linux-stable.git/drivers/hid, branch linux-5.10.y

HID: multitouch: Check to ensure report responses match the request

2026-04-18T08:31:08+00:00

[ Upstream commit e716edafedad4952fe3a4a273d2e039a84e8681a ]

It is possible for a malicious (or clumsy) device to respond to a
specific report's feature request using a completely different report
ID.  This can cause confusion in the HID core resulting in nasty
side-effects such as OOB writes.

Add a check to ensure that the report ID in the response, matches the
one that was requested.  If it doesn't, omit reporting the raw event and
return early.

Signed-off-by: Lee Jones 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Sasha Levin

HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

2026-04-18T08:31:08+00:00

[ Upstream commit 2f1763f62909ccb6386ac50350fa0abbf5bb16a9 ]

The wacom_intuos_bt_irq() function processes Bluetooth HID reports
without sufficient bounds checking. A maliciously crafted short report
can trigger an out-of-bounds read when copying data into the wacom
structure.

Specifically, report 0x03 requires at least 22 bytes to safely read
the processed data and battery status, while report 0x04 (which
falls through to 0x03) requires 32 bytes.

Add explicit length checks for these report IDs and log a warning if
a short report is received.

Signed-off-by: Benoît Sevens 
Reviewed-by: Jason Gerecke 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: mcp2221: cancel last I2C command on read error

2026-04-18T08:31:03+00:00

[ Upstream commit e31b556c0ba21f20c298aa61181b96541140b7b9 ]

When an I2C SMBus read operation fails, the MCP2221 internal state machine
may not reset correctly, causing subsequent transactions to fail.

By adding a short delay and explicitly cancelling the last command,
we ensure the device is ready for the next operation.

Fix an issue where i2cdetect was not able to detect all devices correctly
on the bus.

Signed-off-by: Romain Sioen 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: asus: avoid memory leak in asus_report_fixup()

2026-04-18T08:31:03+00:00

[ Upstream commit 2bad24c17742fc88973d6aea526ce1353f5334a3 ]

The asus_report_fixup() function was returning a newly allocated
kmemdup()-allocated buffer, but never freeing it.  Switch to
devm_kzalloc() to ensure the memory is managed and freed automatically
when the device is removed.

The caller of report_fixup() does not take ownership of the returned
pointer, but it is permitted to return a pointer whose lifetime is at
least that of the input buffer.

Also fix a harmless out-of-bounds read by copying only the original
descriptor size.

Assisted-by: Gemini-CLI:Google Gemini 3
Signed-off-by: Günther Noack 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Sasha Levin

HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them

2026-04-18T08:30:51+00:00

commit ecfa6f34492c493a9a1dc2900f3edeb01c79946b upstream.

In commit 2ff5baa9b527 ("HID: appleir: Fix potential NULL dereference at
raw event handle"), we handle the fact that raw event callbacks
can happen even for a HID device that has not been "claimed" causing a
crash if a broken device were attempted to be connected to the system.

Fix up the remaining in-tree HID drivers that forgot to add this same
check to resolve the same issue.

Cc: Jiri Kosina 
Cc: Benjamin Tissoires 
Cc: Bastien Nocera 
Cc: linux-input@vger.kernel.org
Cc: stable 
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Greg Kroah-Hartman

HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()

2026-03-04T12:20:14+00:00

[ Upstream commit 1547d41f9f19d691c2c9ce4c29f746297baef9e9 ]

Do not crash when a report has no fields.

Fake USB gadgets can send their own HID report descriptors and can define report
structures without valid fields.  This can be used to crash the kernel over USB.

Cc: stable@vger.kernel.org
Signed-off-by: Günther Noack 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: prodikeys: Check presence of pm->input_ep82

2026-03-04T12:20:14+00:00

[ Upstream commit cee8337e1bad168136aecfe6416ecd7d3aa7529a ]

Fake USB devices can send their own report descriptors for which the
input_mapping() hook does not get called.  In this case, pm->input_ep82 stays
NULL, which leads to a crash later.

This does not happen with the real device, but can be provoked by imposing as
one.

Cc: stable@vger.kernel.org
Signed-off-by: Günther Noack 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: magicmouse: Do not crash on missing msc->input

2026-03-04T12:20:14+00:00

[ Upstream commit 17abd396548035fbd6179ee1a431bd75d49676a7 ]

Fake USB devices can send their own report descriptors for which the
input_mapping() hook does not get called.  In this case, msc->input stays NULL,
leading to a crash at a later time.

Detect this condition in the input_configured() hook and reject the device.

This is not supposed to happen with actual magic mouse devices, but can be
provoked by imposing as a magic mouse USB device.

Cc: stable@vger.kernel.org
Signed-off-by: Günther Noack 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: hid-pl: handle probe errors

2026-03-04T12:20:14+00:00

[ Upstream commit 3756a272d2cf356d2203da8474d173257f5f8521 ]

Errors in init must be reported back or we'll
follow a NULL pointer the first time FF is used.

Fixes: 20eb127906709 ("hid: force feedback driver for PantherLord USB/PS2 2in1 Adapter")
Cc: stable@vger.kernel.org
Signed-off-by: Oliver Neukum 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: multitouch: add eGalaxTouch EXC3188 support

2026-03-04T12:19:59+00:00

[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ]

Add support for the for the EXC3188 touchscreen from eGalaxy.

Signed-off-by: Thorsten Schmelzer 
Signed-off-by: Michael Tretter 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin