summaryrefslogtreecommitdiff
path: root/drivers/hid
AgeCommit message (Collapse)Author
2025-03-26Merge branch 'for-6.15/amd_sfh' into for-linusJiri Kosina
From: Mario Limonciello <mario.limonciello@amd.com> Some platforms include a human presence detection (HPD) sensor. When enabled and a user is detected a wake event will be emitted from the sensor fusion hub that software can react to. Example use cases are "wake from suspend on approach" or to "lock when leaving". This is currently enabled by default on supported systems, but users can't control it. This essentially means that wake on approach is enabled which is a really surprising behavior to users that don't expect it. Instead of defaulting to enabled add a sysfs knob that users can use to enable the feature if desirable and set it to disabled by default.
2025-03-12HID: remove superfluous (and wrong) Makefile entry for ↵Jiri Kosina
CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER The line obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/ in top-level HID Makefile is both superfluous (as CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER depends on CONFIG_INTEL_ISH_HID, which contains intel-ish-hid/ already) and wrong (as it's missing the CONFIG_ prefix). Just remove it. Fixes: 91b228107da3e ("HID: intel-ish-hid: ISH firmware loader client driver") Reported-by: Jiri Slaby <jirislaby@kernel.org> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-05Merge tag 'hid-for-linus-2025030501' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - power management fix in intel-thc-hid (Even Xu) - nintendo gencon mapping fix (Ryan McClelland) - fix for UAF on device diconnect path in hid-steam (Vicki Pfau) - two fixes for UAF on device disconnect path in intel-ish-hid (Zhang Lixu) - fix for potential NULL dereference in hid-appleir (Daniil Dulov) - few other small cosmetic fixes (e.g. typos) * tag 'hid-for-linus-2025030501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: Intel-thc-hid: Intel-quickspi: Correct device state after S4 HID: intel-thc-hid: Fix spelling mistake "intput" -> "input" HID: hid-steam: Fix use-after-free when detaching device HID: debug: Fix spelling mistake "Messanger" -> "Messenger" HID: appleir: Fix potential NULL dereference at raw event handle HID: apple: disable Fn key handling on the Omoton KB066 HID: i2c-hid: improve i2c_hid_get_report error message HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() HID: google: fix unused variable warning under !CONFIG_ACPI HID: nintendo: fix gencon button events map HID: corsair-void: Update power supply values with a unified work handler
2025-03-05HID: Intel-thc-hid: Intel-quickspi: Correct device state names gramaticallyEven Xu
Correct quickspi device state name and change the list order to follow device state working flow. Signed-off-by: Even Xu <even.xu@intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: Intel-thc-hid: Intel-quickspi: Correct device state after S4Even Xu
During S4 retore flow, quickspi device was resetted by driver and state was changed to RESETTED. It is needed to be change to ENABLED state after S4 re-initialization finished, otherwise, device will run in wrong state and HID input data will be dropped. Signed-off-by: Even Xu <even.xu@intel.com> Fixes: 6912aaf3fd24 ("HID: intel-thc-hid: intel-quickspi: Add PM implementation") Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: wacom: Remove static WACOM_PKGLEN_MAX limitJason Gerecke
Rather than memcpy every packet that we receive from HID into our own local fixed-size array, we can just access the data directly through the original pointer. While we're at it, remove the few other places that assume a fixed maximum packet size and make them dynamic (in particular: temporary buffers created by the wacom_wac_queue_flush and wacom_intuos_bt_process_data functions; and the pen_fifo FIFO). To ensure pen_fifo allocation has access to the maximum used packet length, this commit also moves the function call to occur a little later in the probe process. Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: amd_sfh: Don't show wrong status for amd_sfh_hpd_info()Mario Limonciello
When HPD is present but has been disabled, avoid reporting HPD status to PMF. Cc: Pratap Nirujogi <pratap.nirujogi@amd.com> Tested-by: Anson Tsao <anson.tsao@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: amd_sfh: Default to HPD disabledMario Limonciello
