summaryrefslogtreecommitdiff
path: root/drivers/hid
AgeCommit message (Collapse)Author
2025-04-24HID: mcp2200: use new line value setter callbacksBartosz Golaszewski
struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: cp2112: use new line value setter callbacksBartosz Golaszewski
struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: cp2112: use lock guardsBartosz Golaszewski
Simplify the code by using the lock guards from linux/cleanup.h throughout the driver. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: cp2112: hold the lock for the entire direction_output() callBartosz Golaszewski
We currently take the lock, set direction to output, release it, reacquire it and set the desired value. That doesn't look correct. Introduce a helper function that sets the value without taking the lock and use it where applicable in order to combine the critical sections. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: cp2112: destroy mutex on driver detachBartosz Golaszewski
Use the devres variant of mutex_init() in order to free resources allocated with mutex debugging enabled. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: intel-thc-hid: intel-quicki2c: pass correct arguments to ↵Wentao Guan
acpi_evaluate_object Delete unused argument, pass correct argument to acpi_evaluate_object. Log: intel_quicki2c 0000:00:10.0: enabling device (0000 -> 0002) ACPI: \_SB.PC00.THC0.ICRS: 1 arguments were passed to a non-method ACPI object (Buffer) (20230628/nsarguments-211) ACPI: \_SB.PC00.THC0.ISUB: 1 arguments were passed to a non-method ACPI object (Buffer) (20230628/nsarguments-211) Fixes: 5282e45ccbfa ("HID: intel-thc-hid: intel-quicki2c: Add THC QuickI2C ACPI interfaces") Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Signed-off-by: WangYuli <wangyuli@uniontech.com> Reviewed-by: Even Xu <even.xu@intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: corsair-void: Use to_delayed_work()Chen Ni
Use to_delayed_work() instead of open-coding it. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: wacom: fix memory leak on size mismatch in wacom_wac_queue_flush()Qasim Ijaz
In wacom_wac_queue_flush() the code allocates zero initialised buffer which it uses as a storage buffer for copying data from a fifo via kfifo_out(). The kfifo_out() function returns the number of elements it has copied. The code checks if the number of copied elements does not equal the size of the fifo record, if it does not it simply skips the entry and continues to the next iteration. However it does not release the storage buffer leading to a memory leak. Fix the memory leak by freeing the buffer on size mismatch. Fixes: 5e013ad20689 ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit") Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com> Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: wacom: handle kzalloc() allocation failure in wacom_wac_queue_flush()Qasim Ijaz
During wacom_wac_queue_flush() the code calls kzalloc() to allocate a zero initialised buffer which it uses as a storage buffer to get data from the fifo via kfifo_out(). However it does not check kzalloc() for allocation failure which returns NULL and could potentially lead to a NULL deref. Fix this by checking for kzalloc() failure and skipping the current entry if allocation failure occurs. Fixes: 5e013ad20689 ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit") Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: thrustmaster: fix memory leak in thrustmaster_interrupts()Qasim Ijaz
In thrustmaster_interrupts(), the allocated send_buf is not freed if the usb_check_int_endpoints() check fails, leading to a memory leak. Fix this by ensuring send_buf is freed before returning in the error path. Fixes: 50420d7c79c3 ("HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check") Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: bpf: fix BTN_STYLUS for the XP Pen ACK05 remotePeter Hutterer
Usage_Dig_BarrelSwitch was applied in the UsagePage_Button which incorrectly mapped to BTN_TOOL_PENCIL Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/193 Fixes: 834da375 ("bpf: add a v6.11+ compatible BPF fixup for the XPPen ACK05 remote") Link: https://patchwork.kernel.org/project/linux-input/patch/20250207-bpf-import-2025-02-07-v1-7-6048fdd5a206@kernel.org/ Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: hid-logitech: use sysfs_emit_at() instead of scnprintf()TangDongxing
Follow the advice in Documentation/filesystems/sysfs.rst: show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: TangDongxing <tang.dongxing@zte.com.cn> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: quirks: Add HID_QUIRK_IGNORE_MOUSE quirkAditya Garg
Some USB HID mice have drivers both in HID as well as a separate USB driver. The already existing hid_mouse_ignore_list in hid-quirks manages this, but is not yet configurable by usbhid.quirks, unlike all others like hid_ignore_list. Thus in some HID devices, where the vendor provides USB drivers only for the mouse and lets keyboard handled by the generic hid drivers, presence of such a quirk prevents the user from compiling hid core again to add the device to the table. Signed-off-by: Aditya Garg <gargaditya08@live.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()Terry Junge
Update struct hid_descriptor to better reflect the mandatory and optional parts of the HID Descriptor as per USB HID 1.11 specification. Note: the kernel currently does not parse any optional HID class descriptors, only the mandatory report descriptor. Update all references to member element desc[0] to rpt_desc. Add test to verify bLength and bNumDescriptors values are valid. Replace the for loop with direct access to the mandatory HID class descriptor member for the report descriptor. This eliminates the possibility of getting an out-of-bounds fault. Add a warning message if the HID descriptor contains any unsupported optional HID class descriptors. Reported-by: syzbot+c52569baf0c843f35495@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c52569baf0c843f35495 Fixes: f043bfc98c19 ("HID: usbhid: fix out-of-bounds bug") Cc: stable@vger.kernel.org Signed-off-by: Terry Junge <linuxhid@cosmicgizmosystems.com> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: Kysona: Add periodic online checkLode Willems
This patch adds a periodic online check at the same interval the battery status gets requested. With this change the driver can detect when the mouse is turned off while the dongle is still plugged in. Tested with a Kysona M600 V-HUB Special Edition. Signed-off-by: Lode Willems <me@lodewillems.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-05treewide: Switch/rename to timer_delete[_sync]()Thomas Gleixner
timer_delete[_sync]() replaces del_timer[_sync](). Convert the whole tree over and remove the historical wrapper inlines. Conversion was done with coccinelle plus manual fixups where necessary. Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Ingo Molnar <mingo@kernel.org>
2025-03-26Merge branch 'for-6.15/wacom' into for-linusJiri Kosina
- removal of WACOM_PKGLEN_MAX limit in Wacom driver (Jason Gerecke)
2025-03-26Merge branch 'for-6.15/usb-hidbp' into for-linusJiri Kosina
- fix for LED_KANA handling in hidbp (junan)
2025-03-26Merge branch 'for-6.15/steam' into for-linusJiri Kosina
- code cleanup (Vicki Pfau)
2025-03-26Merge branch 'for-6.15/sony' into for-linusJiri Kosina
- PlayStation 5 controllers support (Alex Henrie)
2025-03-26Merge branch 'for-6.15/plantronics' into for-linusJiri Kosina
- improved mute handling (Terry Junge)
2025-03-26Merge branch 'for-6.15/pidff' into for-linusJiri Kosina
From: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> This patch series is focused on improving the compatibility and usability of the hid-pidff force feedback driver. Last patch introduces a new, universal driver for PID devices that need some special handling like report fixups, remapping the button range, managing new pidff quirks and setting desirable fuzz/flat values. This work has been done in the span of the past months with the help of the great Linux simracing community, with a little input from sim flight fans from FFBeast. No changes interfere with compliant and currently working PID devices. "Generic" codepath was tested as well with Moza and Simxperience AccuForce v2. I'm not married to the name. It's what we used previously, but if "universal" is confusing (pidff is already the generic driver), we can come up with something better like "hid-quirky-pidff" :) With v8 and tiny finx in v9, all the outstanding issues were resolved, additional pidff issues were fixed and hid-pidff defines moved to a dedicated header file. This patch series could be considered done bar any comments and requests from input maintainers. I could save more then a dozen lines of code by changing simple if statements to only occupy on line instead of two in there's a need for that.
2025-03-26Merge branch 'for-6.15/logitech' into for-linusJiri Kosina
- conversion of hid-lg-g15 to standard multicolor LED API (Kate Hsuan)
2025-03-26Merge branch 'for-6.15/lenovo' into for-linusJiri Kosina
- code cleanups (Dan Carpenter, Vishnu Sankar)
2025-03-26Merge branch 'for-6.15/intel-thc' into for-linusJiri Kosina
- removal of deprecated PCI API calls (Philipp Stanner) - code cleanups (Even Xu)
2025-03-26Merge branch 'for-6.15/intel-ish' into for-linusJiri Kosina
- intel-ish Kbuild cleanup (Jiri Kosina)
2025-03-26Merge branch 'for-6.15/google' into for-linusJiri Kosina
- small include cleanup (Wolfram Sang)
2025-03-26Merge branch 'for-6.15/core' into for-linusJiri Kosina
- differentiate warning for reserved item tag from unknown item tag, in accordance to 6.2.2.4 from the HID specification 1.11 (Tatsuya S)
2025-03-26Merge branch 'for-6.15/bpf' into for-linusJiri Kosina
- a few hid-bpf device fixes from udev-hid-bpf; XP-Pen and Huion plus one from TUXEDO (Benjamin Tissoires)
2025-03-26Merge branch 'for-6.15/apple' into for-linusJiri Kosina
- support for Apple Touch Bars (Kerem Karabay, Aditya Garg)
2025-03-26Merge branch 'for-6.15/amd_sfh' into for-linusJiri Kosina
From: Mario Limonciello <mario.limonciello@amd.com> Some platforms include a human presence detection (HPD) sensor. When enabled and a user is detected a wake event will be emitted from the sensor fusion hub that software can react to. Example use cases are "wake from suspend on approach" or to "lock when leaving". This is currently enabled by default on supported systems, but users can't control it. This essentially means that wake on approach is enabled which is a really surprising behavior to users that don't expect it. Instead of defaulting to enabled add a sysfs knob that users can use to enable the feature if desirable and set it to disabled by default.
2025-03-12HID: remove superfluous (and wrong) Makefile entry for ↵Jiri Kosina
CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER The line obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/ in top-level HID Makefile is both superfluous (as CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER depends on CONFIG_INTEL_ISH_HID, which contains intel-ish-hid/ already) and wrong (as it's missing the CONFIG_ prefix). Just remove it. Fixes: 91b228107da3e ("HID: intel-ish-hid: ISH firmware loader client driver") Reported-by: Jiri Slaby <jirislaby@kernel.org> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-05Merge tag 'hid-for-linus-2025030501' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - power management fix in intel-thc-hid (Even Xu) - nintendo gencon mapping fix (Ryan McClelland) - fix for UAF on device diconnect path in hid-steam (Vicki Pfau) - two fixes for UAF on device disconnect path in intel-ish-hid (Zhang Lixu) - fix for potential NULL dereference in hid-appleir (Daniil Dulov) - few other small cosmetic fixes (e.g. typos) * tag 'hid-for-linus-2025030501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: Intel-thc-hid: Intel-quickspi: Correct device state after S4 HID: intel-thc-hid: Fix spelling mistake "intput" -> "input" HID: hid-steam: Fix use-after-free when detaching device HID: debug: Fix spelling mistake "Messanger" -> "Messenger" HID: appleir: Fix potential NULL dereference at raw event handle HID: apple: disable Fn key handling on the Omoton KB066 HID: i2c-hid: improve i2c_hid_get_report error message HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() HID: google: fix unused variable warning under !CONFIG_ACPI HID: nintendo: fix gencon button events map HID: corsair-void: Update power supply values with a unified work handler
2025-03-05HID: Intel-thc-hid: Intel-quickspi: Correct device state names gramaticallyEven Xu
Correct quickspi device state name and change the list order to follow device state working flow. Signed-off-by: Even Xu <even.xu@intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: Intel-thc-hid: Intel-quickspi: Correct device state after S4Even Xu
During S4 retore flow, quickspi device was resetted by driver and state was changed to RESETTED. It is needed to be change to ENABLED state after S4 re-initialization finished, otherwise, device will run in wrong state and HID input data will be dropped. Signed-off-by: Even Xu <even.xu@intel.com> Fixes: 6912aaf3fd24 ("HID: intel-thc-hid: intel-quickspi: Add PM implementation") Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: wacom: Remove static WACOM_PKGLEN_MAX limitJason Gerecke
