linux-stable.git/drivers/input/tablet, branch v6.18.51 Linux kernel stable tree Input: aiptek - validate raw macro indices before updating state 2026-09-11T09:49:13+00:00 Pengpeng Hou pengpeng@iscas.ac.cn 2026-04-07T04:52:34+00:00 7269bd95d707e26da9ec343ccf20cbdb06d1933e commit 95dffe32a66cbed07fbfa7afed39d56d5014e04f upstream. aiptek_irq() derives macro key indices directly from tablet reports and then uses them to index macroKeyEvents[]. Report types 4 and 5 also save the derived value in aiptek->lastMacro and later use that state to release the previous key. Validate the raw macro index once before it enters that state machine, so lastMacro only ever stores an in-range macro key. Keep direct bounds checks for report type 6, which reads the macro number from the packet body and uses it immediately. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260329001711.88076-1-pengpeng@iscas.ac.cn [dtor: fix macro fallback in report 5s to use -1] Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 95dffe32a66cbed07fbfa7afed39d56d5014e04f upstream.

aiptek_irq() derives macro key indices directly from tablet reports and
then uses them to index macroKeyEvents[]. Report types 4 and 5 also save
the derived value in aiptek->lastMacro and later use that state to
release the previous key.

Validate the raw macro index once before it enters that state machine, so
lastMacro only ever stores an in-range macro key. Keep direct bounds
checks for report type 6, which reads the macro number from the packet
body and uses it immediately.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260329001711.88076-1-pengpeng@iscas.ac.cn
[dtor: fix macro fallback in report 5s to use -1]
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Input: pegasus-notetaker - fix potential out-of-bounds access 2025-10-18T01:04:15+00:00 Seungjin Bae eeodqql09@gmail.com 2025-10-17T22:36:31+00:00 69aeb507312306f73495598a055293fa749d454e In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buffer. Subsequently, if the device sends an interrupt packet with a specific pattern (e.g., where the first byte is 0x80 or 0x42), the pegasus_parse_packet() function parses the packet without checking the allocated buffer size. This leads to an out-of-bounds memory access. Fixes: 1afca2b66aac ("Input: add Pegasus Notetaker tablet driver") Signed-off-by: Seungjin Bae <eeodqql09@gmail.com> Link: https://lore.kernel.org/r/20251007214131.3737115-2-eeodqql09@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
In the pegasus_notetaker driver, the pegasus_probe() function allocates
the URB transfer buffer using the wMaxPacketSize value from
the endpoint descriptor. An attacker can use a malicious USB descriptor
to force the allocation of a very small buffer.

Subsequently, if the device sends an interrupt packet with a specific
pattern (e.g., where the first byte is 0x80 or 0x42),
the pegasus_parse_packet() function parses the packet without checking
the allocated buffer size. This leads to an out-of-bounds memory access.

Fixes: 1afca2b66aac ("Input: add Pegasus Notetaker tablet driver")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Link: https://lore.kernel.org/r/20251007214131.3737115-2-eeodqql09@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Merge tag 'input-for-v6.13-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2024-11-25T18:31:39+00:00 Linus Torvalds torvalds@linux-foundation.org 2024-11-25T18:31:39+00:00 3e51108c72e8adbcf3180ed40527a2a9d2d0123b Pull input updates from Dmitry Torokhov: - support for NT36672A touchscreen added to novatek-nvt-ts driver - a change to ads7846 driver to prevent XPT2046 from locking up - a change switching platform input dirves back to using remove() method (from remove_new()) - updates to a number of input drivers to use the new cleanup facilities (__free(...), guard(), and scoped-guard()) which ensure that the resources and locks are released properly and automatically - other assorted driver cleanups and fixes. * tag 'input-for-v6.13-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (109 commits) Input: mpr121 - use devm_regulator_get_enable_read_voltage() Input: sun4i-lradc-keys - don't include 'pm_wakeup.h' directly Input: spear-keyboard - don't include 'pm_wakeup.h' directly Input: cypress-sf - constify struct i2c_device_id Input: ads7846 - increase xfer array size in 'struct ser_req' Input: fix the input_event struct documentation Input: i8042 - fix typo dublicate to duplicate Input: ads7846 - add dummy command register clearing cycle Input: cs40l50 - fix wrong usage of INIT_WORK() Input: introduce notion of passive observers for input handlers Input: maple_keyb - use guard notation when acquiring mutex Input: locomokbd - use guard notation when acquiring spinlock Input: hilkbd - use guard notation when acquiring spinlock Input: synaptics-rmi4 - switch to using cleanup functions in F34 Input: synaptics - fix a typo dt-bindings: input: rotary-encoder: Fix "rotary-encoder,rollover" type Input: omap-keypad - use guard notation when acquiring mutex Input: imagis - fix warning regarding 'imagis_3038_data' being unused Input: userio - remove unneeded semicolon Input: sparcspkr - use cleanup facility for device_node ... 
Pull input updates from Dmitry Torokhov:

 - support for NT36672A touchscreen added to novatek-nvt-ts driver

 - a change to ads7846 driver to prevent XPT2046 from locking up

 - a change switching platform input dirves back to using remove()
   method (from remove_new())

 - updates to a number of input drivers to use the new cleanup
   facilities (__free(...), guard(), and scoped-guard()) which ensure
   that the resources and locks are released properly and automatically

 - other assorted driver cleanups and fixes.