Unless you know to look for it, HPD is a surprising behavior; particularly because it can wake the system from suspend. It also has implications for power consumption because sensors are left enabled. After the sensors have been probed (and HPD is found present), explicitly turn off HPD by default. Userspace can manually turn it on if desirable. Cc: Pratap Nirujogi <pratap.nirujogi@amd.com> Tested-by: Anson Tsao <anson.tsao@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: amd_sfh: Allow configuring whether HPD is enabled or disabledMario Limonciello
Human presence detection (HPD) sensor uses a camera to determine when user is physically in front of the machine. This might not be a desirable behavior because it can (for example) cause the machine to wake on approach. Add a new sysfs file "hpd" that will control whether this sensor is enabled. Use the value of this sysfs file to turn off HPD and prevent it from re-enabling after resume from suspend. Cc: Pratap Nirujogi <pratap.nirujogi@amd.com> Tested-by: Anson Tsao <anson.tsao@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: intel-thc-hid: Fix spelling mistake "intput" -> "input"Colin Ian King
There is a spelling mistake in a dev_err_once message. Fix it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Reviewed-by: Even Xu <even.xu@intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: hid-steam: Fix use-after-free when detaching deviceVicki Pfau
When a hid-steam device is removed it must clean up the client_hdev used for intercepting hidraw access. This can lead to scheduling deferred work to reattach the input device. Though the cleanup cancels the deferred work, this was done before the client_hdev itself is cleaned up, so it gets rescheduled. This patch fixes the ordering to make sure the deferred work is properly canceled. Reported-by: syzbot+0154da2d403396b2bd59@syzkaller.appspotmail.com Fixes: 79504249d7e2 ("HID: hid-steam: Move hidraw input (un)registering to work") Signed-off-by: Vicki Pfau <vi@endrift.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: debug: Fix spelling mistake "Messanger" -> "Messenger"Colin Ian King
There is a spelling mistake in a literal string. Fix it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: pidff: Fix set_device_control()Tomasz Pakuła
As the search for Device Control report is permissive, make sure the desired field was actually found, before trying to set it. Fix bitmask clearing as it was erronously using index instead of index - 1 (HID arrays index is 1-based). Add last two missing Device Control usages to the defined array. PID_PAUSE and PID_CONTINUE. Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: pidff: Fix 90 degrees direction name North -> EastTomasz Pakuła
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: pidff: Compute INFINITE value instead of using hardcoded 0xffffTomasz Pakuła
As per USB PID standard: INFINITE - Referrers to the maximum value of a range. i.e. if in an 8 bit unsigned field the value of 255 would indicate INFINITE. Detecting 0xffff (U16_MAX) is still important as we MIGHT get this value as infinite from some native software as 0 was never actually defined in Linux' FF api as the infinite value. I'm working on it though. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: pidff: Clamp effect playback LOOP_COUNT valueTomasz Pakuła
Ensures the loop count will never exceed the logical_maximum. Fixes implementation errors happening when applications use the max value of int32/DWORD as the effect iterations. This could be observed when running software both native and in wine. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: pidff: Rename two functions to align them with naming conventionTomasz Pakuła
Driver uses "set" everywhere to indicate setting report values and requesting HID_REQ_SET_REPORT Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: appleir: Fix potential NULL dereference at raw event handleDaniil Dulov
Syzkaller reports a NULL pointer dereference issue in input_event(). BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: null-ptr-deref in is_event_supported drivers/input/input.c:67 [inline] BUG: KASAN: null-ptr-deref in input_event+0x42/0xa0 drivers/input/input.c:395 Read of size 8 at addr 0000000000000028 by task syz-executor199/2949 CPU: 0 UID: 0 PID: 2949 Comm: syz-executor199 Not tainted 6.13.0-rc4-syzkaller-00076-gf097a36ef88d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 kasan_report+0xd9/0x110 mm/kasan/report.c:602 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] is_event_supported drivers/input/input.c:67 [inline] input_event+0x42/0xa0 drivers/input/input.c:395 input_report_key include/linux/input.h:439 [inline] key_down drivers/hid/hid-appleir.c:159 [inline] appleir_raw_event+0x3e5/0x5e0 drivers/hid/hid-appleir.c:232 __hid_input_report.constprop.0+0x312/0x440 drivers/hid/hid-core.c:2111 hid_ctrl+0x49f/0x550 drivers/hid/usbhid/hid-core.c:484 __usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650 usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734 dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993 __run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820 handle_softirqs+0x206/0x8d0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 __mod_timer+0x8f6/0xdc0 kernel/time/timer.c:1185 add_timer+0x62/0x90 kernel/time/timer.c:1295 schedule_timeout+0x11f/0x280 kernel/time/sleep_timeout.c:98 usbhid_wait_io+0x1c7/0x380 drivers/hid/usbhid/hid-core.c:645 usbhid_init_reports+0x19f/0x390 drivers/hid/usbhid/hid-core.c:784 hiddev_ioctl+0x1133/0x15b0 drivers/hid/usbhid/hiddev.c:794 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> This happens due to the malformed report items sent by the emulated device which results in a report, that has no fields, being added to the report list. Due to this appleir_input_configured() is never called, hidinput_connect() fails which results in the HID_CLAIMED_INPUT flag is not being set. However, it does not make appleir_probe() fail and lets the event callback to be called without the associated input device. Thus, add a check for the HID_CLAIMED_INPUT flag and leave the event hook early if the driver didn't claim any input_dev for some reason. Moreover, some other hid drivers accessing input_dev in their event callbacks do have similar checks, too. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 9a4a5574ce42 ("HID: appleir: add support for Apple ir devices") Cc: stable@vger.kernel.org Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: apple: disable Fn key handling on the Omoton KB066Alex Henrie
Remove the fixup to make the Omoton KB066's F6 key F6 when not holding Fn. That was really just a hack to allow typing F6 in fnmode>0, and it didn't fix any of the other F keys that were likewise untypable in fnmode>0. Instead, because the Omoton's Fn key is entirely internal to the keyboard, completely disable Fn key translation when an Omoton is detected, which will prevent the hid-apple driver from interfering with the keyboard's built-in Fn key handling. All of the F keys, including F6, are then typable when Fn is held. The Omoton KB066 and the Apple A1255 both have HID product code 05ac:022c. The self-reported name of every original A1255 when they left the factory was "Apple Wireless Keyboard". By default, Mac OS changes the name to "<username>'s keyboard" when pairing with the keyboard, but Mac OS allows the user to set the internal name of Apple keyboards to anything they like. The Omoton KB066's name, on the other hand, is not configurable: It is always "Bluetooth Keyboard". Because that name is so generic that a user might conceivably use the same name for a real Apple keyboard, detect Omoton keyboards based on both having that exact name and having HID product code 022c. Fixes: 819083cb6eed ("HID: apple: fix up the F6 key on the Omoton KB066 keyboard") Signed-off-by: Alex Henrie <alexhenrie24@gmail.com> Reviewed-by: Aditya Garg <gargaditya08@live.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: i2c-hid: improve i2c_hid_get_report error messageWentao Guan
We have two places to print "failed to set a report to ...", use "get a report from" instead of "set a report to", it makes people who knows less about the module to know where the error happened. Before: i2c_hid_acpi i2c-FTSC1000:00: failed to set a report to device: -11 After: i2c_hid_acpi i2c-FTSC1000:00: failed to get a report from device: -11 Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: lenovo: silence unreachable code warningDan Carpenter
In theory, this code used to return 0 if CONFIG_ACPI_PLATFORM_PROFILE was disabled. It's not clear if that was a config which would actually boot so we've removed the CONFIG_ACPI_PLATFORM_PROFILE ifdef. But now the "return 0;" statement is unreachable and static checker tools complain. Delete it and pull the else statement in a tab to silence the checker warning and make the code a bit more clear. Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: lenovo: Fix to ensure the data as __le32 instead of u32Vishnu Sankar