Rather than memcpy every packet that we receive from HID into our own local fixed-size array, we can just access the data directly through the original pointer. While we're at it, remove the few other places that assume a fixed maximum packet size and make them dynamic (in particular: temporary buffers created by the wacom_wac_queue_flush and wacom_intuos_bt_process_data functions; and the pen_fifo FIFO). To ensure pen_fifo allocation has access to the maximum used packet length, this commit also moves the function call to occur a little later in the probe process. Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: amd_sfh: Don't show wrong status for amd_sfh_hpd_info()Mario Limonciello
When HPD is present but has been disabled, avoid reporting HPD status to PMF. Cc: Pratap Nirujogi <pratap.nirujogi@amd.com> Tested-by: Anson Tsao <anson.tsao@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: amd_sfh: Default to HPD disabledMario Limonciello
Unless you know to look for it, HPD is a surprising behavior; particularly because it can wake the system from suspend. It also has implications for power consumption because sensors are left enabled. After the sensors have been probed (and HPD is found present), explicitly turn off HPD by default. Userspace can manually turn it on if desirable. Cc: Pratap Nirujogi <pratap.nirujogi@amd.com> Tested-by: Anson Tsao <anson.tsao@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: amd_sfh: Allow configuring whether HPD is enabled or disabledMario Limonciello
Human presence detection (HPD) sensor uses a camera to determine when user is physically in front of the machine. This might not be a desirable behavior because it can (for example) cause the machine to wake on approach. Add a new sysfs file "hpd" that will control whether this sensor is enabled. Use the value of this sysfs file to turn off HPD and prevent it from re-enabling after resume from suspend. Cc: Pratap Nirujogi <pratap.nirujogi@amd.com> Tested-by: Anson Tsao <anson.tsao@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: intel-thc-hid: Fix spelling mistake "intput" -> "input"Colin Ian King
There is a spelling mistake in a dev_err_once message. Fix it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Reviewed-by: Even Xu <even.xu@intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: hid-steam: Fix use-after-free when detaching deviceVicki Pfau
When a hid-steam device is removed it must clean up the client_hdev used for intercepting hidraw access. This can lead to scheduling deferred work to reattach the input device. Though the cleanup cancels the deferred work, this was done before the client_hdev itself is cleaned up, so it gets rescheduled. This patch fixes the ordering to make sure the deferred work is properly canceled. Reported-by: syzbot+0154da2d403396b2bd59@syzkaller.appspotmail.com Fixes: 79504249d7e2 ("HID: hid-steam: Move hidraw input (un)registering to work") Signed-off-by: Vicki Pfau <vi@endrift.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: debug: Fix spelling mistake "Messanger" -> "Messenger"Colin Ian King
There is a spelling mistake in a literal string. Fix it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: pidff: Fix set_device_control()Tomasz Pakuła
As the search for Device Control report is permissive, make sure the desired field was actually found, before trying to set it. Fix bitmask clearing as it was erronously using index instead of index - 1 (HID arrays index is 1-based). Add last two missing Device Control usages to the defined array. PID_PAUSE and PID_CONTINUE. Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: pidff: Fix 90 degrees direction name North -> EastTomasz Pakuła
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: pidff: Compute INFINITE value instead of using hardcoded 0xffffTomasz Pakuła
As per USB PID standard: INFINITE - Referrers to the maximum value of a range. i.e. if in an 8 bit unsigned field the value of 255 would indicate INFINITE. Detecting 0xffff (U16_MAX) is still important as we MIGHT get this value as infinite from some native software as 0 was never actually defined in Linux' FF api as the infinite value. I'm working on it though. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: pidff: Clamp effect playback LOOP_COUNT valueTomasz Pakuła
Ensures the loop count will never exceed the logical_maximum. Fixes implementation errors happening when applications use the max value of int32/DWORD as the effect iterations. This could be observed when running software both native and in wine. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: pidff: Rename two functions to align them with naming conventionTomasz Pakuła
