. 'barrelswitch' and 'barrelswitch2' are both set) but not the case where it is released (i.e. one or both being cleared). This results in a BTN_STYLUS3 "down" event being sent when the button is pressed, but no "up" event ever being sent afterwards. This patch restores the previously-used logic for determining button states in the emulated case so that switches are reported correctly again. Link: https://github.com/linuxwacom/xf86-input-wacom/issues/292 Fixes: 6d09085b38e5 ("HID: wacom: Adding Support for new usages") CC: stable@vger.kernel.org #v5.19+ Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Tested-by: Joshua Dickens <joshua.dickens@wacom.com> Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-11-02HID: hyperv: fix possible memory leak in mousevsc_probe()Yang Yingliang1-1/+1
If hid_add_device() returns error, it should call hid_destroy_device() to free hid_dev which is allocated in hid_allocate_device(). Fixes: 74c4fb058083 ("HID: hv_mouse: Properly add the hid device") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Reviewed-by: Wei Liu <wei.liu@kernel.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-11-02HID: asus: Remove unused variable in asus_report_tool_width()Colin Ian King1-3/+1
Variable count is just being incremented and it's never used anywhere else. The variable and the increment are redundant so remove it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-10-22Merge tag 'for-linus-2022102101' of ↵Linus Torvalds6-9/+83
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Benjamin Tissoires: - a 12 year old bug fix for the Apple Magic Trackpad v1 (José Expósito) - a fix for a potential crash on removal of the Playstation controllers (Roderick Colenbrander) - a few new device IDs and device-specific quirks, most notably support of the new Playstation DualSense Edge controller * tag 'for-linus-2022102101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: lenovo: Make array tp10ubkbd_led static const HID: saitek: add madcatz variant of MMO7 mouse device ID HID: playstation: support updated DualSense rumble mode. HID: playstation: add initial DualSense Edge controller support HID: playstation: stop DualSense output work on remove. HID: magicmouse: Do not set BTN_MOUSE on double report
2022-10-18HID: lenovo: Make array tp10ubkbd_led static constColin Ian King1-1/+1
Don't populate the read-only array tp10ubkbd_led on the stack but instead make it static const. Also makes the object code a little smaller. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-10-18HID: saitek: add madcatz variant of MMO7 mouse device IDSamuel Bailey3-0/+4
The MadCatz variant of the MMO7 mouse has the ID 0738:1713 and the same quirks as the Saitek variant. Signed-off-by: Samuel Bailey <samuel.bailey1@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-10-14HID: playstation: support updated DualSense rumble mode.Roderick Colenbrander1-1/+36
Newer DualSense firmware supports a revised classic rumble mode, which feels more similar to rumble as supported on previous PlayStation controllers. It has been made the default on PlayStation and non-PlayStation devices now (e.g. iOS and Windows). Default to this new mode when supported. Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20221010212313.78275-4-roderick.colenbrander@sony.com
2022-10-14HID: playstation: add initial DualSense Edge controller supportRoderick Colenbrander2-1/+5
Provide initial support for the DualSense Edge controller. The brings support up to the level of the original DualSense, but won't yet provide support for new features (e.g. reprogrammable buttons). Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com> CC: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20221010212313.78275-3-roderick.colenbrander@sony.com
2022-10-14HID: playstation: stop DualSense output work on remove.Roderick Colenbrander1-5/+36
Ensure we don't schedule any new output work on removal and wait for any existing work to complete. If we don't do this e.g. rumble work can get queued during deletion and we trigger a kernel crash. Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com> CC: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20221010212313.78275-2-roderick.colenbrander@sony.com
2022-10-14HID: magicmouse: Do not set BTN_MOUSE on double reportJosé Expósito1-1/+1
Under certain conditions the Magic Trackpad can group 2 reports in a single packet. The packet is split and the raw event function is invoked recursively for each part. However, after processing each part, the BTN_MOUSE status is updated, sending multiple click events. [1] Return after processing double reports to avoid this issue. Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/811 # [1] Fixes: a462230e16ac ("HID: magicmouse: enable Magic Trackpad support") Reported-by: Nulo <git@nulo.in> Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20221009182747.90730-1-jose.exposito89@gmail.com
2022-10-11Merge tag 'input-for-v6.1-rc0' of ↵Linus Torvalds1-1/+2
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - a new driver for IBM Operational Panel - a new driver for PinePhone keyboards - RT5120 PMIC power key support - various enhancements and support for new models in xpad (Xbox) driver - a new compatible ID for Elan touchscreen driver - rework of adp5588-keys driver to support configuring via device properties (OF, ACPI, etc) instead of platform data, and proper support of optional gpiochip functionality (and removal of gpio-adp5588 driver) - improvements to firmware update handling in Synaptics RMI4 driver - support for double key matrix in mt6779-keypad - support for polled mode in adc-joystick driver - other assorted driver fixes, cleanups and improvements * tag 'input-for-v6.1-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (90 commits) Input: i8042 - fix refount leak on sparc Input: i8042 - add LoongArch support in i8042-acpipnpio.h Input: i8042 - rename i8042-x86ia64io.h to i8042-acpipnpio.h Input: pinephone-keyboard - support the proxied I2C bus Input: pinephone-keyboard - add PinePhone keyboard driver dt-bindings: input: Add the PinePhone keyboard binding dt-bindings: input: Convert hid-over-i2c to DT schema input: drop empty comment blocks Input: xpad - add X-Box Adaptive Profile button Input: add ABS_PROFILE to uapi and documentation Input: xpad - add X-Box Adaptive XBox button Input: xpad - add X-Box Adaptive support Input: ims-pcu - fix spelling mistake "BOOLTLOADER" -> "BOOTLOADER" Input: ibm-panel - add missing MODULE_DEVICE_TABLE Input: icn8505 - utilize acpi_get_subsystem_id() Input: xpad - decipher xpadone packages with GIP defines Input: xpad - refactor using BIT() macro Input: synaptics-rmi4 - convert to use sysfs_emit() APIs Input: twl4030-pwrbutton - add missing of.h include Input: applespi - replace zero-length array with DECLARE_FLEX_ARRAY() helper ...
2022-10-07Merge tag 'for-linus-2022100501' of ↵Linus Torvalds35-300/+988
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Benjamin Tissoires: - handle of all Logitech Bluetooth HID++ devices in the Logitech HID++ drivers (Bastien Nocera) - fix broken atomic checks in hid-multitouch by adding memory barriers (Andri Yngvason) - better handling of devices with AMD SFH1.1 (Basavaraj Natikar) - better support of Nintendo clone controllers (Icenowy Zheng and Johnothan King) - Support for various RC controllers (Marcus Folkesson) - Add UGEEv2 support in hid-uclogic (XP-PEN Deco Pro S and Parblo A610 PRO) (José Expósito) - some conversions to use dev_groups (Greg Kroah-Hartman) - HID-BPF preparatory patches, mostly to convert blank defines as enums (Benjamin Tissoires) * tag 'for-linus-2022100501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (38 commits) HID: wacom: add three styli to wacom_intuos_get_tool_type HID: amd_sfh: Handle condition of "no sensors" for SFH1.1 HID: amd_sfh: Change dev_err to dev_dbg for additional debug info HID: nintendo: check analog user calibration for plausibility HID: nintendo: deregister home LED when it fails HID: roccat: Fix use-after-free in roccat_read() hid: topre: Add driver fixing report descriptor HID: multitouch: Add memory barriers HID: convert defines of HID class requests into a proper enum HID: export hid_report_type to uapi HID: core: store the unique system identifier in hid_device HID: Add driver for PhoenixRC Flight Controller HID: Add driver for VRC-2 Car Controller HID: sony: Fix double word in comments hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event HID: logitech-hidpp: Detect hi-res scrolling support HID: logitech-hidpp: Remove hard-coded "Sw. Id." for HID++ 2.0 commands HID: logitech-hidpp: Fix "Sw. Id." for HID++ 2.0 commands HID: logitech-hidpp: Remove special-casing of Bluetooth devices HID: logitech-hidpp: Enable HID++ for all the Logitech Bluetooth devices ...
2022-10-05Merge branch 'for-6.1/google' into for-linusBenjamin Tissoires4-19/+22
- convert to use dev_groups (Greg Kroah-Hartman)
2022-10-05Merge branch 'for-6.1/rmi' into for-linusBenjamin Tissoires1-4/+2
- compilation warning fix (Jiangshan Yi)
2022-10-05Merge branch 'for-6.1/wacom' into for-linusBenjamin Tissoires4-17/+2
- Simplify comments (Christophe JAILLET)
2022-10-05Merge branch 'for-6.1/uclogic' into for-linusBenjamin Tissoires10-51/+500
- Add UGEEv2 support (XP-PEN Deco Pro S and Parblo A610 PRO) (José Expósito)
2022-10-05Merge branch 'for-6.1/rc-controllers' into for-linusBenjamin Tissoires5-0/+225
- Support for various RC controllers (Marcus Folkesson)
2022-10-05Merge branch 'for-6.1/topre' into for-linusBenjamin Tissoires4-0/+59
- Fix Topre REALFORCE R2 keyboard so it can send more than 6 keys at the time (Harry Stern)
2022-10-05Merge branch 'for-6.1/nintendo' into for-linusBenjamin Tissoires1-28/+32
- better support of Nintendo clone controllers (Icenowy Zheng and Johnothan King)
2022-10-05Merge branch 'for-6.1/amd_sfh' into for-linusBenjamin Tissoires1-3/+5
- reduce verbosity of amd_sfh driver (Basavaraj Natikar) - better handling of devices with SFH1.1 (Basavaraj Natikar)
generated by cgit v1.2.3 (git 2.39.0) at 2026-01-23 05:49:17 +0300