summaryrefslogtreecommitdiff
path: root/drivers/hid
AgeCommit message (Collapse)Author
9 daysMerge tag 'hid-for-linus-2025062701' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - fix for stalls during suspend/resume cycles with hid-nintendo (Daniel J. Ogorchock) - memory leak and reference count fixes in hid-wacom and in-appletb-kdb (Qasim Ijaz) - race condition (leading to kernel crash) fix during device removal in hid-wacom (Thomas Zeitlhofer) - fix for missed interrupt in intel-thc-hid (Intel-thc-hid:) - support for a bunch of new device IDs * tag 'hid-for-linus-2025062701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 HID: appletb-kbd: fix "appletb_backlight" backlight device reference counting HID: wacom: fix crash in wacom_aes_battery_handler() HID: intel-ish-hid: ipc: Add Wildcat Lake PCI device ID hid: intel-ish-hid: Use PCI_DEVICE_DATA() macro for ISH device table HID: lenovo: Restrict F7/9/11 mode to compact keyboards only HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY HID: input: lower message severity of 'No inputs registered, leaving' to debug HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras HID: Intel-thc-hid: Intel-quicki2c: Enhance QuickI2C reset flow HID: nintendo: avoid bluetooth suspend/resume stalls HID: wacom: fix kobject reference count leak HID: wacom: fix memory leak on sysfs attribute creation failure HID: wacom: fix memory leak on kobject creation failure
2025-06-20HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2Akira Inoue
Add "Thinkpad X1 Tablet Gen 2 Keyboard" PID to hid-lenovo driver to fix trackpoint not working issue. Signed-off-by: Akira Inoue <niyarium@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-06-20HID: appletb-kbd: fix "appletb_backlight" backlight device reference countingQasim Ijaz
During appletb_kbd_probe, probe attempts to get the backlight device by name. When this happens backlight_device_get_by_name looks for a device in the backlight class which has name "appletb_backlight" and upon finding a match it increments the reference count for the device and returns it to the caller. However this reference is never released leading to a reference leak. Fix this by decrementing the backlight device reference count on removal via put_device and on probe failure. Fixes: 93a0fc489481 ("HID: hid-appletb-kbd: add support for automatic brightness control while using the touchbar") Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Reviewed-by: Aditya Garg <gargaditya08@live.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-06-11HID: wacom: fix crash in wacom_aes_battery_handler()Thomas Zeitlhofer
Commit fd2a9b29dc9c ("HID: wacom: Remove AES power_supply after extended inactivity") introduced wacom_aes_battery_handler() which is scheduled as a delayed work (aes_battery_work). In wacom_remove(), aes_battery_work is not canceled. Consequently, if the device is removed while aes_battery_work is still pending, then hard crashes or "Oops: general protection fault..." are experienced when wacom_aes_battery_handler() is finally called. E.g., this happens with built-in USB devices after resume from hibernate when aes_battery_work was still pending at the time of hibernation. So, take care to cancel aes_battery_work in wacom_remove(). Fixes: fd2a9b29dc9c ("HID: wacom: Remove AES power_supply after extended inactivity") Signed-off-by: Thomas Zeitlhofer <thomas.zeitlhofer+lkml@ze-it.at> Acked-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-06-10HID: intel-ish-hid: ipc: Add Wildcat Lake PCI device IDZhang Lixu
Add device ID of Wildcat Lake into ishtp support list. Signed-off-by: Zhang Lixu <lixu.zhang@intel.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-06-10hid: intel-ish-hid: Use PCI_DEVICE_DATA() macro for ISH device tableZhang Lixu
Replace the usage of PCI_VDEVICE() with driver_data assignment in the ISH PCI device table with the PCI_DEVICE_DATA() macro. This improves code readability. Signed-off-by: Zhang Lixu <lixu.zhang@intel.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-06-10HID: lenovo: Restrict F7/9/11 mode to compact keyboards onlyIusico Maxim
Commit 2f2bd7cbd1d1 ("hid: lenovo: Resend all settings on reset_resume for compact keyboards") introduced a regression for ThinkPad TrackPoint Keyboard II by removing the conditional check for enabling F7/9/11 mode needed for compact keyboards only. As a result, the non-compact keyboards can no longer toggle Fn-lock via Fn+Esc, although it can be controlled via sysfs knob that directly sends raw commands. This patch restores the previous conditional check without any additions. Cc: stable@vger.kernel.org Fixes: 2f2bd7cbd1d1 ("hid: lenovo: Resend all settings on reset_resume for compact keyboards") Signed-off-by: Iusico Maxim <iusico.maxim@libero.it> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-06-10HID: Add IGNORE quirk for SMARTLINKTECHNOLOGYZhang Heng
MARTLINKTECHNOLOGY is a microphone device, when the HID interface in an audio device is requested to get specific report id, the following error may occur. [ 562.939373] usb 1-1.4.1.2: new full-speed USB device number 21 using xhci_hcd [ 563.104908] usb 1-1.4.1.2: New USB device found, idVendor=4c4a, idProduct=4155, bcdDevice= 1.00 [ 563.104910] usb 1-1.4.1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.104911] usb 1-1.4.1.2: Product: USB Composite Device [ 563.104912] usb 1-1.4.1.2: Manufacturer: SmartlinkTechnology [ 563.104913] usb 1-1.4.1.2: SerialNumber: 20201111000001 [ 563.229499] input: SmartlinkTechnology USB Composite Device as /devices/pci0000:00/0000:00:07.1/0000:04:00.3/usb1/1-1/1-1.4/1-1.4.1/1-1.4.1.2/1-1.4.1.2:1.2/0003:4C4A:4155.000F/input/input35 [ 563.291505] hid-generic 0003:4C4A:4155.000F: input,hidraw2: USB HID v2.01 Keyboard [SmartlinkTechnology USB Composite Device] on usb-0000:04:00.3-1.4.1.2/input2 [ 563.291557] usbhid 1-1.4.1.2:1.3: couldn't find an input interrupt endpoint [ 568.506654] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 573.626656] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 578.746657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 583.866655] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 588.986657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) Ignore HID interface. The device is working properly. Signed-off-by: Zhang Heng <zhangheng@kylinos.cn> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-06-10HID: input: lower message severity of 'No inputs registered, leaving' to debugMario Limonciello
Plugging in a "Blue snowball" microphone always shows the error 'No inputs registered, leaving', but the device functions as intended. When a HID device is started using the function hid_hw_start() and the argument HID_CONNECT_DEFAULT it will try all various hid connect requests. Not all devices will create an input device and so the message is needlessly noisy. Decrease it to debug instead. [jkosina@suse.com: edit shortlog] Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-06-10HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP CamerasChia-Lin Kao (AceLan)
The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C) report a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor. Add these 2 devices to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace. Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-06-10HID: Intel-thc-hid: Intel-quicki2c: Enhance QuickI2C reset flowEven Xu
During customer board enabling, it was found: some touch devices prepared reset response, but either forgot sending interrupt or THC missed reset interrupt because of timing issue. THC QuickI2C driver depends on interrupt to read reset response, in this case, it will cause driver waiting timeout. This patch enhances the flow by adding manually reset response reading after waiting for reset interrupt timeout. Signed-off-by: Even Xu <even.xu@intel.com> Tested-by: Chong Han <chong.han@intel.com> Fixes: 66b59bfce6d9 ("HID: intel-thc-hid: intel-quicki2c: Complete THC QuickI2C driver") Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-06-10HID: nintendo: avoid bluetooth suspend/resume stallsDaniel J. Ogorchock
Ensure we don't stall or panic the kernel when using bluetooth-connected controllers. This was reported as an issue on android devices using kernel 6.6 due to the resume hook which had been added for usb joycons. First, set a new state value to JOYCON_CTLR_STATE_SUSPENDED in a newly-added nintendo_hid_suspend. This makes sure we will not stall out the kernel waiting for input reports during led classdev suspend. The stalls could happen if connectivity is unreliable or lost to the controller prior to suspend. Second, since we lose connectivity during suspend, do not try joycon_init() for bluetooth controllers in the nintendo_hid_resume path. Tested via multiple suspend/resume flows when using the controller both in USB and bluetooth modes. Signed-off-by: Daniel J. Ogorchock <djogorchock@gmail.com> Reviewed-by: Silvan Jegen <s.jegen@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-06-10HID: wacom: fix kobject reference count leakQasim Ijaz
When sysfs_create_files() fails in wacom_initialize_remotes() the error is returned and the cleanup action will not have been registered yet. As a result the kobject???s refcount is never dropped, so the kobject can never be freed leading to a reference leak. Fix this by calling kobject_put() before returning. Fixes: 83e6b40e2de6 ("HID: wacom: EKR: have the wacom resources dynamically allocated") Acked-by: Ping Cheng <ping.cheng@wacom.com> Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-06-10HID: wacom: fix memory leak on sysfs attribute creation failureQasim Ijaz
When sysfs_create_files() fails during wacom_initialize_remotes() the fifo buffer is not freed leading to a memory leak. Fix this by calling kfifo_free() before returning. Fixes: 83e6b40e2de6 ("HID: wacom: EKR: have the wacom resources dynamically allocated") Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-06-10HID: wacom: fix memory leak on kobject creation failureQasim Ijaz
During wacom_initialize_remotes() a fifo buffer is allocated with kfifo_alloc() and later a cleanup action is registered during devm_add_action_or_reset() to clean it up. However if the code fails to create a kobject and register it with sysfs the code simply returns -ENOMEM before the cleanup action is registered leading to a memory leak. Fix this by ensuring the fifo is freed when the kobject creation and registration process fails. Fixes: 83e6b40e2de6 ("HID: wacom: EKR: have the wacom resources dynamically allocated") Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-06-08treewide, timers: Rename from_timer() to timer_container_of()Ingo Molnar
Move this API to the canonical timer_*() namespace. [ tglx: Redone against pre rc1 ] Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com
2025-06-03Merge tag 'hid-for-linus-2025060301' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - support for Apple Magic Mouse 2 USB-C (Aditya Garg) - power management improvement for multitouch devices (Werner Sembach) - fix for ACPI initialization in intel-thc driver (Wentao Guan) - adaptation of HID drivers to use new gpio_chip's line setter callbacks (Bartosz Golaszewski) - fix potential OOB in usbhid_parse() (Terry Junge) - make it possible to set hid_mouse_ignore_list dynamically (the same way we handle other quirks) (Aditya Garg) - other small assorted fixes and device ID additions * tag 'hid-for-linus-2025060301' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: multitouch: Disable touchpad on firmware level while not in use HID: core: Add functions for HID drivers to react on first open and last close call HID: HID_APPLETB_BL should depend on X86 HID: HID_APPLETB_KBD should depend on X86 HID: appletb-kbd: Use secs_to_jiffies() instead of msecs_to_jiffies() HID: intel-thc-hid: intel-thc: make read-only arrays static const HID: magicmouse: Apple Magic Mouse 2 USB-C support HID: mcp2221: use new line value setter callbacks HID: mcp2200: use new line value setter callbacks HID: cp2112: use new line value setter callbacks HID: cp2112: use lock guards HID: cp2112: hold the lock for the entire direction_output() call HID: cp2112: destroy mutex on driver detach HID: intel-thc-hid: intel-quicki2c: pass correct arguments to acpi_evaluate_object HID: corsair-void: Use to_delayed_work() HID: hid-logitech: use sysfs_emit_at() instead of scnprintf() HID: quirks: Add HID_QUIRK_IGNORE_MOUSE quirk HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() HID: Kysona: Add periodic online check
2025-06-03Merge branch 'for-6.16/core' into for-linusJiri Kosina
- power management improvement for multitouch devices (Werner Sembach)
2025-06-03Merge branch 'for-6.16/magicmouse' into for-linusJiri Kosina
- support for Apple Magic Mouse 2 USB-C (Aditya Garg)
2025-06-03Merge branch 'for-6.16/logitech' into for-linusJiri Kosina
2025-06-03Merge branch 'for-6.16/kysona' into for-linusJiri Kosina
- power management improvement (Lode Willems)
2025-06-03Merge branch 'for-6.16/intel-thc' into for-linusJiri Kosina
- fix for ACPI initialization (Wentao Guan)
2025-06-03Merge branch 'for-6.16/hid-gpio-setter-callbacks' into for-linusJiri Kosina
- adapt HID drivers to use new gpio_chip's line setter callbacks (Bartosz Golaszewski)
2025-06-03Merge branch 'for-6.16/corsair' into for-linusJiri Kosina
2025-06-03Merge branch 'for-6.16/core' into for-linusJiri Kosina
- make it possible to set hid_mouse_ignore_list dynamically (the same way we handle other quirks) (Aditya Garg) - fix potential OOB in usbhid_parse() (Terry Junge)
2025-06-03Merge branch 'for-6.16/apple' into for-linusJiri Kosina
- Kconfig dependency fixes (Geert Uytterhoeven) - time scaling fix for appletb_tb_idle_timeout and appletb_tb_dim_timeout parameters (Thorsten Blum)
2025-05-29Merge tag 'platform-drivers-x86-v6.16-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform drivers updates from Ilpo Järvinen: "The changes are mostly business as usual. Besides pdx86 changes, there are a few power supply changes needed for related pdx86 features, move of oxpec driver from hwmon (oxp-sensors) to pdx86, and one FW version warning to hid-asus. Highlights: - alienware-wmi-wmax: - Add HWMON support - Add ABI and admin-guide documentation - Expose GPIO debug methods through debug FS - Support manual fan control and "custom" thermal profile - amd/hsmp: - Add sysfs files to show HSMP telemetry - Report power readings and limits via hwmon - amd/isp4: Add AMD ISP platform config for OV05C10 - asus-wmi: - Refactor Ally suspend/resume to work better with older FW - hid-asus: check ROG Ally MCU version and warn about old FW versions - dasharo-acpi: - Add driver for Dasharo devices supporting fans and temperatures monitoring - dell-ddv: - Expose the battery health and manufacture date to userspace using power supply extensions - Implement the battery matching algorithm - dell-pc: - Improve error propagation - Use faux device - int3472: - Add delays to avoid GPIO regulator spikes - Add handshake pin support - Make regulator supply name configurable and allow registering more than 1 GPIO regulator - Map mt9m114 powerdown pin to powerenable - intel/pmc: Add separate SSRAM Telemetry driver - intel-uncore-freq: Add attributes to show agent types and die ID - ISST: - Support SST-TF revision 2 (allows more cores per bucket) - Support SST-PP revision 2 (fabric 1 frequencies) - Remove unnecessary SST MSRs restore (the package retains MSRs despite CPU offlining) - mellanox: Add support for SN2201, SN4280, SN5610, and SN5640 - mellanox: mlxbf-pmc: Support additional PMC blocks - oxpec: - Add OneXFly variants - Add support for charge limit, charge thresholds, and turbo LED - Distinguish current X1 variants to avoid unwanted matching to new variants - Follow hwmon conventions - Move from hwmon/oxp-sensors to platform/x86 to match the enlarged scope - power supply: - Add inhibit-charge-awake (needed by oxpec) - Add additional battery health status values ("blown fuse" and "cell imbalance") (needed by dell-ddv) - powerwell-ec: Add driver for Portwell EC supporting GPIO and watchdog - thinkpad-acpi: Support camera shutter switch hotkey - tuxedo: Add virtual LampArray for TUXEDO NB04 devices - tools/power/x86/intel-speed-select: - Support displaying SST-PP revision 2 fields - Skip uncore frequency update on newer generations of CPUs - Miscellaneous cleanups / refactoring / improvements" * tag 'platform-drivers-x86-v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (112 commits) thermal/drivers/acerhdf: Constify struct thermal_zone_device_ops platform/x86/amd/hsmp: fix building with CONFIG_HWMON=m platform/x86: asus-wmi: fix build without CONFIG_SUSPEND docs: ABI: Fix "aassociated" to "associated" platform/x86: Add AMD ISP platform config for OV05C10 Documentation: admin-guide: pm: Add documentation for die_id platform/x86/intel-uncore-freq: Add attributes to show die_id platform/x86/intel: power-domains: Add interface to get Linux die ID Documentation: admin-guide: pm: Add documentation for agent_types platform/x86/intel-uncore-freq: Add attributes to show agent types platform/x86/tuxedo: Prevent invalid Kconfig state platform/x86: dell-ddv: Expose the battery health to userspace platform/x86: dell-ddv: Expose the battery manufacture date to userspace platform/x86: dell-ddv: Implement the battery matching algorithm power: supply: core: Add additional health status values platform/x86/amd/hsmp: acpi: Add sysfs files to display HSMP telemetry platform/x86/amd/hsmp: Report power via hwmon sensors platform/x86/amd/hsmp: Use a single DRIVER_VERSION for all hsmp modules platform/mellanox: mlxreg-dpu: Fix smatch warnings platform: mellanox: nvsw-sn2200: Fix .items in nvsw_sn2201_busbar_hotplug ...