* tag 'input-for-v6.13-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (109 commits)
  Input: mpr121 - use devm_regulator_get_enable_read_voltage()
  Input: sun4i-lradc-keys - don't include 'pm_wakeup.h' directly
  Input: spear-keyboard - don't include 'pm_wakeup.h' directly
  Input: cypress-sf - constify struct i2c_device_id
  Input: ads7846 - increase xfer array size in 'struct ser_req'
  Input: fix the input_event struct documentation
  Input: i8042 - fix typo dublicate to duplicate
  Input: ads7846 - add dummy command register clearing cycle
  Input: cs40l50 - fix wrong usage of INIT_WORK()
  Input: introduce notion of passive observers for input handlers
  Input: maple_keyb - use guard notation when acquiring mutex
  Input: locomokbd - use guard notation when acquiring spinlock
  Input: hilkbd - use guard notation when acquiring spinlock
  Input: synaptics-rmi4 - switch to using cleanup functions in F34
  Input: synaptics - fix a typo
  dt-bindings: input: rotary-encoder: Fix "rotary-encoder,rollover" type
  Input: omap-keypad - use guard notation when acquiring mutex
  Input: imagis - fix warning regarding 'imagis_3038_data' being unused
  Input: userio - remove unneeded semicolon
  Input: sparcspkr - use cleanup facility for device_node
  ...
Input: pegasus_notetaker - use guard notation when acquiring mutex 2024-10-03T16:10:37+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2024-09-04T20:59:18+00:00 0e7b4bc31d171856fcb753f653e0f00855763bf3 Using guard notation makes the code more compact and error handling more robust by ensuring that mutexes are released in all code paths when control leaves critical section. Reviewed-by: Javier Carrasco <javier.carrasco.cruz@gmail.com> Link: https://lore.kernel.org/r/ZtjKJsArLu3byTU6@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Using guard notation makes the code more compact and error handling
more robust by ensuring that mutexes are released in all code paths
when control leaves critical section.

Reviewed-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Link: https://lore.kernel.org/r/ZtjKJsArLu3byTU6@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
move asm/unaligned.h to linux/unaligned.h 2024-10-02T21:23:23+00:00 Al Viro viro@zeniv.linux.org.uk 2024-10-01T19:35:57+00:00 5f60d5f6bbc12e782fac78110b0ee62698f3b576 asm/unaligned.h is always an include of asm-generic/unaligned.h; might as well move that thing to linux/unaligned.h and include that - there's nothing arch-specific in that header. auto-generated by the following: for i in `git grep -l -w asm/unaligned.h`; do sed -i -e "s/asm\/unaligned.h/linux\/unaligned.h/" $i done for i in `git grep -l -w asm-generic/unaligned.h`; do sed -i -e "s/asm-generic\/unaligned.h/linux\/unaligned.h/" $i done git mv include/asm-generic/unaligned.h include/linux/unaligned.h git mv tools/include/asm-generic/unaligned.h tools/include/linux/unaligned.h sed -i -e "/unaligned.h/d" include/asm-generic/Kbuild sed -i -e "s/__ASM_GENERIC/__LINUX/" include/linux/unaligned.h tools/include/linux/unaligned.h 
asm/unaligned.h is always an include of asm-generic/unaligned.h;
might as well move that thing to linux/unaligned.h and include
that - there's nothing arch-specific in that header.

auto-generated by the following:

for i in `git grep -l -w asm/unaligned.h`; do
	sed -i -e "s/asm\/unaligned.h/linux\/unaligned.h/" $i
done
for i in `git grep -l -w asm-generic/unaligned.h`; do
	sed -i -e "s/asm-generic\/unaligned.h/linux\/unaligned.h/" $i
done
git mv include/asm-generic/unaligned.h include/linux/unaligned.h
git mv tools/include/asm-generic/unaligned.h tools/include/linux/unaligned.h
sed -i -e "/unaligned.h/d" include/asm-generic/Kbuild
sed -i -e "s/__ASM_GENERIC/__LINUX/" include/linux/unaligned.h tools/include/linux/unaligned.h
Input: tablet - use sizeof(*pointer) instead of sizeof(type) 2024-06-03T04:32:03+00:00 Erick Archer erick.archer@outlook.com 2024-06-03T04:30:48+00:00 2960d4c8e77aba365df80b69e72f88b29011b111 It is preferred to use sizeof(*pointer) instead of sizeof(type) due to the type of the variable can change and one needs not change the former (unlike the latter). This patch has no effect on runtime behavior. Signed-off-by: Erick Archer <erick.archer@outlook.com> Link: https://lore.kernel.org/r/AS8PR02MB7237B05083487507CFAF96B08BFE2@AS8PR02MB7237.eurprd02.prod.outlook.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
It is preferred to use sizeof(*pointer) instead of sizeof(type)
due to the type of the variable can change and one needs not
change the former (unlike the latter). This patch has no effect
on runtime behavior.

