<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/drivers/input/joystick, branch master</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc</title>
<updated>2026-08-25T16:38:50+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-08-25T16:38:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=93e4b3076b5f2d853462b9777d083c77fc0b7b23'/>
<id>93e4b3076b5f2d853462b9777d083c77fc0b7b23</id>
<content type='text'>
Pull char/misc/IIO/etc driver updates from Greg KH:
 "Here is the big set of char, misc, iio, counter, fpga, and other small
  driver subsystems for 7.3-rc1.

  Overall, due to some driver removals we only added a bit more code
  than removed, which was a nice change. Highlights in this merge
  request are:

   - Loads of IIO driver updates and additions

   - binder driver updates (more on that below...)

   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall

   - Removal of the obsolete ibmasm driver as it's not being used
     anymore

   - Coresight driver updates and additions

   - Mei driver udpates

   - Counter driver updates

   - FPGA driver updates

   - ICC driver updates

   - lots and lots of other tiny driver updates to resolve reported
     issues

  All of these have been in linux-next for a while"

* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
  iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
  iio: adc: pac1921: fix wrong channel used in trigger handler read
  iio: light: gp2ap002: re-enable irq if runtime suspend fails
  iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
  iio: light: apds9306: fix PM reference leak in apds9306_read_data()
  iio: gyro: mpu3050: fix sign of raw angular velocity readings
  iio: srf04: fix pm_runtime handling on probe error path
  iio: adc: ad4080: configure backend data size
  iio: adc: adi-axi-adc: add data size support for AD408X backend
  iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
  iio: dac: ad5446: fix OF module device table
  iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
  iio: light: opt4001: Reject integration times with a non-zero seconds part
  iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
  iio: light: opt4001: Fix power down clearing bits of the wrong register
  iio: light: opt4060: Fix incorrect register name in threshold read error message
  iio: light: opt4060: Fix pointer type passed to div_u64_rem()
  iio: light: opt4060: Reject integration times with a non-zero seconds part
  iio: light: ltrf216a: fix runtime PM reference leak in error path
  iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull char/misc/IIO/etc driver updates from Greg KH:
 "Here is the big set of char, misc, iio, counter, fpga, and other small
  driver subsystems for 7.3-rc1.

  Overall, due to some driver removals we only added a bit more code
  than removed, which was a nice change. Highlights in this merge
  request are:

   - Loads of IIO driver updates and additions

   - binder driver updates (more on that below...)

   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall

   - Removal of the obsolete ibmasm driver as it's not being used
     anymore

   - Coresight driver updates and additions

   - Mei driver udpates

   - Counter driver updates

   - FPGA driver updates

   - ICC driver updates

   - lots and lots of other tiny driver updates to resolve reported
     issues

  All of these have been in linux-next for a while"

* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
  iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
  iio: adc: pac1921: fix wrong channel used in trigger handler read
  iio: light: gp2ap002: re-enable irq if runtime suspend fails
  iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
  iio: light: apds9306: fix PM reference leak in apds9306_read_data()
  iio: gyro: mpu3050: fix sign of raw angular velocity readings
  iio: srf04: fix pm_runtime handling on probe error path
  iio: adc: ad4080: configure backend data size
  iio: adc: adi-axi-adc: add data size support for AD408X backend
  iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
  iio: dac: ad5446: fix OF module device table
  iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
  iio: light: opt4001: Reject integration times with a non-zero seconds part
  iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
  iio: light: opt4001: Fix power down clearing bits of the wrong register
  iio: light: opt4060: Fix incorrect register name in threshold read error message
  iio: light: opt4060: Fix pointer type passed to div_u64_rem()
  iio: light: opt4060: Reject integration times with a non-zero seconds part
  iio: light: ltrf216a: fix runtime PM reference leak in error path
  iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next</title>
<updated>2026-08-19T07:45:01+00:00</updated>
<author>
<name>Greg Kroah-Hartman</name>
<email>gregkh@linuxfoundation.org</email>
</author>
<published>2026-08-19T07:45:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=258ad625930ff4535ba6b438c8b49509e9a1c2dd'/>
<id>258ad625930ff4535ba6b438c8b49509e9a1c2dd</id>
<content type='text'>
Jonathan writes:

IIO new device support, features, cleanup for 7.3

Includes a merge of 7.2-rc2 to pick up the changes around
mod_devicetable.h and reduce resulting conflicts around includes.

New device support
------------------

adi,ad3530R
- Add support for the AD3532R and AD3532 16 channel DACs.
adi,ad4080
- Add support for the AD4883 ADC.
adi,ad5686
- Add support for AD5313R, AD5317R, AD5674, AD5687R, AD5689, AD5689R DACs
  over SPI
- Add support for AD5316R, AD5674, AD5697R and AD5696 DACs over I2C
- Significant driver refactoring prior to these additions, partly to reduce
  bus traffic and to add triggered buffer and gain control support. An
  earlier set added support for missing supplies, reset and LDAC GPIO.
adi,adf41513
- New driver to support this PLL frequency synthesizer that runs up to
  26.5 GHz.
- Included infrastructure to handle higher precision attributes with
  extensive tests
adi,ltc2378-20
- New driver supporting LTC2338, LTC2364, LTC2367, LTC2368, LT2369, LTC2370
  LTC2376, LTC2377, LTC2378, LTC2379 and LTC23980 ADCs with both high speed
  capture via appropriate backend and conventional triggered buffer SPI
  capture.
invensense,icm42607
- New driver for this IMU.
mediateck,mt6323
- New driver for this PMIC ADC.
microchip,mcp47a1
- New driver for this I2C 6 bit DAC.
nxp,mcf54415-dac
- New driver for this DAC found in NXP SoCs.
qst,qmc5884l
- New driver for this 3 axis magnetometer. Included dt vendor entry for qst.
qst,qmc6308
- New driver for this 3 axis magnetometer.
sensiron,slf3s
- New driver for this liquid flow sensor. Includes adding IIO_VOLUMEFLOW
  channel type.
st,vl53l1x
- Refactors to improve readability.
ti,ads112c14
- New driver supporting the ADS112C14 and ADS122C14 ADCs. These bring
  some new ABI for input chopping, particular useful for resistive sensors
  like thermocouples or Wheatstone bridges.
- Support CRC8 detection of corruption on the bus.
- Support buffered reads.
ti,tmp117
- (trivial) Add support for the tmp119 temperature sensor.
xilinx,versal-sysmon
- New ADC driver for this block found on various FPGAs including various
  bus interfaces, threshold and oversampling support.

dt binding updates
------------------
new shared bindings
- excitation-channels and excitation-current-nanoamp allow per channel
  specification of currents used for resistive sensor measurement.
- reference-sources property to allow selection of a per channel reference.
rockchip,saradc
- Add RV1106 which is compatible with the RV3588.

Features
--------

buffer-dmaengine
- Allow cyclic buffers, useful for repeating sequence generation with DACs.
devantech,dmard09
- Implement read back of channel scale - previously interface always
  returned an error.
hid,sensors-als
- Enable separate channel scaling for hardware that supports it.
invensense,timestamp library
- Various precision improvements.
invensense,icm42600
- Add support for hwfifo watermark interfaces.
taos,tcs3472
- Support wait time and sampling frequency control.

Cleanups, minor fixes
---------------------

Minor cleanups not mentioned at all in this summary such
as white space fixes or typos.

Affecting various drivers
- Cleanup of conditionals that had no affect.
- Drop some runtime pm local wrappers as now runtime_pm does the
  mark_last_busy part inside the put, these provide no useful code
  deduplication or readability advantages over directly calling the
  runtime_pm functions.
- Return 0 from write_raw() on success.
- Use of dev_err_probe() to simplify code and sometimes provide useful
  info for deferred probe debugging.
- Drop some redundant error prints where the called function already
  provides information on errors.
- Make some read only arrays in functions static.
- Fix up missing handling of regcache_sync() errors.
- Drop some false kernel-doc markings.
- Add missing MODULE_DEVICE_TABLE for some of_match_id tables.
- Use local variables for things like the struct device to shorten and
  improve readability of code.
- Drop some unused structure elements.
- Reorder dds.h macro parameters to be inline with others.
- Header reorders and IWYU. Often part of a more significant series.
- Remove abstractions designed to allow a driver to support multiple device
  types, when they have been around a long time and only the original part
  showed up.
- Initialize spi_device_id arrays using member names following dropping of
  driver data from drivers that didn't actually use it.
- Catch up with i2c_device_id tables added since previous effort to use
  named initializers for all those.
- Use kernel types in a few places instead of standard C ones or bare
  unsigned.

Misc
- Update Xilinx AMS maintainer.
- Update email address for Maxwell Doose.
- Update email address for Siratul Islam.
- Update email address for Tomasz Duszynski and re-add Tomasz to
  various maintainer entries.
Docs
- Encourage use of differential channel naming even when there is no
  flexibility in input to differential pair mapping. Intended to
  provide a strong signal to userspace that a channel is differential.
adi,ad_sigma_delta
- Allow COMPILE_TEST without any users.
adi,ad2s1201
- Refactor trigger handler to avoid mix of guard() and goto.
adi,ad5686
- Avoid potential NULL dereference is user forces a driver bind.
adi,ad5696
- Add a couple of missing entries to the of_match_id table and update
  binding to match.
atmel,ad91_adc
- Use const char * for DT string property allowing a cast to be dropped.
avia,hx711
- Various refactors and cleanup to enable support of additional parts
  (to come)
- Add missing supply and gpio dt-bindings.
bosch,bmc150
- Harden against device reporting too large a FIFO sample count.
- Use FIELD_PREP() / FIELD_GET() to improve readability.
freescale,fxls8962af
- Harden against device reporting too large a FIFO sample count.
hid-sensors-*
- Reorder probe to not expose userspace interfaces until the rest of
  the setup is done to avoid potentially dropping data.
honeywell,abp2030pa
- Drop an unreachable return.
invensens,icm45600
- Harden against bad value of FIFO sample count from device.
- Use i2c_match_data if firmware table sourced match data isn't available.
nxp,mpl1115
- Ensure runtime_pm is balanced on error in probe.
rohm,bm1390
- Make the driver slightly more likely to recover from transient errors.
sensiron,sgp30
- Handle thread creation errors.
st,lsm6dsx
- Update the enable mask when doing sensor fusion to avoid incorrect fifo
  data handling.
st,stm32-dfsdm
- Treat dt flags as booleans.
ti,ads1015
- Switch to devm helpers which simplified code and closed a resource leak.
ti,opt3001
- Split complicated opt3001_get_processed() logic into irq an no irq
  helper functions.
- Use devm to simplify code.
- Use guard() to simplify code.
- Reorder probe so final call exposes userspace interfaces.
- Various other more minor cleanup
taos,tsl2772
- Fix calibscale readback to check right channel type.
taos,tsl2583
- Use sysfs_emit() and sysfs_emit_at() to replace open coded equivalents.

* tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (232 commits)
  iio: dac: mcp47a1: add support for new device
  dt-bindings: iio: dac: add support for mcp47a1
  iio: Update email for Maxwell Doose
  iio: imu: st_lsm6dsx: Update enable mask when using sensor fusion
  iio: light: cm32181: return zero after writing calibscale
  iio: flow: add Sensirion SLF3S liquid flow sensor driver
  iio: core: add IIO_VAL_DECIMAL64_FEMTO format type
  dt-bindings: iio: flow: add Sensirion SLF3S liquid flow sensor
  iio: types: add IIO_VOLUMEFLOW channel type
  iio: ABI: Encourage differential voltage ABI usage
  iio: adc: ltc2378: Add support for LTC2338-18
  iio: adc: ltc2378: Enable triggered buffer data capture
  iio: adc: ltc2378: Enable high-speed data capture
  iio: adc: ltc2378: Add support for LTC2378-20 and similar ADCs
  dt-bindings: iio: adc: Add ltc2378
  iio: magnetometer: ak8974: remove conditional return with no effect
  iio: light: tsl2583: remove conditional return with no effect
  iio: adc: rcar-gyroadc: remove rcar_gyroadc_set_power() helper
  iio: light: vcnl4000: remove vcnl4000_set_pm_runtime_state() helper
  iio: light: vcnl4035: remove vcnl4035_set_pm_runtime_state() helper
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Jonathan writes:

IIO new device support, features, cleanup for 7.3

Includes a merge of 7.2-rc2 to pick up the changes around
mod_devicetable.h and reduce resulting conflicts around includes.

New device support
------------------

adi,ad3530R
- Add support for the AD3532R and AD3532 16 channel DACs.
adi,ad4080
- Add support for the AD4883 ADC.
adi,ad5686
- Add support for AD5313R, AD5317R, AD5674, AD5687R, AD5689, AD5689R DACs
  over SPI
- Add support for AD5316R, AD5674, AD5697R and AD5696 DACs over I2C
- Significant driver refactoring prior to these additions, partly to reduce
  bus traffic and to add triggered buffer and gain control support. An
  earlier set added support for missing supplies, reset and LDAC GPIO.
adi,adf41513
- New driver to support this PLL frequency synthesizer that runs up to
  26.5 GHz.
- Included infrastructure to handle higher precision attributes with
  extensive tests
adi,ltc2378-20
- New driver supporting LTC2338, LTC2364, LTC2367, LTC2368, LT2369, LTC2370
  LTC2376, LTC2377, LTC2378, LTC2379 and LTC23980 ADCs with both high speed
  capture via appropriate backend and conventional triggered buffer SPI
  capture.
invensense,icm42607
- New driver for this IMU.
mediateck,mt6323
- New driver for this PMIC ADC.
microchip,mcp47a1
- New driver for this I2C 6 bit DAC.
nxp,mcf54415-dac
- New driver for this DAC found in NXP SoCs.
qst,qmc5884l
- New driver for this 3 axis magnetometer. Included dt vendor entry for qst.
qst,qmc6308
- New driver for this 3 axis magnetometer.
sensiron,slf3s
- New driver for this liquid flow sensor. Includes adding IIO_VOLUMEFLOW
  channel type.
st,vl53l1x
- Refactors to improve readability.
ti,ads112c14
- New driver supporting the ADS112C14 and ADS122C14 ADCs. These bring
  some new ABI for input chopping, particular useful for resistive sensors
  like thermocouples or Wheatstone bridges.
- Support CRC8 detection of corruption on the bus.
- Support buffered reads.
ti,tmp117
- (trivial) Add support for the tmp119 temperature sensor.
xilinx,versal-sysmon
- New ADC driver for this block found on various FPGAs including various
  bus interfaces, threshold and oversampling support.

dt binding updates
------------------
new shared bindings
- excitation-channels and excitation-current-nanoamp allow per channel
  specification of currents used for resistive sensor measurement.
- reference-sources property to allow selection of a per channel reference.
rockchip,saradc
- Add RV1106 which is compatible with the RV3588.

Features
--------

buffer-dmaengine
- Allow cyclic buffers, useful for repeating sequence generation with DACs.
devantech,dmard09
- Implement read back of channel scale - previously interface always
  returned an error.
hid,sensors-als
- Enable separate channel scaling for hardware that supports it.
invensense,timestamp library
- Various precision improvements.
invensense,icm42600
- Add support for hwfifo watermark interfaces.
taos,tcs3472
- Support wait time and sampling frequency control.

Cleanups, minor fixes
---------------------

Minor cleanups not mentioned at all in this summary such
as white space fixes or typos.

Affecting various drivers
- Cleanup of conditionals that had no affect.
- Drop some runtime pm local wrappers as now runtime_pm does the
  mark_last_busy part inside the put, these provide no useful code
  deduplication or readability advantages over directly calling the
  runtime_pm functions.
- Return 0 from write_raw() on success.
- Use of dev_err_probe() to simplify code and sometimes provide useful
  info for deferred probe debugging.
- Drop some redundant error prints where the called function already
  provides information on errors.
- Make some read only arrays in functions static.
- Fix up missing handling of regcache_sync() errors.
- Drop some false kernel-doc markings.
- Add missing MODULE_DEVICE_TABLE for some of_match_id tables.
- Use local variables for things like the struct device to shorten and
  improve readability of code.
- Drop some unused structure elements.
- Reorder dds.h macro parameters to be inline with others.
- Header reorders and IWYU. Often part of a more significant series.
- Remove abstractions designed to allow a driver to support multiple device
  types, when they have been around a long time and only the original part
  showed up.
- Initialize spi_device_id arrays using member names following dropping of
  driver data from drivers that didn't actually use it.
- Catch up with i2c_device_id tables added since previous effort to use
  named initializers for all those.
- Use kernel types in a few places instead of standard C ones or bare
  unsigned.

Misc
- Update Xilinx AMS maintainer.
- Update email address for Maxwell Doose.
- Update email address for Siratul Islam.
- Update email address for Tomasz Duszynski and re-add Tomasz to
  various maintainer entries.
Docs
- Encourage use of differential channel naming even when there is no
  flexibility in input to differential pair mapping. Intended to
  provide a strong signal to userspace that a channel is differential.
adi,ad_sigma_delta
- Allow COMPILE_TEST without any users.
adi,ad2s1201
- Refactor trigger handler to avoid mix of guard() and goto.
adi,ad5686
- Avoid potential NULL dereference is user forces a driver bind.
adi,ad5696
- Add a couple of missing entries to the of_match_id table and update
  binding to match.
atmel,ad91_adc
- Use const char * for DT string property allowing a cast to be dropped.
avia,hx711
- Various refactors and cleanup to enable support of additional parts
  (to come)
- Add missing supply and gpio dt-bindings.
bosch,bmc150
- Harden against device reporting too large a FIFO sample count.
- Use FIELD_PREP() / FIELD_GET() to improve readability.
freescale,fxls8962af
- Harden against device reporting too large a FIFO sample count.
hid-sensors-*
- Reorder probe to not expose userspace interfaces until the rest of
  the setup is done to avoid potentially dropping data.
honeywell,abp2030pa
- Drop an unreachable return.
invensens,icm45600
- Harden against bad value of FIFO sample count from device.
- Use i2c_match_data if firmware table sourced match data isn't available.
nxp,mpl1115
- Ensure runtime_pm is balanced on error in probe.
rohm,bm1390
- Make the driver slightly more likely to recover from transient errors.
sensiron,sgp30
- Handle thread creation errors.
st,lsm6dsx
- Update the enable mask when doing sensor fusion to avoid incorrect fifo
  data handling.
st,stm32-dfsdm
- Treat dt flags as booleans.
ti,ads1015
- Switch to devm helpers which simplified code and closed a resource leak.
ti,opt3001
- Split complicated opt3001_get_processed() logic into irq an no irq
  helper functions.
- Use devm to simplify code.
- Use guard() to simplify code.
- Reorder probe so final call exposes userspace interfaces.
- Various other more minor cleanup
taos,tsl2772
- Fix calibscale readback to check right channel type.
taos,tsl2583
- Use sysfs_emit() and sysfs_emit_at() to replace open coded equivalents.

* tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (232 commits)
  iio: dac: mcp47a1: add support for new device
  dt-bindings: iio: dac: add support for mcp47a1
  iio: Update email for Maxwell Doose
  iio: imu: st_lsm6dsx: Update enable mask when using sensor fusion
  iio: light: cm32181: return zero after writing calibscale
  iio: flow: add Sensirion SLF3S liquid flow sensor driver
  iio: core: add IIO_VAL_DECIMAL64_FEMTO format type
  dt-bindings: iio: flow: add Sensirion SLF3S liquid flow sensor
  iio: types: add IIO_VOLUMEFLOW channel type
  iio: ABI: Encourage differential voltage ABI usage
  iio: adc: ltc2378: Add support for LTC2338-18
  iio: adc: ltc2378: Enable triggered buffer data capture
  iio: adc: ltc2378: Enable high-speed data capture
  iio: adc: ltc2378: Add support for LTC2378-20 and similar ADCs
  dt-bindings: iio: adc: Add ltc2378
  iio: magnetometer: ak8974: remove conditional return with no effect
  iio: light: tsl2583: remove conditional return with no effect
  iio: adc: rcar-gyroadc: remove rcar_gyroadc_set_power() helper
  iio: light: vcnl4000: remove vcnl4000_set_pm_runtime_state() helper
  iio: light: vcnl4035: remove vcnl4035_set_pm_runtime_state() helper
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>Input: iforce - validate input packet lengths</title>
<updated>2026-07-25T03:49:53+00:00</updated>
<author>
<name>Pengpeng Hou</name>
<email>pengpeng@iscas.ac.cn</email>
</author>
<published>2026-07-25T03:46:27+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=5751c781d3c97ab6ce0e2a966156ed882152c415'/>
<id>5751c781d3c97ab6ce0e2a966156ed882152c415</id>
<content type='text'>
iforce_process_packet() reads fixed fields from joystick, wheel and
status packets without first checking their lengths. In particular, the
shared hats-and-buttons helper unconditionally reads data[6]. The status
tail is a sequence of 16-bit effect addresses, but an incomplete final
address is also consumed. A successful zero-length USB URB additionally
reads the packet ID before the common parser is called.