2025-05-15Merge tag 'hid-for-linus-2025051501' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Benjamin Tissoires: - fix a few potential memory leaks in the wacom driver (Qasim Ijaz) - AMD SFH fixes when there is only one SRA sensor (Mario Limonciello) - HID-BPF dispatch UAF fix that happens on removal of the Logitech DJ receiver (Rong Zhang) - various minor fixes and usual device ID additions * tag 'hid-for-linus-2025051501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: bpf: abort dispatch if device destroyed HID: quirks: Add ADATA XPG alpha wireless mouse support HID: hid-steam: Remove the unused variable connected HID: amd_sfh: Avoid clearing reports for SRA sensor HID: amd_sfh: Fix SRA sensor when it's the only sensor HID: wacom: fix shift OOB in kfifo allocation for zero pktlen HID: uclogic: Add NULL check in uclogic_input_configured() HID: wacom: fix memory leak on size mismatch in wacom_wac_queue_flush() HID: wacom: handle kzalloc() allocation failure in wacom_wac_queue_flush() HID: thrustmaster: fix memory leak in thrustmaster_interrupts() HID: hid-appletb-kbd: Fix wrong date and kernel version in sysfs interface docs HID: bpf: fix BTN_STYLUS for the XP Pen ACK05 remote
2025-05-13HID: multitouch: Disable touchpad on firmware level while not in useWerner Sembach
Using the new on_hid_hw_open and on_hid_hw_close functions to disable the touchpad on firmware level while not being in use. This safes some battery and triggers touchpad-disabled-leds hardwired to the touchpads firmware, that exist for example on some TongFang barebones. For a lengthy discussion with all the details see https://gitlab.freedesktop.org/libinput/libinput/-/issues/558 Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Link: https://patch.msgid.link/20250211133950.422232-2-wse@tuxedocomputers.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-05-13HID: core: Add functions for HID drivers to react on first open and last ↵Werner Sembach
close call Adds a new function to the hid_driver struct that is called when the userspace starts using the device, and another one that is called when userspace stop using the device. With this a hid driver can implement special suspend handling for devices currently not in use. Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Link: https://patch.msgid.link/20250211133950.422232-1-wse@tuxedocomputers.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-05-13HID: bpf: abort dispatch if device destroyedRong Zhang
The current HID bpf implementation assumes no output report/request will go through it after hid_bpf_destroy_device() has been called. This leads to a bug that unplugging certain types of HID devices causes a cleaned- up SRCU to be accessed. The bug was previously a hidden failure until a recent x86 percpu change [1] made it access not-present pages. The bug will be triggered if the conditions below are met: A) a device under the driver has some LEDs on B) hid_ll_driver->request() is uninplemented (e.g., logitech-djreceiver) If condition A is met, hidinput_led_worker() is always scheduled *after* hid_bpf_destroy_device(). hid_destroy_device ` hid_bpf_destroy_device ` cleanup_srcu_struct(&hdev->bpf.srcu) ` hid_remove_device ` ... ` led_classdev_unregister ` led_trigger_set(led_cdev, NULL) ` led_set_brightness(led_cdev, LED_OFF) ` ... ` input_inject_event ` input_event_dispose ` hidinput_input_event ` schedule_work(&hid->led_work) [hidinput_led_worker] This is fine when condition B is not met, where hidinput_led_worker() calls hid_ll_driver->request(). This is the case for most HID drivers, which implement it or use the generic one from usbhid. The driver itself or an underlying driver will then abort processing the request. Otherwise, hidinput_led_worker() tries hid_hw_output_report() and leads to the bug. hidinput_led_worker ` hid_hw_output_report ` dispatch_hid_bpf_output_report ` srcu_read_lock(&hdev->bpf.srcu) ` srcu_read_unlock(&hdev->bpf.srcu, idx) The bug has existed since the introduction [2] of dispatch_hid_bpf_output_report(). However, the same bug also exists in dispatch_hid_bpf_raw_requests(), and I've reproduced (no visible effect because of the lack of [1], but confirmed bpf.destroyed == 1) the bug against the commit (i.e., the Fixes:) introducing the function. This is because hidinput_led_worker() falls back to hid_hw_raw_request() when hid_ll_driver->output_report() is uninplemented (e.g., logitech- djreceiver). hidinput_led_worker ` hid_hw_output_report: -ENOSYS ` hid_hw_raw_request ` dispatch_hid_bpf_raw_requests ` srcu_read_lock(&hdev->bpf.srcu) ` srcu_read_unlock(&hdev->bpf.srcu, idx) Fix the issue by returning early in the two mentioned functions if hid_bpf has been marked as destroyed. Though dispatch_hid_bpf_device_event() handles input events, and there is no evidence that it may be called after the destruction, the same check, as a safety net, is also added to it to maintain the consistency among all dispatch functions. The impact of the bug on other architectures is unclear. Even if it acts as a hidden failure, this is still dangerous because it corrupts whatever is on the address calculated by SRCU. Thus, CC'ing the stable list. [1]: commit 9d7de2aa8b41 ("x86/percpu/64: Use relative percpu offsets") [2]: commit 9286675a2aed ("HID: bpf: add HID-BPF hooks for hid_hw_output_report") Closes: https://lore.kernel.org/all/20250506145548.GGaBoi9Jzp3aeJizTR@fat_crate.local/ Fixes: 8bd0488b5ea5 ("HID: bpf: add HID-BPF hooks for hid_hw_raw_requests") Cc: stable@vger.kernel.org Signed-off-by: Rong Zhang <i@rong.moe> Tested-by: Petr Tesarik <petr@tesarici.cz> Link: https://patch.msgid.link/20250512152420.87441-1-i@rong.moe Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-05-08platform/x86: asus-wmi: Refactor Ally suspend/resumeLuke D. Jones
Adjust how the CSEE direct call hack is used. The results of months of testing combined with help from ASUS to determine the actual cause of suspend issues has resulted in this refactoring which immensely improves the reliability for devices which do not have the following minimum MCU FW version: - ROG Ally X: 313 - ROG Ally 1: 319 For MCU FW versions that match the minimum or above the CSEE hack is disabled and mcu_powersave set to on by default as there are no negatives beyond a slightly slower device reinitialization due to the MCU being powered off. As this is set only at module load time, it is still possible for mcu_powersave sysfs attributes to change it at runtime if so desired. Signed-off-by: Luke D. Jones <luke@ljones.dev> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://lore.kernel.org/r/20250323023421.78012-3-luke@ljones.dev Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-05-08hid-asus: check ROG Ally MCU version and warnLuke D. Jones
ASUS have fixed suspend issues arising from a flag not being cleared in the MCU FW in both the ROG Ally 1 and the ROG Ally X. Implement a check and a warning to encourage users to update the FW to a minimum supported version. Signed-off-by: Luke D. Jones <luke@ljones.dev> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://lore.kernel.org/r/20250323023421.78012-2-luke@ljones.dev Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-04-24HID: quirks: Add ADATA XPG alpha wireless mouse supportMilton Barrera
This patch adds HID_QUIRK_ALWAYS_POLL for the ADATA XPG wireless gaming mouse (USB ID 125f:7505) and its USB dongle (USB ID 125f:7506). Without this quirk, the device does not generate input events properly. Signed-off-by: Milton Barrera <miltonjosue2001@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: hid-steam: Remove the unused variable connectedJiapeng Chong
Variable connected is not effectively used, so delete it. drivers/hid/hid-steam.c:1153:7: warning: variable ‘connected’ set but not used. Reported-by: Abaci Robot <abaci@linux.alibaba.com> Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=20462 Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: HID_APPLETB_BL should depend on X86Geert Uytterhoeven
The Apple Touch Bar is only present on x86 MacBook Pros. Hence add a dependency on X86, to prevent asking the user about this driver when configuring a kernel for a different architecture. Fixes: 1fd41e5e3d7cc556 ("HID: hid-appletb-bl: add driver for the backlight of Apple Touch Bars") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Aditya Garg <gargaditya08@live.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: HID_APPLETB_KBD should depend on X86Geert Uytterhoeven
The Apple Touch Bar is only present on x86 MacBook Pros. Hence add a dependency on X86, to prevent asking the user about this driver when configuring a kernel for a different architecture. Fixes: 8e9b9152cfbdc2a9 ("HID: hid-appletb-kbd: add driver for the keyboard mode of Apple Touch Bars") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Aditya Garg <gargaditya08@live.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: appletb-kbd: Use secs_to_jiffies() instead of msecs_to_jiffies()Thorsten Blum
Use secs_to_jiffies() instead of msecs_to_jiffies() and avoid scaling the module params 'appletb_tb_idle_timeout' and 'appletb_tb_dim_timeout' to milliseconds. secs_to_jiffies() expands to simpler code and reduces the size of 'hid-appletb-kbd.ko'. Reformat the code to silence multiple checkpatch warnings. No functional changes intended. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Aditya Garg <gargaditya08@live.com> Tested-by: Aditya Garg <gargaditya08@live.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: amd_sfh: Avoid clearing reports for SRA sensorMario Limonciello
