aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/hid (follow)
AgeCommit message (Collapse)AuthorFilesLines
2025-09-15HID: multitouch: add haptic multitouch supportAngela Czubak2-5/+58
If CONFIG_HID_HAPTIC is enabled, and the device is recognized to have simple haptic capabilities, try initializing the haptic device, check input frames for pressure and handle it using hid_haptic_* API. Signed-off-by: Angela Czubak <aczubak@google.com> Co-developed-by: Jonathan Denose <jdenose@google.com> Signed-off-by: Jonathan Denose <jdenose@google.com> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-09-15HID: haptic: add hid_haptic_switch_modeAngela Czubak1-7/+59
Function hid_haptic_switch_mode() can be used to switch between device-controlled mode and host-controlled mode. Uploading a WAVEFORMPRESS or WAVEFORMRELEASE effect triggers host-controlled mode if the device is in device-controlled mode. Signed-off-by: Angela Czubak <aczubak@google.com> Co-developed-by: Jonathan Denose <jdenose@google.com> Signed-off-by: Jonathan Denose <jdenose@google.com> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-09-15HID: haptic: add functions handling eventsAngela Czubak2-1/+34
Implement hid_haptic_handle_press_release() which generates haptic feedback as well as saves the pressed state of the haptic device. Add functions to increase and reset the state of the pressure detected by the device. Signed-off-by: Angela Czubak <aczubak@google.com> Co-developed-by: Jonathan Denose <jdenose@google.com> Signed-off-by: Jonathan Denose <jdenose@google.com> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-09-15HID: input: calculate resolution for pressureAngela Czubak1-0/+13
Assume that if the pressure is given in newtons it should be normalized to grams. If the pressure has no unit do not calculate resolution. Signed-off-by: Angela Czubak <aczubak@google.com> Co-developed-by: Jonathan Denose <jdenose@google.com> Signed-off-by: Jonathan Denose <jdenose@google.com> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-09-15HID: haptic: initialize haptic deviceAngela Czubak2-0/+443
Add hid_haptic_init(). Parse autotrigger report to retrieve ordinals for press and release waveforms. Implement force feedback functions. Signed-off-by: Angela Czubak <aczubak@google.com> Co-developed-by: Jonathan Denose <jdenose@google.com> Signed-off-by: Jonathan Denose <jdenose@google.com> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-09-15HID: input: allow mapping of haptic outputAngela Czubak1-2/+3
This change makes it possible to parse output reports by input mapping functions by HID drivers. Signed-off-by: Angela Czubak <aczubak@google.com> Co-developed-by: Jonathan Denose <jdenose@google.com> Signed-off-by: Jonathan Denose <jdenose@google.com> Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-09-15HID: haptic: introduce hid_haptic_deviceAngela Czubak4-0/+185
Define a new structure that contains simple haptic device configuration as well as current state. Add functions that recognize auto trigger and manual trigger reports as well as save their addresses. Verify that the pressure unit is either grams or newtons. Mark the input device as a haptic touchpad if the unit is correct and the reports are found. Signed-off-by: Angela Czubak <aczubak@google.com> Co-developed-by: Jonathan Denose <jdenose@google.com> Signed-off-by: Jonathan Denose <jdenose@google.com> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-09-15Merge tag 'v6.17-rc6' into drm-nextDave Airlie20-42/+79
This is a backmerge of Linux 6.17-rc6, needed for msm, also requested by misc. Signed-off-by: Dave Airlie <airlied@redhat.com>
2025-09-12HID: asus: add Z13 folio to generic group for multitouch to workAntheas Kapenekakis2-4/+4
The Asus Z13 folio has a multitouch touchpad that needs to bind to the hid-multitouch driver in order to work properly. So bind it to the HID_GROUP_GENERIC group to release the touchpad and move it to the bottom so that the comment applies to it. While at it, change the generic KEYBOARD3 name to Z13_FOLIO. Reviewed-by: Luke D. Jones <luke@ljones.dev> Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-09-12HID: pidff: Fix possible null pointer dereferenceTomasz Pakuła1-5/+10
As reported by Dan Carpenter, if the axes_enable field wasn't found, trying to find the axes themselves will result in a null pointer dereference. This could only occur with a broken PID descriptor, but it's worth protecting from. Exit early if the axes_enable wasn't found AND add a gate to the pidff_find_special_keys to exit early if the passed HID field is null. This will protect again null dereferencing in the future and properly return 0 found special keys. Fixes: 1d72e7bd340b ("HID: pidff: Add support for AXES_ENABLE field") Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-09-12HID: intel-ish-ipc: Remove redundant ready check after timeout functionZhang Lixu1-8/+9