Ensure that data is treated as __le32 instead of u32 before applying le32_to_cpu. This patch fixes the sparse warning "sparse: cast to restricted __le32". Signed-off-by: Vishnu Sankar <vishnuocv@gmail.com> Signed-off-by: Vishnu Sankar <vsankar@lenovo.com> Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202501101635.qJrwAOwf-lkp@intel.com/ Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-24HID: bpf: add a v6.11+ compatible BPF fixup for the XPPen ACK05 remoteBenjamin Tissoires
With v6.11+, we can actually call hid_hw_output_report() and put the device into raw mode, thus getting accurate events without being messed up. Technically we could do the same on v6.10, but given that wayland, gnome and KDE are still not capable of handling the dial, and that v6.10 is EOL, we can safely save a little bit of compilation by only allowing v6.11+. We can easily export the battery information to userspace by adding a dedicated report. However, we need to cheat on the kernel to force it not to query the battery by making the physical collection a stylus. The kernel will then only rely on the events it gets from the device. Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/133 Acked-by: Jiri Kosina <jkosina@suse.com> Link: https://patch.msgid.link/20250207-bpf-import-2025-02-07-v1-7-6048fdd5a206@kernel.org Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-02-24HID: bpf: new hid_bpf_async.h common headerBenjamin Tissoires
The purpose is to simplify the use of bpf_wq to defer blocking operations in a sleepable context. Compared to a more "classic" async approach, there is no sync mechanism to wait for the async to finish. The "simple" API is the following: ``` static int HID_BPF_ASYNC(async_fun)(struct hid_bpf_ctx *hctx) { bpf_printk("%s", __fun__); return 0; } SEC("syscall") int probe(struct hid_bpf_probe_args *ctx) { ctx->retval = HID_BPF_ASYNC_INIT(async_fun); return 0; } SEC(HID_BPF_DEVICE_EVENT) int BPF_PROG(event_handler, struct hid_bpf_ctx *hctx) { /* async_fun() can be called now, it's not a sleepable * function in this example */ async_fun(hctx); /* but we can also delay the call by 10 ms */ HID_BPF_ASYNC_DELAYED_CALL(async_fun, hctx, 10); return 0; } HID_BPF_OPS(xppen_ack05_remote) = { .hid_device_event = (void *)event_handler, }; ``` Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/133 Acked-by: Jiri Kosina <jkosina@suse.com> Link: https://patch.msgid.link/20250207-bpf-import-2025-02-07-v1-6-6048fdd5a206@kernel.org Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-02-24HID: bpf: import new kfunc from v6.10 & v6.11Benjamin Tissoires
These kfunc are all in v6.10 except for the hid_bpf_try_input_report() which will be in v6.11. Import their definition once now so we can make use of it. Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/114 Acked-by: Jiri Kosina <jkosina@suse.com> Link: https://patch.msgid.link/20250207-bpf-import-2025-02-07-v1-5-6048fdd5a206@kernel.org Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-02-24HID: bpf: add support for the XP-Pen Artist Pro 19 (gen2)Benjamin Tissoires
The device behaves the same than the 16" and 14" models, so let's just add support for it too. Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/145 Acked-by: Jiri Kosina <jkosina@suse.com> Link: https://patch.msgid.link/20250207-bpf-import-2025-02-07-v1-4-6048fdd5a206@kernel.org Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-02-24HID: bpf: Added updated Kamvas Pro 19 descriptorBenjamin Tissoires
This adds an updated HID descriptor for the Huion Kamvas Pro 19 that is present on newer firmware revisions, while also trying to keep compat with the older versions. Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/164 Signed-off-by: Aki Van Ness <aki@lethalbit.net> Acked-by: Jiri Kosina <jkosina@suse.com> Link: https://patch.msgid.link/20250207-bpf-import-2025-02-07-v1-3-6048fdd5a206@kernel.org Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-02-24HID: bpf: Suppress bogus F13 trigger on Sirius keyboard full fan shortcutBenjamin Tissoires