Driver uses "set" everywhere to indicate setting report values and requesting HID_REQ_SET_REPORT Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: appleir: Fix potential NULL dereference at raw event handleDaniil Dulov
Syzkaller reports a NULL pointer dereference issue in input_event(). BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: null-ptr-deref in is_event_supported drivers/input/input.c:67 [inline] BUG: KASAN: null-ptr-deref in input_event+0x42/0xa0 drivers/input/input.c:395 Read of size 8 at addr 0000000000000028 by task syz-executor199/2949 CPU: 0 UID: 0 PID: 2949 Comm: syz-executor199 Not tainted 6.13.0-rc4-syzkaller-00076-gf097a36ef88d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 kasan_report+0xd9/0x110 mm/kasan/report.c:602 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] is_event_supported drivers/input/input.c:67 [inline] input_event+0x42/0xa0 drivers/input/input.c:395 input_report_key include/linux/input.h:439 [inline] key_down drivers/hid/hid-appleir.c:159 [inline] appleir_raw_event+0x3e5/0x5e0 drivers/hid/hid-appleir.c:232 __hid_input_report.constprop.0+0x312/0x440 drivers/hid/hid-core.c:2111 hid_ctrl+0x49f/0x550 drivers/hid/usbhid/hid-core.c:484 __usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650 usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734 dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993 __run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820 handle_softirqs+0x206/0x8d0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 __mod_timer+0x8f6/0xdc0 kernel/time/timer.c:1185 add_timer+0x62/0x90 kernel/time/timer.c:1295 schedule_timeout+0x11f/0x280 kernel/time/sleep_timeout.c:98 usbhid_wait_io+0x1c7/0x380 drivers/hid/usbhid/hid-core.c:645 usbhid_init_reports+0x19f/0x390 drivers/hid/usbhid/hid-core.c:784 hiddev_ioctl+0x1133/0x15b0 drivers/hid/usbhid/hiddev.c:794 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> This happens due to the malformed report items sent by the emulated device which results in a report, that has no fields, being added to the report list. Due to this appleir_input_configured() is never called, hidinput_connect() fails which results in the HID_CLAIMED_INPUT flag is not being set. However, it does not make appleir_probe() fail and lets the event callback to be called without the associated input device. Thus, add a check for the HID_CLAIMED_INPUT flag and leave the event hook early if the driver didn't claim any input_dev for some reason. Moreover, some other hid drivers accessing input_dev in their event callbacks do have similar checks, too. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 9a4a5574ce42 ("HID: appleir: add support for Apple ir devices") Cc: stable@vger.kernel.org Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: apple: disable Fn key handling on the Omoton KB066Alex Henrie
Remove the fixup to make the Omoton KB066's F6 key F6 when not holding Fn. That was really just a hack to allow typing F6 in fnmode>0, and it didn't fix any of the other F keys that were likewise untypable in fnmode>0. Instead, because the Omoton's Fn key is entirely internal to the keyboard, completely disable Fn key translation when an Omoton is detected, which will prevent the hid-apple driver from interfering with the keyboard's built-in Fn key handling. All of the F keys, including F6, are then typable when Fn is held. The Omoton KB066 and the Apple A1255 both have HID product code 05ac:022c. The self-reported name of every original A1255 when they left the factory was "Apple Wireless Keyboard". By default, Mac OS changes the name to "<username>'s keyboard" when pairing with the keyboard, but Mac OS allows the user to set the internal name of Apple keyboards to anything they like. The Omoton KB066's name, on the other hand, is not configurable: It is always "Bluetooth Keyboard". Because that name is so generic that a user might conceivably use the same name for a real Apple keyboard, detect Omoton keyboards based on both having that exact name and having HID product code 022c. Fixes: 819083cb6eed ("HID: apple: fix up the F6 key on the Omoton KB066 keyboard") Signed-off-by: Alex Henrie <alexhenrie24@gmail.com> Reviewed-by: Aditya Garg <gargaditya08@live.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-03-04HID: i2c-hid: improve i2c_hid_get_report error messageWentao Guan
We have two places to print "failed to set a report to ...", use "get a report from" instead of "set a report to", it makes people who knows less about the module to know where the error happened. Before: i2c_hid_acpi i2c-FTSC1000:00: failed to set a report to device: -11 After: i2c_hid_acpi i2c-FTSC1000:00: failed to get a report from device: -11 Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>