Reject the zero-length USB transfer, require the seven-byte joystick and
wheel prefixes and the two-byte status prefix, and consume only complete
status-tail addresses.

Signed-off-by: Pengpeng Hou &lt;pengpeng@iscas.ac.cn&gt;
Link: https://patch.msgid.link/20260720115018.75045-1-pengpeng@iscas.ac.cn
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
iforce_process_packet() reads fixed fields from joystick, wheel and
status packets without first checking their lengths. In particular, the
shared hats-and-buttons helper unconditionally reads data[6]. The status
tail is a sequence of 16-bit effect addresses, but an incomplete final
address is also consumed. A successful zero-length USB URB additionally
reads the packet ID before the common parser is called.

Reject the zero-length USB transfer, require the seven-byte joystick and
wheel prefixes and the two-byte status prefix, and consume only complete
status-tail addresses.

Signed-off-by: Pengpeng Hou &lt;pengpeng@iscas.ac.cn&gt;
Link: https://patch.msgid.link/20260720115018.75045-1-pengpeng@iscas.ac.cn
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Input: psxpad-spi - set driver data before use</title>
<updated>2026-07-25T01:45:30+00:00</updated>
<author>
<name>Linmao Li</name>
<email>lilinmao@kylinos.cn</email>
</author>
<published>2026-07-25T01:42:06+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=732f38c36059e68ba3b4b89c56911d777fd3185c'/>
<id>732f38c36059e68ba3b4b89c56911d777fd3185c</id>
<content type='text'>
psxpad_spi_suspend() retrieves the controller state with
spi_get_drvdata(), but probe never stores it, so suspend dereferences a
NULL pointer. Store it during probe.

Fixes: 8be193c7b1f4 ("Input: add support for PlayStation 1/2 joypads connected via SPI")
Signed-off-by: Linmao Li &lt;lilinmao@kylinos.cn&gt;
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260721055551.1714965-1-lilinmao@kylinos.cn
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
psxpad_spi_suspend() retrieves the controller state with
spi_get_drvdata(), but probe never stores it, so suspend dereferences a
NULL pointer. Store it during probe.

Fixes: 8be193c7b1f4 ("Input: add support for PlayStation 1/2 joypads connected via SPI")
Signed-off-by: Linmao Li &lt;lilinmao@kylinos.cn&gt;
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260721055551.1714965-1-lilinmao@kylinos.cn
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Input: xpad - add support for ZENAIM LEVERLESS</title>
<updated>2026-07-23T17:50:16+00:00</updated>
<author>
<name>Kyohei Kadota</name>
<email>lufia@lufia.org</email>
</author>
<published>2026-07-23T10:55:57+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=7d971337ebfad0b173cb46097c709db174ac3557'/>
<id>7d971337ebfad0b173cb46097c709db174ac3557</id>
<content type='text'>
Add the VID/PID for the ZENAIM LEVERLESS controller to xpad_device and
the VID to xpad_table.

Signed-off-by: KADOTA, Kyohei &lt;lufia@lufia.org&gt;
Link: https://patch.msgid.link/CAFMepckDUuOHiDDVVhUYc-UqJMeCqrWSfCuxbJ2x2sGgdDD4nw@mail.gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Add the VID/PID for the ZENAIM LEVERLESS controller to xpad_device and
the VID to xpad_table.

Signed-off-by: KADOTA, Kyohei &lt;lufia@lufia.org&gt;
Link: https://patch.msgid.link/CAFMepckDUuOHiDDVVhUYc-UqJMeCqrWSfCuxbJ2x2sGgdDD4nw@mail.gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>iio: inkern: Use namespaced exports</title>
<updated>2026-07-05T00:37:19+00:00</updated>
<author>
<name>Romain Gantois</name>
<email>romain.gantois@bootlin.com</email>
</author>
<published>2025-12-09T08:25:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=ebf1d03dab9659749d5605656cf92fb6700f33bb'/>
<id>ebf1d03dab9659749d5605656cf92fb6700f33bb</id>
<content type='text'>
Use namespaced exports for IIO consumer API functions.

This will make it easier to manage the IIO export surface. Consumer drivers
will only be provided access to a specific set of functions, thereby
restricting usage of internal IIO functions by other parts of the kernel.

This change cannot be split into several parts without breaking
bisectability, thus all of the affected drivers are modified at once.

Acked-by: Sebastian Reichel &lt;sebastian.reichel@collabora.com&gt; # for power-supply
Acked-by: Guenter Roeck &lt;linux@roeck-us.net&gt;
Reviewed-by: Andy Shevchenko &lt;andriy.shevchenko@intel.com&gt;
Signed-off-by: Romain Gantois &lt;romain.gantois@bootlin.com&gt;
Acked-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
Acked-by: Vinod Koul &lt;vkoul@kernel.org&gt;
Signed-off-by: Jonathan Cameron &lt;jic23@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Use namespaced exports for IIO consumer API functions.

This will make it easier to manage the IIO export surface. Consumer drivers
will only be provided access to a specific set of functions, thereby
restricting usage of internal IIO functions by other parts of the kernel.

This change cannot be split into several parts without breaking
bisectability, thus all of the affected drivers are modified at once.

Acked-by: Sebastian Reichel &lt;sebastian.reichel@collabora.com&gt; # for power-supply
Acked-by: Guenter Roeck &lt;linux@roeck-us.net&gt;
Reviewed-by: Andy Shevchenko &lt;andriy.shevchenko@intel.com&gt;
Signed-off-by: Romain Gantois &lt;romain.gantois@bootlin.com&gt;
Acked-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
Acked-by: Vinod Koul &lt;vkoul@kernel.org&gt;
Signed-off-by: Jonathan Cameron &lt;jic23@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Input: maplecontrol - set driver data before registering input device</title>
<updated>2026-07-03T05:49:02+00:00</updated>
<author>
<name>Dmitry Torokhov</name>
<email>dmitry.torokhov@gmail.com</email>
</author>
<published>2026-06-30T05:49:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=fe938ee497d58c644f6910cfe6ae155f6fb3e523'/>
<id>fe938ee497d58c644f6910cfe6ae155f6fb3e523</id>
<content type='text'>
Set maple driver data before calling input_register_device() to
ensure that it is available if the device is opened immediately and
the callback is triggered.

Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Tested-by: Florian Fuchs &lt;fuchsfl@gmail.com&gt;
Link: https://patch.msgid.link/akNYib9hQFNN1fA9@google.com
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Set maple driver data before calling input_register_device() to
ensure that it is available if the device is opened immediately and
the callback is triggered.

Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Tested-by: Florian Fuchs &lt;fuchsfl@gmail.com&gt;
Link: https://patch.msgid.link/akNYib9hQFNN1fA9@google.com
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Input: iforce - bound the device-reported force-feedback effect index</title>
<updated>2026-06-23T03:55:41+00:00</updated>
<author>
<name>Bryam Vargas</name>
<email>hexlabsecurity@proton.me</email>
</author>
<published>2026-06-23T03:47:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=0e9943d2e4c63496b6ca84bc66fd3c71d40558e2'/>
<id>0e9943d2e4c63496b6ca84bc66fd3c71d40558e2</id>
<content type='text'>
iforce_process_packet() handles a status report (packet id 0x02) by
taking a force-feedback effect index straight from the device wire and
using it to address the per-effect state array:

	i = data[1] &amp; 0x7f;
	if (data[1] &amp; 0x80) {
		if (!test_and_set_bit(FF_CORE_IS_PLAYED,
				      iforce-&gt;core_effects[i].flags))
			...
	} else if (test_and_clear_bit(FF_CORE_IS_PLAYED,
				      iforce-&gt;core_effects[i].flags)) {
		...
	}

The index is masked only with 0x7f, so it ranges 0..127, but
core_effects[] holds only IFORCE_EFFECTS_MAX (32) entries.  For an index
of 32..127 the test_and_set_bit()/test_and_clear_bit() is an
out-of-bounds single-bit read-modify-write past the array.  core_effects[]
is the second-to-last member of struct iforce, so the write lands in the
trailing members and beyond the embedding kzalloc()'d iforce_serio /
iforce_usb object.

data[1] is unvalidated device payload on both transports (the USB
interrupt endpoint and serio), and the status path is not gated on force
feedback being present, so a malicious or counterfeit device can set or
clear a bit at an attacker-chosen offset past the object.

Reject an out-of-range index instead of indexing with it.  Bound against
the array dimension IFORCE_EFFECTS_MAX rather than dev-&gt;ff-&gt;max_effects so
the check guarantees memory safety regardless of how many effects the
device registered.  A legitimate "effect started/stopped" status always
carries an index below IFORCE_EFFECTS_MAX, so well-formed devices are
unaffected; the neighbouring mark_core_as_ready() loop is already bounded
and is left untouched.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Bryam Vargas &lt;hexlabsecurity@proton.me&gt;
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260613-b4-disp-4828d263-v1-1-02320e1a89dd@proton.me
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
iforce_process_packet() handles a status report (packet id 0x02) by
taking a force-feedback effect index straight from the device wire and
using it to address the per-effect state array:

	i = data[1] &amp; 0x7f;
	if (data[1] &amp; 0x80) {
		if (!test_and_set_bit(FF_CORE_IS_PLAYED,
				      iforce-&gt;core_effects[i].flags))
			...
	} else if (test_and_clear_bit(FF_CORE_IS_PLAYED,
				      iforce-&gt;core_effects[i].flags)) {
		...
	}

The index is masked only with 0x7f, so it ranges 0..127, but
core_effects[] holds only IFORCE_EFFECTS_MAX (32) entries.  For an index
of 32..127 the test_and_set_bit()/test_and_clear_bit() is an
out-of-bounds single-bit read-modify-write past the array.  core_effects[]
is the second-to-last member of struct iforce, so the write lands in the
trailing members and beyond the embedding kzalloc()'d iforce_serio /
iforce_usb object.

data[1] is unvalidated device payload on both transports (the USB
interrupt endpoint and serio), and the status path is not gated on force
feedback being present, so a malicious or counterfeit device can set or
clear a bit at an attacker-chosen offset past the object.

Reject an out-of-range index instead of indexing with it.  Bound against
the array dimension IFORCE_EFFECTS_MAX rather than dev-&gt;ff-&gt;max_effects so
the check guarantees memory safety regardless of how many effects the
device registered.  A legitimate "effect started/stopped" status always
carries an index below IFORCE_EFFECTS_MAX, so well-formed devices are
unaffected; the neighbouring mark_core_as_ready() loop is already bounded
and is left untouched.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Bryam Vargas &lt;hexlabsecurity@proton.me&gt;
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260613-b4-disp-4828d263-v1-1-02320e1a89dd@proton.me
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'v7.1-rc6' into next</title>
<updated>2026-06-01T02:43:25+00:00</updated>
<author>
<name>Dmitry Torokhov</name>
<email>dmitry.torokhov@gmail.com</email>
</author>
<published>2026-06-01T02:43:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=fff88709f9a9153af85b5224b4594caa5387ca60'/>
<id>fff88709f9a9153af85b5224b4594caa5387ca60</id>
<content type='text'>
Sync up with mainline to pull in a fix to IMS PCU driver and other
enhancements.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Sync up with mainline to pull in a fix to IMS PCU driver and other
enhancements.
</pre>
</div>
</content>
</entry>
<entry>
<title>Input: Use named initializers for arrays of i2c_device_data</title>
<updated>2026-05-31T05:10:47+00:00</updated>
<author>
<name>Uwe Kleine-König (The Capable Hub)</name>
<email>u.kleine-koenig@baylibre.com</email>
</author>
<published>2026-05-15T16:48:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=47ceab218c827cd5861bd1615763433a870a2d45'/>
<id>47ceab218c827cd5861bd1615763433a870a2d45</id>
<content type='text'>
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.

The mentioned robustness is relevant for a planned change to struct
i2c_device_id that replaces .driver_data by an anonymous union.

This patch doesn't modify the compiled arrays, only their representation
in source form benefits. The former was confirmed with x86 and arm64
builds.

Signed-off-by: Uwe Kleine-König (The Capable Hub) &lt;u.kleine-koenig@baylibre.com&gt;
Link: https://patch.msgid.link/20260515164848.497608-2-u.kleine-koenig@baylibre.com
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.

The mentioned robustness is relevant for a planned change to struct
i2c_device_id that replaces .driver_data by an anonymous union.

This patch doesn't modify the compiled arrays, only their representation
in source form benefits. The former was confirmed with x86 and arm64
builds.

Signed-off-by: Uwe Kleine-König (The Capable Hub) &lt;u.kleine-koenig@baylibre.com&gt;
Link: https://patch.msgid.link/20260515164848.497608-2-u.kleine-koenig@baylibre.com
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
</pre>
</div>
</content>
</entry>
</feed>
