linux-stable.git/drivers/hid, branch v6.1.142

HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()

2025-06-27T10:07:24+00:00

commit fe7f7ac8e0c708446ff017453add769ffc15deed upstream.

Update struct hid_descriptor to better reflect the mandatory and
optional parts of the HID Descriptor as per USB HID 1.11 specification.
Note: the kernel currently does not parse any optional HID class
descriptors, only the mandatory report descriptor.

Update all references to member element desc[0] to rpt_desc.

Add test to verify bLength and bNumDescriptors values are valid.

Replace the for loop with direct access to the mandatory HID class
descriptor member for the report descriptor. This eliminates the
possibility of getting an out-of-bounds fault.

Add a warning message if the HID descriptor contains any unsupported
optional HID class descriptors.

Reported-by: syzbot+c52569baf0c843f35495@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c52569baf0c843f35495
Fixes: f043bfc98c19 ("HID: usbhid: fix out-of-bounds bug")
Cc: stable@vger.kernel.org
Signed-off-by: Terry Junge 
Reviewed-by: Michael Kelley 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: quirks: Add ADATA XPG alpha wireless mouse support

2025-06-04T12:40:25+00:00

[ Upstream commit fa9fdeea1b7d6440c22efa6d59a769eae8bc89f1 ]

This patch adds HID_QUIRK_ALWAYS_POLL for the ADATA XPG wireless gaming mouse (USB ID 125f:7505) and its USB dongle (USB ID 125f:7506). Without this quirk, the device does not generate input events properly.

Signed-off-by: Milton Barrera 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: usbkbd: Fix the bit shift number for LED_KANA

2025-06-04T12:40:17+00:00

[ Upstream commit d73a4bfa2881a6859b384b75a414c33d4898b055 ]

Since "LED_KANA" was defined as "0x04", the shift number should be "4".

Signed-off-by: junan 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: uclogic: Add NULL check in uclogic_input_configured()

2025-05-22T12:10:01+00:00

[ Upstream commit bd07f751208ba190f9b0db5e5b7f35d5bb4a8a1e ]

devm_kasprintf() returns NULL when memory allocation fails. Currently,
uclogic_input_configured() does not check for this case, which results
in a NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue.

Fixes: dd613a4e45f8 ("HID: uclogic: Correct devm device reference for hidinput input_dev name")
Signed-off-by: Henry Martin 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: thrustmaster: fix memory leak in thrustmaster_interrupts()

2025-05-22T12:10:01+00:00

[ Upstream commit 09d546303b370113323bfff456c4e8cff8756005 ]

In thrustmaster_interrupts(), the allocated send_buf is not
freed if the usb_check_int_endpoints() check fails, leading
to a memory leak.

Fix this by ensuring send_buf is freed before returning in
the error path.

Fixes: 50420d7c79c3 ("HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check")
Signed-off-by: Qasim Ijaz 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: pidff: Fix null pointer dereference in pidff_find_fields

2025-04-25T08:43:28+00:00

[ Upstream commit 22a05462c3d0eee15154faf8d13c49e6295270a5 ]

This function triggered a null pointer dereference if used to search for
a report that isn't implemented on the device. This happened both for
optional and required reports alike.

The same logic was applied to pidff_find_special_field and although
pidff_init_fields should return an error earlier if one of the required
reports is missing, future modifications could change this logic and
resurface this possible null pointer dereference again.

LKML bug report:
https://lore.kernel.org/all/CAL-gK7f5=R0nrrQdPtaZZr1fd-cdAMbDMuZ_NLA8vM0SX+nGSw@mail.gmail.com

Reported-by: Nolan Nicholson 
Signed-off-by: Tomasz Pakuła 
Reviewed-by: Michał Kopeć 
Reviewed-by: Paul Dino Jones 
Tested-by: Paul Dino Jones 
Tested-by: Cristóferson Bueno 
Tested-by: Pablo Cisneros 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: pidff: Do not send effect envelope if it's empty

2025-04-25T08:43:28+00:00

[ Upstream commit 8876fc1884f5b39550c8387ff3176396c988541d ]

Envelope struct is always initialized, but the envelope itself is
optional as described in USB PID Device class definition 1.0.

5.1.1.1 Type Specific Block Offsets
...
4) Effects that do not use Condition Blocks use 1 Parameter Block and
an *optional* Envelope Block.

Sending out "empty" envelope breaks force feedback on some devices with
games that use SINE effect + offset to emulate constant force effect, as
well as generally breaking Constant/Periodic effects. One of the affected
brands is Moza Racing.

This change prevents the envelope from being sent if it contains all
0 values while keeping the old behavior of only sending it, if it differs
from the old one.

Changes in v6:
- Simplify the checks to make them clearer
- Fix possible null pointer dereference while calling
  pidff_needs_set_envelope

Signed-off-by: Tomasz Pakuła 
Reviewed-by: Michał Kopeć 
Reviewed-by: Paul Dino Jones 
Tested-by: Paul Dino Jones 
Tested-by: Cristóferson Bueno 
Tested-by: Pablo Cisneros 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: pidff: Convert infinite length from Linux API to PID standard

2025-04-25T08:43:28+00:00

[ Upstream commit 37e0591fe44dce39d1ebc7a82d5b6e4dba1582eb ]

Software uses 0 as de-facto infinite lenght on Linux FF apis (SDL),
Linux doesn't actually define anythi as of now, while USB PID defines
NULL (0xffff). Most PID devices do not expect a 0-length effect and
can't interpret it as infinite. This change fixes Force Feedback for
most PID compliant devices.

As most games depend on updating the values of already playing infinite
effects, this is crucial to ensure they will actually work.

Previously, users had to rely on third-party software to do this conversion
and make their PID devices usable.

Co-developed-by: Makarenko Oleg 
Signed-off-by: Makarenko Oleg 
Signed-off-by: Tomasz Pakuła 
Reviewed-by: Michał Kopeć 
Reviewed-by: Paul Dino Jones 
Tested-by: Paul Dino Jones 
Tested-by: Cristóferson Bueno 
Tested-by: Pablo Cisneros 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: i2c-hid: improve i2c_hid_get_report error message

2025-04-10T12:33:39+00:00

[ Upstream commit 723aa55c08c9d1e0734e39a815fd41272eac8269 ]

We have two places to print "failed to set a report to ...",
use "get a report from" instead of "set a report to", it makes
people who knows less about the module to know where the error
happened.

Before:
i2c_hid_acpi i2c-FTSC1000:00: failed to set a report to device: -11

After:
i2c_hid_acpi i2c-FTSC1000:00: failed to get a report from device: -11

Signed-off-by: Wentao Guan 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER

2025-04-10T12:33:31+00:00

[ Upstream commit fe0fb58325e519008e2606a5aa2cff7ad23e212d ]

The line

	obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER)   += intel-ish-hid/

in top-level HID Makefile is both superfluous (as CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
depends on CONFIG_INTEL_ISH_HID, which contains intel-ish-hid/ already) and wrong (as it's
missing the CONFIG_ prefix).

Just remove it.

Fixes: 91b228107da3e ("HID: intel-ish-hid: ISH firmware loader client driver")
Reported-by: Jiri Slaby 
Acked-by: Srinivas Pandruvada 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin