linux-stable.git/drivers/hid, branch linux-6.16.y

hid: fix I2C read buffer overflow in raw_event() for mcp2221

2025-10-12T11:01:03+00:00

commit b56cc41a3ae7323aa3c6165f93c32e020538b6d2 upstream.

As reported by syzbot, mcp2221_raw_event lacked
validation of incoming I2C read data sizes, risking buffer
overflows in mcp->rxbuf during multi-part transfers.
As highlighted in the DS20005565B spec, p44, we have:
"The number of read-back data bytes to follow in this packet:
from 0 to a maximum of 60 bytes of read-back bytes."
This patch enforces we don't exceed this limit.

Reported-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346
Tested-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com
Signed-off-by: Arnaud Lecomte 
Link: https://patch.msgid.link/20250726220931.7126-1-contact@arnaud-lcm.com
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Romain Sioen 
Signed-off-by: Greg Kroah-Hartman

HID: asus: add support for missing PX series fn keys

2025-10-02T11:48:34+00:00

commit 831f70a5b93bd2d9e858ced2c12fab5766ede5e7 upstream.

Add support for missing hotkey keycodes affecting Asus PX13 and PX16 families
so userspace can use them.

Signed-off-by: Amit Chaudhari 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: intel-thc-hid: intel-quickspi: Add WCL Device IDs

2025-10-02T11:48:34+00:00

commit cc54ed51c761728f6933cca889b684ed7fbaaf07 upstream.

Add THC SPI WildcatLake device IDs.

Signed-off-by: Xinpeng Sun 
Reviewed-by: Even Xu 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: amd_sfh: Add sync across amd sfh work functions

2025-10-02T11:48:27+00:00

[ Upstream commit bba920e6f803138587248079de47ad3464a396f6 ]

The process of the report is delegated across different work functions.
Hence, add a sync mechanism to protect SFH work data across functions.

Fixes: 4b2c53d93a4b ("SFH:Transport Driver to add support of AMD Sensor Fusion Hub (SFH)")
Reported-by: Matthew Schwartz 
Closes: https://lore.kernel.org/all/a21abca5-4268-449d-95f1-bdd7a25894a5@linux.dev/
Tested-by: Prakruthi SP 
Co-developed-by: Akshata MukundShetty 
Signed-off-by: Akshata MukundShetty 
Signed-off-by: Basavaraj Natikar 
Reviewed-by: Mario Limonciello (AMD) 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: cp2112: fix setter callbacks return value

2025-10-02T11:48:26+00:00

[ Upstream commit 2a5e76b9a0efc44807ff0e6b141649fac65a55ac ]

Since commit 6485543488a6 ("HID: cp2112: use new line value setter
callbacks"), setting a GPIO value always fails with error -EBADE.

That's because the returned value by the setter callbacks is the
returned value by the hid_hw_raw_request() function which is the number of
bytes sent on success or a negative value on error. The function
gpiochip_set() returns -EBADE if the setter callbacks return a value >
0.

Fix this by making the setter callbacks return 0 on success or a negative
value on error.

While at it, use the returned value by cp2112_gpio_set_unlocked() in the
direction_output callback.

Fixes: 6485543488a6 ("HID: cp2112: use new line value setter callbacks")
Signed-off-by: Sébastien Szymanski 
Reviewed-by: Bartosz Golaszewski 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: multitouch: specify that Apple Touch Bar is direct

2025-10-02T11:48:24+00:00

[ Upstream commit 45ca23c5ee8b2b3074377fecc92fa72aa595f7c9 ]

Currently the driver determines the device type based on the
application, but this value is not reliable on Apple Touch Bar, where
the application is HID_DG_TOUCHPAD even though this device is direct,
so add a quirk for the same.

Acked-by: Benjamin Tissoires 
Signed-off-by: Kerem Karabay 
Co-developed-by: Aditya Garg 
Signed-off-by: Aditya Garg 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: multitouch: take cls->maxcontacts into account for Apple Touch Bar even without a HID_DG_CONTACTMAX field

2025-10-02T11:48:24+00:00

[ Upstream commit 7dfe48bdc9d38db46283f2e0281bc1626277b8bf ]

In Apple Touch Bar, the HID_DG_CONTACTMAX is not present, but the maximum
contact count is still greater than the default. Add quirks for the same.

Acked-by: Benjamin Tissoires 
Signed-off-by: Kerem Karabay 
Co-developed-by: Aditya Garg 
Signed-off-by: Aditya Garg 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: multitouch: support getting the tip state from HID_DG_TOUCH fields in Apple Touch Bar

2025-10-02T11:48:24+00:00

[ Upstream commit e0976a61a543b5e03bc0d08030a0ea036ee3751d ]

In Apple Touch Bar, the tip state is contained in fields with the
HID_DG_TOUCH usage. This feature is gated by a quirk in order to
prevent breaking other devices, see commit c2ef8f21ea8f
("HID: multitouch: add support for trackpads").

Acked-by: Benjamin Tissoires 
Signed-off-by: Kerem Karabay 
Co-developed-by: Aditya Garg 
Signed-off-by: Aditya Garg 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: multitouch: Get the contact ID from HID_DG_TRANSDUCER_INDEX fields in case of Apple Touch Bar

2025-10-02T11:48:23+00:00

[ Upstream commit f41d736acc039d86512951f4e874b0f5e666babf ]

In Apple Touch Bar, the contact ID is contained in fields with the
HID_DG_TRANSDUCER_INDEX usage rather than HID_DG_CONTACTID, thus differing
from the HID spec. Add a quirk for the same.

Acked-by: Benjamin Tissoires 
Signed-off-by: Kerem Karabay 
Co-developed-by: Aditya Garg 
Signed-off-by: Aditya Garg 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()

2025-09-04T14:55:46+00:00

commit 185c926283da67a72df20a63a5046b3b4631b7d9 upstream.

in ntrig_report_version(), hdev parameter passed from hid_probe().
sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null
if hdev->dev.parent->parent is null, usb_dev has
invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned
when usb_rcvctrlpipe() use usb_dev,it trigger
page fault error for address(0xffffffffffffff58)

add null check logic to ntrig_report_version()
before calling hid_to_usb_dev()

Signed-off-by: Minjong Kim 
Link: https://patch.msgid.link/20250813-hid-ntrig-page-fault-fix-v2-1-f98581f35106@samsung.com
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Greg Kroah-Hartman