timed_wait_for_timeout() internally checks for ish_is_input_ready() and ishtp_fw_is_ready() based on the provided parameters. If timed_wait_for_timeout() returns 0, it indicates the status is ready. In rare cases, another thread may send a message immediately after timed_wait_for_timeout() returns, causing a subsequent ish_is_input_ready() check to fail. Since the return value of timed_wait_for_timeout() is sufficient to determine readiness, the additional ready check is unnecessary and may introduce issues. This patch removes the redundant check and relies solely on the return value of timed_wait_for_timeout(). Fixes: ae02e5d40d5f ("HID: intel-ish-hid: ipc layer") Signed-off-by: Zhang Lixu <lixu.zhang@intel.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-09-12HID: asus: add support for missing PX series fn keysAmit Chaudhari1-0/+3
Add support for missing hotkey keycodes affecting Asus PX13 and PX16 families so userspace can use them. Signed-off-by: Amit Chaudhari <amitchaudhari@mac.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-09-12HID: cp2112: fix setter callbacks return valueSébastien Szymanski1-5/+5
Since commit 6485543488a6 ("HID: cp2112: use new line value setter callbacks"), setting a GPIO value always fails with error -EBADE. That's because the returned value by the setter callbacks is the returned value by the hid_hw_raw_request() function which is the number of bytes sent on success or a negative value on error. The function gpiochip_set() returns -EBADE if the setter callbacks return a value > 0. Fix this by making the setter callbacks return 0 on success or a negative value on error. While at it, use the returned value by cp2112_gpio_set_unlocked() in the direction_output callback. Fixes: 6485543488a6 ("HID: cp2112: use new line value setter callbacks") Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-09-12HID: bpf: rescan the device for the group after a load/unloadBenjamin Tissoires1-0/+21
When a BPF gets loaded, it was previously not possible to bind a hid-generic device to hid-multitouch because the group was never updated. This change forces a rescan of the report descriptor after a bpf is loaded/unloaded so we set up the proper group. This was detected while Peter was trying to fix a Viewsonic device: the HID device sending multiotuch data through a proprietary collection was handled by hid-generic, and we don't have any way of attaching it to hid-multitouch because the pre-scanning wasn't able to see the Contact ID HID usage. Suggested-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-09-12HID: core: factor out hid_set_group()Benjamin Tissoires1-8/+15
When we load a bpf, we can change the report descriptor. However, the current implementation doesn't change the group meaning that we can not rebind a device from hid-generic to hid-multitouch. This is a preparatory patch to force a rescan of the device after the bpf has been loaded. Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-09-12HID: lenovo: Use KEY_PERFORMANCE instead of ACPI's platform_profileJanne Grunau2-5/+1
Commit 84c9d2a968c82 ("HID: lenovo: Support for ThinkPad-X12-TAB-1/2 Kbd Fn keys") added a dependency on ACPI's platform_profile. This should not be done for generic USB devices as this prevents using the devices on non ACPI devices like Apple silicon Macs and other non-ACPI arm64 systems. An attempt to allow using platform_profile on non-ACPI systems was rejected in [1] and instead platform_profile was made to fail during init in commit dd133162c9cf ("ACPI: platform_profile: Avoid initializing on non-ACPI platforms"). So remove the broken dependency and instead let's user space handle this keycode by sending the new KEY_PERFORMANCE. Stable backport depends on commit 89c5214639294 ("Input: add keycode for performance mode key"). [1]: https://lore.kernel.org/linux-acpi/CAJZ5v0icRdTSToaKbdf=MdRin4NyB2MstUVaQo8VR6-n7DkVMQ@mail.gmail.com/ Cc: regressions@lists.linux.dev Cc: stable@vger.kernel.org Fixes: 84c9d2a968c82 ("HID: lenovo: Support for ThinkPad-X12-TAB-1/2 Kbd Fn keys") Signed-off-by: Janne Grunau <j@jannau.net> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-09-12Merge commit '89c5214639294' into for-6.17/upstream-fixesJiri Kosina1-0/+2
This bringig in a KEY_PERFORMANCE definition, which a followup fix will depend on. Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-09-12HID: steelseries: Fix STEELSERIES_SRWS1 handling in steelseries_remove()Jiri Kosina1-2/+1
srws1_remove label can be only reached only if LEDS subsystem is enabled. To avoid putting horryfing ifdef second time around the label, just perform the cleanup and exit immediately directly. Fixes: a84eeacbf9325 ("HID: steelseries: refactor probe() and remove()") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202509090334.76D4qGtW-lkp@intel.com/ Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-09-12HID: intel-thc-hid: intel-quickspi: Add WCL Device IDsXinpeng Sun2-0/+4
Add THC SPI WildcatLake device IDs. Signed-off-by: Xinpeng Sun <xinpeng.sun@intel.com> Reviewed-by: Even Xu <even.xu@intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-09-12HID: intel-thc-hid: intel-quicki2c: Add WCL Device IDsXinpeng Sun2-0/+4
Add THC I2C WildcatLake device IDs. Signed-off-by: Xinpeng Sun <xinpeng.sun@intel.com> Reviewed-by: Even Xu <even.xu@intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-29Merge tag 'hid-for-linus-2025082901' of ↵Linus Torvalds20-42/+79
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - fixes for memory corruption in intel-thc-hid, hid-multitouch, hid-mcp2221 and hid-asus (Aaron Ma, Qasim Ijaz, Arnaud Lecomte) - power management/resume fix for intel-ish-hid (Zhang Lixu) - driver reinitialization fix for intel-thc-hid (Even Xu) - ensure that battery level status is reported as soon as possible, which is required at least for some Android use-cases (José Expósito) - quite a few new device ID additions and device-specific quirks * tag 'hid-for-linus-2025082901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: quirks: add support for Legion Go dual dinput modes HID: elecom: add support for ELECOM M-DT2DRBK HID: logitech: Add ids for G PRO 2 LIGHTSPEED HID: input: report battery status changes immediately HID: input: rename hidinput_set_battery_charge_status() HID: intel-thc-hid: Intel-quicki2c: Enhance driver re-install flow HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() HID: asus: fix UAF via HID_CLAIMED_INPUT validation hid: fix I2C read buffer overflow in raw_event() for mcp2221 HID: wacom: Add a new Art Pen 2 HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() HID: Kconfig: Fix spelling mistake "enthropy" -> "entropy" HID: intel-ish-hid: Increase ISHTP resume ack timeout to 300ms HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length
2025-08-27HID: i2c-hid: Fix test in i2c_hid_core_register_panel_follower()Dan Carpenter1-1/+1
Bitwise AND was intended instead of OR. With the current code the condition is always true. Fixes: cbdd16b818ee ("HID: i2c-hid: Make elan touch controllers power on after panel is enabled") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Douglas Anderson <dianders@chromium.org> Reviewed-by: Pin-yen Lin <treapking@chromium.org> Acked-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://lore.kernel.org/r/aK8Au3CgZSTvfEJ6@stanley.mountain
2025-08-26HID: quirks: add support for Legion Go dual dinput modesAntheas Kapenekakis2-0/+4
The Legion Go features detachable controllers which support a dual dinput mode. In this mode, the controllers appear under a single HID device with two applications. Currently, both controllers appear under the same event device, causing their controls to be mixed up. This patch separates the two so that they can be used independently. In addition, the latest firmware update for the Legion Go swaps the IDs to the ones used by the Legion Go 2, so add those IDs as well. [jkosina@suse.com: improved shortlog] Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-26HID: elecom: add support for ELECOM M-DT2DRBKMartin Hilgendorf3-0/+4
The DT2DRBK trackball has 8 buttons, but the report descriptor only specifies 5. This patch adds the device ID and performs a similar fixup as for other ELECOM devices to enable the remaining 3 buttons. Signed-off-by: Martin Hilgendorf <martin.hilgendorf@posteo.de> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-25HID: i2c-hid: Make elan touch controllers power on after panel is enabledPin-yen Lin2-19/+38
Introduce a new HID quirk to indicate that this device has to be enabled after the panel's backlight is enabled, and update the driver data for the elan devices to enable this quirk. This cannot be a I2C HID quirk because the kernel needs to acknowledge this before powering up the device and read the VID/PID. When this quirk is enabled, register .panel_enabled()/.panel_disabling() instead for the panel follower. Also rename the *panel_prepare* functions into *panel_follower* because they could be called in other situations now. Fixes: bd3cba00dcc63 ("HID: i2c-hid: elan: Add support for Elan eKTH6915 i2c-hid touchscreens") Fixes: d06651bebf99e ("HID: i2c-hid: elan: Add elan-ekth6a12nay timing") Reviewed-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Pin-yen Lin <treapking@chromium.org> Acked-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://lore.kernel.org/r/20250818115015.2909525-2-treapking@chromium.org
2025-08-20HID: logitech: Add ids for G PRO 2 LIGHTSPEEDMatt Coffin3-0/+7
Adds support for the G PRO 2 LIGHTSPEED Wireless via it's nano receiver or directly. This nano receiver appears to work identically to the 1_1 receiver for the case I've verified, which is the battery status through lg-hidpp. The same appears to be the case wired, sharing much with the Pro X Superlight 2; differences seemed to lie in userland configuration rather than in interfaces used by hid_logitech_hidpp on the kernel side. I verified the sysfs interface for battery charge/discharge status, and capacity read to be working on my 910-007290 device (white). Signed-off-by: Matt Coffin <mcoffin13@gmail.com> Reviewed-by: Bastien Nocera <hadess@hadess.net> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-20HID: input: report battery status changes immediatelyJosé Expósito1-13/+10
Previously, the battery status (charging/discharging) was not reported immediately to user-space.  For most input devices, this wasn't problematic because changing their battery status requires connecting them to a different bus. For example, a gamepad would report a discharging status while connected via Bluetooth and a charging status while connected via USB. However, certain devices are not connected or disconnected when their battery status changes. For example, a phone battery changes its status without connecting or disconnecting it. In these cases, the battery status was not reported immediately to user space. Report battery status changes immediately to user space to support these kinds of devices. Fixes: a608dc1c0639 ("HID: input: map battery system charging") Reported-by: 卢国宏 <luguohong@xiaomi.com> Closes: https://lore.kernel.org/linux-input/aI49Im0sGb6fpgc8@fedora/T/ Tested-by: 卢国宏 <luguohong@xiaomi.com> Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-20HID: input: rename hidinput_set_battery_charge_status()José Expósito2-24/+24
In preparation for a patch fixing a bug affecting hidinput_set_battery_charge_status(), rename the function to hidinput_update_battery_charge_status() and move it up so it can be used by hidinput_update_battery(). Refactor, no functional changes. Tested-by: 卢国宏 <luguohong@xiaomi.com> Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: Reduce PID_EFFECT_OPERATION spamTomasz Pakuła1-8/+28
Keep track of effect's loop_count to reduce the spam of ffb play commands coming from some games. This should speed up normal magnitude etc updates and slightly increase max possible FFB refresh rate. Helps games like Dirt Rally 2.0, F1 2023, WRC from KT Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: universal-pidff: clang-format passTomasz Pakuła1-28/+29
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: clang-format passTomasz Pakuła1-29/+26
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: Define all cardinal directionsTomasz Pakuła1-2/+6
Will be used by ff-effect based autocentering Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: Remove Anssi's email address from info msgTomasz Pakuła1-1/+1
Some users might try to contact him about issues and he's no longer active when it comes to the driver development/fixes. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: PERMISSIVE_CONTROL quirk autodetectionTomasz Pakuła1-3/+11
Fixes force feedback for devices built with MMOS firmware and many more not yet detected devices. Update quirks mask debug message to always contain all 32 bits of data. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: Separate check for infinite durationTomasz Pakuła1-5/+6
It will be used in a few more places so this makes sure it will always work the same. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: Rework pidff_upload_effectTomasz Pakuła1-128/+115
One of the more complicated functions. Expunge some of the logic to separate functions (FF -> PID id conversion) Add a macro for envelope check to make it more readable in the upload function. All this made it possible to to expunge common code from the big switch statement and reduce the overall function size considerably. Now it can fit on one screen. Move the effect_cout logic from report functions to upload/erase functions. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: Update debug messagesTomasz Pakuła1-4/+11
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Better indicate what operation is requested on a given effect (play or stop). Previously, we only had the info about requesting playback but this could be misleading when the looop count is 0. Add debug print that shows what device control command was actually sent to the device. Print out its hex hid usage. Make field_index const to make sure it won't be changed by mistake later. Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: Add support for AXES_ENABLE fieldTomasz Pakuła1-4/+87
AXES_ENABLE can be used in place of DIRECTION_ENABLE to indicate, which FFB-enabled axes will be affected by a given effect. EFFECT_DIRECTION enables all and uses the first direction only while AXES_ENABLE is a bitmask and bit indexes are the same as the defined GD usages in the EFFECT_DIRECTION array. Each axis can have it's own direction in this case. Search for AXES_ENABLE, set AXES_ENABLE for all axes if DIRECTION_ENABLE is not used. Search for specific axes in the direction array. Save their indexes. This let us know what axes are actually available on the device and which bit in the AXES_ENABLE field corresponds to which axis. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: Simplify HID field/usage searching logicTomasz Pakuła1-43/+62
Some deduplication and splitting into separate functions. This is now way easier to comprehend and parse mentally. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: Better quirk assigment when searching for fieldsTomasz Pakuła1-41/+18
Assign quirks directly when they're discovered. Way easier to understand without relying on return values. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: Treat PID_REQUIRED_REPORTS as count, not maxTomasz Pakuła1-2/+2