Signed-off-by: Erick Archer <erick.archer@outlook.com>
Link: https://lore.kernel.org/r/AS8PR02MB7237B05083487507CFAF96B08BFE2@AS8PR02MB7237.eurprd02.prod.outlook.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: pegasus-notetaker - check pipe type when probing 2023-04-10T02:19:14+00:00 Soumya Negi soumya.negi97@gmail.com 2023-04-10T02:12:04+00:00 b3d80fd27a3c2d8715a40cbf876139b56195f162 Fix WARNING in pegasus_open/usb_submit_urb Syzbot bug: https://syzkaller.appspot.com/bug?id=bbc107584dcf3262253ce93183e51f3612aaeb13 Warning raised because pegasus_driver submits transfer request for bogus URB (pipe type does not match endpoint type). Add sanity check at probe time for pipe value extracted from endpoint descriptor. Probe will fail if sanity check fails. Reported-and-tested-by: syzbot+04ee0cb4caccaed12d78@syzkaller.appspotmail.com Signed-off-by: Soumya Negi <soumya.negi97@gmail.com> Link: https://lore.kernel.org/r/20230404074145.11523-1-soumya.negi97@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Fix WARNING in pegasus_open/usb_submit_urb
Syzbot bug: https://syzkaller.appspot.com/bug?id=bbc107584dcf3262253ce93183e51f3612aaeb13

Warning raised because pegasus_driver submits transfer request for
bogus URB (pipe type does not match endpoint type). Add sanity check at
probe time for pipe value extracted from endpoint descriptor. Probe
will fail if sanity check fails.

Reported-and-tested-by: syzbot+04ee0cb4caccaed12d78@syzkaller.appspotmail.com
Signed-off-by: Soumya Negi <soumya.negi97@gmail.com>
Link: https://lore.kernel.org/r/20230404074145.11523-1-soumya.negi97@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
input: drop empty comment blocks 2022-09-29T23:25:42+00:00 Christophe JAILLET christophe.jaillet@wanadoo.fr 2022-09-29T19:11:36+00:00 2d09ac951b7750780ecb3de3ccb642dffd7ef62b Commit 1a59d1b8e05e ("treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156") has left some empty comment blocks. Remove them to save a few lines of code. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Link: https://lore.kernel.org/r/26a2b905b259bfffaf2de5b26f2007b8606970ed.1664478665.git.christophe.jaillet@wanadoo.fr Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Commit 1a59d1b8e05e ("treewide: Replace GPLv2 boilerplate/reference with
SPDX - rule 156") has left some empty comment blocks.

Remove them to save a few lines of code.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/26a2b905b259bfffaf2de5b26f2007b8606970ed.1664478665.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: aiptek - switch to using dev_groups for driver-specific attributes 2022-09-03T19:31:18+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2022-09-03T05:11:19+00:00 f4e7a254299bcdfe7bced700a7d96690b1b9a6f2 The driver core now has the ability to handle the creation and removal of device-specific sysfs files, let's use it instead of registering and unregistering attributes by hand. Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20220903051119.1332808-3-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
The driver core now has the ability to handle the creation and removal
of device-specific sysfs files, let's use it instead of registering and
unregistering attributes by hand.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20220903051119.1332808-3-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: move from strlcpy with unused retval to strscpy 2022-08-18T22:44:08+00:00 Wolfram Sang wsa+renesas@sang-engineering.com 2022-08-18T22:05:06+00:00 a9f08ad7adb3d2f90e11efbb40a1246ef95b0c04 Follow the advice of the below link and prefer 'strscpy' in this subsystem. Conversion is 1:1 because the return value is not used. Generated by a coccinelle script. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://lore.kernel.org/r/20220818210022.6865-1-wsa+renesas@sang-engineering.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Follow the advice of the below link and prefer 'strscpy' in this
subsystem. Conversion is 1:1 because the return value is not used.
Generated by a coccinelle script.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://lore.kernel.org/r/20220818210022.6865-1-wsa+renesas@sang-engineering.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>