The TUXEDO Sirius 16 Gen1 and the TUXEDO Sirius 16 Gen2 Notebooks have an additional "fan" key next to F12. Pressing it alone sends a F14 key press which can be bound by user space. Pressing it while holding the FN key triggers two things: - The EC firmware locks the fan speed of the internal fans at 100% - F13 key press is registered which by default is already bound in xkb and desktop environments (e.g. in KDE Plasma it launches system settings) To avoid this unexpected double duty of the FN shortcut, this bpf program suppresses the F13 key press. Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/166 Acked-by: Jiri Kosina <jkosina@suse.com> Link: https://patch.msgid.link/20250207-bpf-import-2025-02-07-v1-2-6048fdd5a206@kernel.org Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-02-24HID: bpf: Add support for the default firmware mode of the Huion K20Benjamin Tissoires
This re-uses the same HID report descriptor that we also use for the tablet mode after switching the device. The keys send uniquely identifyable shortcuts so we can map those to buttons. However the dial and the button inside the dial send events on a different hidraw node and they are unreliable (e.g. the button does not get released reliably). So they're ignored in this patch, it's not worth the effort getting those to work correctly. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/158 Acked-by: Jiri Kosina <jkosina@suse.com> Link: https://patch.msgid.link/20250207-bpf-import-2025-02-07-v1-1-6048fdd5a206@kernel.org Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-02-19HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()Zhang Lixu
The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed. Fixes: 0b28cb4bcb17 ("HID: intel-ish-hid: ISH HID client driver") Signed-off-by: Zhang Lixu <lixu.zhang@intel.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-19HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove()Zhang Lixu
During the `rmmod` operation for the `intel_ishtp_hid` driver, a use-after-free issue can occur in the hid_ishtp_cl_remove() function. The function hid_ishtp_cl_deinit() is called before ishtp_hid_remove(), which can lead to accessing freed memory or resources during the removal process. Call Trace: ? ishtp_cl_send+0x168/0x220 [intel_ishtp] ? hid_output_report+0xe3/0x150 [hid] hid_ishtp_set_feature+0xb5/0x120 [intel_ishtp_hid] ishtp_hid_request+0x7b/0xb0 [intel_ishtp_hid] hid_hw_request+0x1f/0x40 [hid] sensor_hub_set_feature+0x11f/0x190 [hid_sensor_hub] _hid_sensor_power_state+0x147/0x1e0 [hid_sensor_trigger] hid_sensor_runtime_resume+0x22/0x30 [hid_sensor_trigger] sensor_hub_remove+0xa8/0xe0 [hid_sensor_hub] hid_device_remove+0x49/0xb0 [hid] hid_destroy_device+0x6f/0x90 [hid] ishtp_hid_remove+0x42/0x70 [intel_ishtp_hid] hid_ishtp_cl_remove+0x6b/0xb0 [intel_ishtp_hid] ishtp_cl_device_remove+0x4a/0x60 [intel_ishtp] ... Additionally, ishtp_hid_remove() is a HID level power off, which should occur before the ISHTP level disconnect. This patch resolves the issue by reordering the calls in hid_ishtp_cl_remove(). The function ishtp_hid_remove() is now called before hid_ishtp_cl_deinit(). Fixes: f645a90e8ff7 ("HID: intel-ish-hid: ishtp-hid-client: use helper functions for connection") Signed-off-by: Zhang Lixu <lixu.zhang@intel.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-19HID: google: fix unused variable warning under !CONFIG_ACPIYu-Chun Lin
As reported by the kernel test robot, the following warning occurs: >> drivers/hid/hid-google-hammer.c:261:36: warning: 'cbas_ec_acpi_ids' defined but not used [-Wunused-const-variable=] 261 | static const struct acpi_device_id cbas_ec_acpi_ids[] = { | ^~~~~~~~~~~~~~~~ The 'cbas_ec_acpi_ids' array is only used when CONFIG_ACPI is enabled. Wrapping its definition and 'MODULE_DEVICE_TABLE' in '#ifdef CONFIG_ACPI' prevents a compiler warning when ACPI is disabled. Fixes: eb1aac4c8744f75 ("HID: google: add support tablet mode switch for Whiskers") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202501201141.jctFH5eB-lkp@intel.com/ Signed-off-by: Yu-Chun Lin <eleanor15x@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-19HID: google: don't include '<linux/pm_wakeup.h>' directlyWolfram Sang
The header clearly states that it does not want to be included directly, only via '<linux/(platform_)?device.h>'. Which is already present, so delete the superfluous include. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Acked-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-19HID: nintendo: fix gencon button events mapRyan McClelland
This fixes the button event map to match the 3-button recommendation as well as the redundant 'z' in the button map events for the Sega MD/Gen 6 Button. Signed-off-by: Ryan McClelland <rymcclel@gmail.com> Reviewed-by: Daniel J. Ogorchock <djogorchock@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-18Hid: Intel-thc-hid: Intel-thc: Fix "dubious: !x | !y" issueEven Xu
Change to use "||" to make it more readable and avoid miss understanding. Signed-off-by: Even Xu <even.xu@intel.com> Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202501292144.eFDq4ovr-lkp@intel.com Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-18HID: hid-universal-pidff: Fix spelling mistake "sucessfully" -> "successfully"Colin Ian King
There is a spelling mistake in a hid_info message. Fix it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Acked-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-18HID: appletb-kbd: Fix inconsistent indentation and pass -ENODEV to dev_err_probeAditya Garg
The following warnings were flagged by the kernel test robot: drivers/hid/hid-appletb-kbd.c:405 appletb_kbd_probe() warn: inconsistent indenting drivers/hid/hid-appletb-kbd.c:406 appletb_kbd_probe() warn: passing zero to 'dev_err_probe' This patch aims at fixing those warnings. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202502152006.fBBCdEr3-lkp@intel.com/ Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/linux-input/6263a1a2-4d50-41db-aa54-cfcb3e0523a4@stanley.mountain/ Fixes: 93a0fc489481 ("HID: hid-appletb-kbd: add support for automatic brightness control while using the touchbar") Signed-off-by: Aditya Garg <gargaditya08@live.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-18HID: hid-appletb-bl: fix incorrect error message for default brightnessAditya Garg
The error message responsible to show failure to set default backlight brightness incorrectly showed the intended brightness as off irrespective of what the user had set it. This patch intends to fix the same. Also, a small typo in MODULE_DESCRIPTION has been fixed. Signed-off-by: Aditya Garg <gargaditya08@live.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-18HID: hid-appletb-kbd: simplify logic used to switch between media and ↵Aditya Garg
function keys on pressing fn key This commit simplifies the logic in appletb_kbd_inp_event used for switching between the media and function keys on pressing the fn key. We now also prevent touching the kbd->saved_mode variable in case the esc key only mode is chosen. The following small fixes have also been done in this patch: - A small comment style error has been fixed - Fixed spelling in MODULE_DESCRIPTION - I have added myself to MODULE_AUTHOR Signed-off-by: Aditya Garg <gargaditya08@live.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-18HID: corsair-void: Update power supply values with a unified work handlerStuart Hayhurst
corsair_void_process_receiver can be called from an interrupt context, locking battery_mutex in it was causing a kernel panic. Fix it by moving the critical section into its own work, sharing this work with battery_add_work and battery_remove_work to remove the need for any locking Closes: https://bugzilla.suse.com/show_bug.cgi?id=1236843 Fixes: 6ea2a6fd3872 ("HID: corsair-void: Add Corsair Void headset family driver") Cc: stable@vger.kernel.org Signed-off-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com> Reviewed-by: Jiri Slaby <jirislaby@kernel.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-11HID: pidff: Remove redundant call to pidff_find_special_keysTomasz Pakuła
Probably left out as a mistake after Anssi created the helper macro Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-11HID: pidff: Support device error response from PID_BLOCK_LOADTomasz Pakuła
If an error happens on the device, the driver will no longer fall into the trap of reading this status 60 times before it decides that this reply won't change to success/memory full. Greatly reduces communication overhead during device error situation. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-11HID: pidff: Comment and code style updateTomasz Pakuła
Update comments to fully conform to the Linux comment styling. Define Linux infinite effect duration (0) as FF_INFINITE Chanage Oleg's name order Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-11HID: hid-universal-pidff: Add Asetek wheelbases supportTomasz Pakuła
Adds Asetek vendor id and product ids for: - Invicta - Forte - La Prima - Tony Kanaan v2: - Misc spelling fix in driver loaded info v3: - Chanage Oleg's name order Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-11HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAXTomasz Pakuła
As noted by Anssi some 20 years ago, pool report is sometimes messed up. This worked fine on many devices but casued oops on VRS DirectForce PRO. Here, we're making sure pool report is refetched before trying to access any of it's fields. While loop was replaced with a for loop + exit conditions were moved aroud to decrease the possibility of creating an infinite loop scenario. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-11HID: Kconfig: Add LEDS_CLASS_MULTICOLOR dependency to HID_LOGITECHKate Hsuan
The test bot found an issue with building hid-lg-g15. All errors (new ones prefixed by >>): powerpc-linux-ld: drivers/hid/hid-lg-g15.o: in function `lg_g510_kbd_led_write': >> drivers/hid/hid-lg-g15.c:241:(.text+0x768): undefined reference to `led_mc_calc_color_components' powerpc-linux-ld: drivers/hid/hid-lg-g15.o: in function `lg_g15_register_led': >> drivers/hid/hid-lg-g15.c:686:(.text+0xa9c): undefined reference to `devm_led_classdev_multicolor_register_ext' Since multicolor LED APIs manage the keyboard backlight settings of hid-lg-g15, the LEDS_CLASS_MULTICOLOR dependency was added to HID_LOGITECH. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202502110032.VZ0J024X-lkp@intel.com/ Fixes: a3a064146c50 ("HID: hid-lg-g15: Use standard multicolor LED API") Signed-off-by: Kate Hsuan <hpa@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-10Merge tag 'hid-for-linus-2025021001' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - build/dependency fixes for hid-lenovo and hid-intel-thc (Arnd Bergmann) - functional fixes for hid-corsair-void (Stuart Hayhurst) - workqueue handling and ordering fix for hid-steam (Vicki Pfau) - Gamepad mode vs. Lizard mode fix for hid-steam (Vicki Pfau) - OOB read fix for hid-thrustmaster (Tulio Fernandes) - fix for very long timeout on certain firmware in intel-ish-hid (Zhang Lixu) - other assorted small code fixes and device ID additions * tag 'hid-for-linus-2025021001' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: hid-steam: Don't use cancel_delayed_work_sync in IRQ context HID: hid-steam: Move hidraw input (un)registering to work HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints() HID: apple: fix up the F6 key on the Omoton KB066 keyboard HID: hid-apple: Apple Magic Keyboard a3203 USB-C support samples/hid: fix broken vmlinux path for VMLINUX_BTF samples/hid: remove unnecessary -I flags from libbpf EXTRA_CFLAGS HID: topre: Fix n-key rollover on Realforce R3S TKL boards HID: intel-ish-hid: ipc: Add Panther Lake PCI device IDs HID: multitouch: Add NULL check in mt_input_configured HID: winwing: Add NULL check in winwing_init_led() HID: hid-steam: Fix issues with disabling both gamepad mode and lizard mode HID: ignore non-functional sensor in HP 5MP Camera HID: intel-thc: fix CONFIG_HID dependency HID: lenovo: select CONFIG_ACPI_PLATFORM_PROFILE HID: intel-ish-hid: Send clock sync message immediately after reset HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell HID: corsair-void: Initialise memory for psy_cfg HID: corsair-void: Add missing delayed work cancel for headset status
2025-02-10HID: hid-appletb-bl: use appletb_bl_brightness_map instead of magic numbers ↵Aditya Garg
to set default brightness This commit makes use of appletb_bl_brightness_map instead of using if statements and magic numbers to set default brightness, and thus simplifies the code. Signed-off-by: Aditya Garg <gargaditya08@live.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-10HID: hid-appletb-kbd: make struct attribute *appletb_kbd_attrs[] staticAditya Garg
This commit addresses the sparse warning flagged by the kernel test robot. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202502091105.ZsLoBSIh-lkp@intel.com/ Signed-off-by: Aditya Garg <gargaditya08@live.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-02-08HID: Enable playstation driver for PlayStation 5 controllersAlex Henrie
Without entries in the hid_have_special_driver table, PS5 controllers default to the hidraw driver instead of the hid-playstation driver. Signed-off-by: Alex Henrie <dhenrale@amazon.com> Acked-by: Roderick Colenbrander <roderick.colenbrander@sony.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-02 02:12:31 +0000