SRA sensor doesn't allocate any memory for reports. Skip trying to clear memory for that sensor in cleanup path. Suggested-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Acked-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: amd_sfh: Fix SRA sensor when it's the only sensorMario Limonciello
On systems that only have an SRA sensor connected to SFH the sensor doesn't get enabled due to a bad optimization condition of breaking the sensor walk loop. This optimization is unnecessary in the first place because if there is only one device then the loop only runs once. Drop the condition and explicitly mark sensor as enabled. Reported-by: Yijun Shen <Yijun.Shen@dell.com> Tested-By: Yijun Shen <Yijun_Shen@Dell.com> Fixes: d1c444b47100d ("HID: amd_sfh: Add support to export device operating states") Cc: stable@vger.kernel.org Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Acked-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: intel-thc-hid: intel-thc: make read-only arrays static constColin Ian King
Don't populate the read-only arrays frequency and frequency_div on the stack at run time, instead make them static const. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Reviewed-by: Even Xu <even.xu@intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: wacom: fix shift OOB in kfifo allocation for zero pktlenQasim Ijaz
During wacom_parse_and_register() the code calls wacom_devm_kfifo_alloc to allocate a fifo. During this operation it passes kfifo_alloc a fifo_size of 0. Kfifo attempts to round the size passed to it to the next power of 2 via roundup_pow_of_two (queue-type data structures do this to maintain efficiency of operations). However during this phase a problem arises when the roundup_pow_of_two() function utilises a shift exponent of fls_long(n-1), where n is the fifo_size. Since n is 0 in this case and n is also an unsigned long, doing n-1 causes unsigned integer wrap-around to occur making the fifo_size 4294967295. So the code effectively does fls_long(4294967295) which results in 64. Returning back to roundup_pow_of_two(), the code utilises a shift exponent of 64. When a shift exponent of 64 is used on a 64-bit type such as 1UL it results in a shift-out-of-bounds. The root cause of the issue seems to stem from insufficient validation of wacom_compute_pktlen(), since in this case the fifo_size comes from wacom_wac->features.pktlen. During wacom_parse_and_register() the wacom_compute_pktlen() function sets the pktlen as 0. To fix this, we should handle cases where wacom_compute_pktlen() results in 0. Reported-by: syzbot <syzbot+d5204cbbdd921f1f7cad@syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=d5204cbbdd921f1f7cad Fixes: 5e013ad20689 ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit") Tested-by: Qasim Ijaz <qasdev00@gmail.com> Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com> Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: uclogic: Add NULL check in uclogic_input_configured()Henry Martin
devm_kasprintf() returns NULL when memory allocation fails. Currently, uclogic_input_configured() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. Fixes: dd613a4e45f8 ("HID: uclogic: Correct devm device reference for hidinput input_dev name") Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: magicmouse: Apple Magic Mouse 2 USB-C supportAditya Garg
This patch adds support for USB-C model of Apple Magic Mouse 2. Except for the hardware ID, it should resemble the existing configuration for the older Magic Mouse 2. Signed-off-by: Aditya Garg <gargaditya08@live.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: mcp2221: use new line value setter callbacksBartosz Golaszewski
struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: mcp2200: use new line value setter callbacksBartosz Golaszewski
struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: cp2112: use new line value setter callbacksBartosz Golaszewski
struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: cp2112: use lock guardsBartosz Golaszewski
Simplify the code by using the lock guards from linux/cleanup.h throughout the driver. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: cp2112: hold the lock for the entire direction_output() callBartosz Golaszewski
We currently take the lock, set direction to output, release it, reacquire it and set the desired value. That doesn't look correct. Introduce a helper function that sets the value without taking the lock and use it where applicable in order to combine the critical sections. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24HID: cp2112: destroy mutex on driver detachBartosz Golaszewski
Use the devres variant of mutex_init() in order to free resources allocated with mutex debugging enabled. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>