It's naming suggests it's a count of the records required by the USB PID standard and this driver. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Reviewed-by: Oleg Makarenko <oleg@makarenk.ooo> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: Use ARRAY_SIZE macro instead of sizeofTomasz Pakuła1-23/+23
Could lead to issues when arrays won't be 8 bit fields Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Reviewed-by: Oleg Makarenko <oleg@makarenk.ooo> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: Remove unneeded debugTomasz Pakuła1-4/+0
All the envelope settings work correctly and even if we wanted to debug something about the envelope report, we would not only need the attack level but it's length and fade properties to have a full image. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Reviewed-by: Oleg Makarenko <oleg@makarenk.ooo> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: Remove unhelpful pidff_set_actuators helperTomasz Pakuła1-11/+1
Abstracts away too little of the functionality and replaces a nice, defined value with a magic bool. There's no actual need for it. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Reviewed-by: Oleg Makarenko <oleg@makarenk.ooo> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15HID: pidff: Use direction fix only for conditional effectsTomasz Pakuła3-16/+34
The already fixed bug in SDL only affected conditional effects. This should fix FFB in Forza Horizion 4/5 on Moza Devices as Forza Horizon flips the constant force direction instead of using negative magnitude values. Changing the direction in the effect directly in pidff_upload_effect() would affect it's value in further operations like comparing to the old effect and/or just reading the effect values in the user application. This, in turn, would lead to constant PID_SET_EFFECT spam as the effect direction would constantly not match the value that's set by the application. This way, it's still transparent to any software/API. Only affects conditional effects now so it's better for it to explicitly state that in the name. If any HW ever needs fixed direction for other effects, we'll add more quirks. Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Reviewed-by: Oleg Makarenko <oleg@makarenk.ooo> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-13HID: intel-thc-hid: Intel-quicki2c: Enhance driver re-install flowEven Xu1-0/+1
After driver module is removed and during re-install stage, if there is continueous user touching on the screen, it is a risk impacting THC hardware initialization which causes driver installation failure. This patch enhances this flow by quiescing the external touch interrupt after driver is removed which keeps THC hardware ignore external interrupt during this remove and re-install stage. Signed-off-by: Even Xu <even.xu@intel.com> Tested-by: Rui Zhang <rui1.zhang@intel.com> Fixes: 66b59bfce6d9 ("HID: intel-thc-hid: intel-quicki2c: Complete THC QuickI2C driver") Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-13HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()Minjong Kim1-0/+3
in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_version() before calling hid_to_usb_dev() Signed-off-by: Minjong Kim <minbell.kim@samsung.com> Link: https://patch.msgid.link/20250813-hid-ntrig-page-fault-fix-v2-1-f98581f35106@samsung.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-08-13HID: asus: fix UAF via HID_CLAIMED_INPUT validationQasim Ijaz1-1/+7
After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device. This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees. 0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection Below is the KASAN splat after triggering the UAF: [ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] <TASK> [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfree+0xcf/0x350 [ 21.673700] input_dev_release+0xab/0xd0 [ 21.673700] device_release+0x9f/0x220 [ 21.673700] kobject_put+0x12b/0x220 [ 21.673700] put_device+0x12/0x20 [ 21.673700] input_free_device+0x4c/0xb0 [ 21.673700] hidinput_connect+0x1862/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] Fixes: 9ce12d8be12c ("HID: asus: Add i2c touchpad support") Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Link: https://patch.msgid.link/20250810181041.44874-1-qasdev00@gmail.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-08-13hid: fix I2C read buffer overflow in raw_event() for mcp2221Arnaud Lecomte1-0/+4
As reported by syzbot, mcp2221_raw_event lacked validation of incoming I2C read data sizes, risking buffer overflows in mcp->rxbuf during multi-part transfers. As highlighted in the DS20005565B spec, p44, we have: "The number of read-back data bytes to follow in this packet: from 0 to a maximum of 60 bytes of read-back bytes." This patch enforces we don't exceed this limit. Reported-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346 Tested-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com> Link: https://patch.msgid.link/20250726220931.7126-1-contact@arnaud-lcm.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-08-12HID: wacom: Add a new Art Pen 2Ping Cheng1-0/+1
Signed-off-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-01-06 14:03:39 +0000