linux-stable.git/include/linux/hid.h, branch v7.0.10

HID: core: introduce hid_safe_input_report()

2026-05-23T11:09:38+00:00

[ Upstream commit 206342541fc887ae919774a43942dc883161fece ]

hid_input_report() is used in too many places to have a commit that
doesn't cross subsystem borders. Instead of changing the API, introduce
a new one when things matters in the transport layers:
- usbhid
- i2chid

This effectively revert to the old behavior for those two transport
layers.

Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

HID: pass the buffer size to hid_report_raw_event

2026-05-23T11:09:37+00:00

[ Upstream commit 2c85c61d1332e1e16f020d76951baf167dcb6f7a ]

commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
bogus memset()") enforced the provided data to be at least the size of
the declared buffer in the report descriptor to prevent a buffer
overflow. However, we can try to be smarter by providing both the buffer
size and the data size, meaning that hid_report_raw_event() can make
better decision whether we should plaining reject the buffer (buffer
overflow attempt) or if we can safely memset it to 0 and pass it to the
rest of the stack.

Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires 
Acked-by: Johan Hovold 
Reviewed-by: Greg Kroah-Hartman 
Signed-off-by: Jiri Kosina 
Stable-dep-of: 206342541fc8 ("HID: core: introduce hid_safe_input_report()")
Signed-off-by: Sasha Levin

HID: input: Add HID_BATTERY_QUIRK_DYNAMIC for Elan touchscreens

2026-03-11T14:26:47+00:00

Elan touchscreens have a HID-battery device for the stylus which is always
there even if there is no stylus.

This is causing upower to report an empty battery for the stylus and some
desktop-environments will show a notification about this, which is quite
annoying.

Because of this the HID-battery is being ignored on all Elan I2c and USB
touchscreens, but this causes there to be no battery reporting for
the stylus at all.

This adds a new HID_BATTERY_QUIRK_DYNAMIC and uses these for the Elan
touchscreens.

This new quirks causes the present value of the battery to start at 0,
which will make userspace ignore it and only sets present to 1 after
receiving a battery input report which only happens when the stylus
gets in range.

Reported-by: ggrundik@gmail.com
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221118
Signed-off-by: Hans de Goede 
Reviewed-by: Sebastian Reichel 
Signed-off-by: Jiri Kosina

HID: Document memory allocation properties of report_fixup()

2026-02-19T17:57:38+00:00

The memory pointer returned by the report_fixup() hook does not get
freed by the caller.  Instead, report_fixup() must return (in return
value and *rsize) a memory buffer with at least the same lifetime as
the input buffer (defined by rdesc and original *rsize).

This is usually achieved using one of the following techniques:

* Returning a pointer and size to a sub-portion of the input buffer
* Returning a pointer to a static buffer
* Allocating a buffer with a devm_*() function,
  which will automatically get freed when the device is removed.

Signed-off-by: Günther Noack 
Signed-off-by: Benjamin Tissoires

drivers: hid: renegotiate resolution multipliers with device after reset

2025-11-26T16:21:48+00:00

The scroll resolution multipliers are set in the context of
hidinput_connect(), which is only called at probe time: when the host
changes the value on the device with a SET_REPORT(FEATURE), and the device
accepts it, these multipliers are stored on the host side, and used to
calculate the final scroll event values sent to userspace.

After a USB suspend, the resume operation on many hubs and chipsets
involve a USB reset signal as well. A reset on the device side clears all
previous state information, including the value of the multiplier report.
This reset is not handled by the multiplier handling logic, so what ends up
happening is the host is still expecting high-resolution scroll events,
but the device is reset to default resolution, making the effective,
user-perceived scroll speed incredibly slow.

The solution is to renegotiate the multiplier selection after each reset.

This is not the only bug related to the high-resolution scrolling
implementation in the kernel (the other one is
https://bugzilla.kernel.org/show_bug.cgi?id=220144), but for this one,
there is no device side workaround for, leading to poor user experience with our product:
https://github.com/UltimateHackingKeyboard/firmware/issues/1155
https://github.com/UltimateHackingKeyboard/firmware/issues/1261
https://github.com/UltimateHackingKeyboard/firmware/pull/1355
This patch was tested by an affected user and has been reported to
fix the issue (see discussion in 1355).

Signed-off-by: Benedek Kupper 
Signed-off-by: Jiri Kosina

HID: core: Add printk_ratelimited variants to hid_warn() etc

2025-10-14T09:57:40+00:00

hid_warn_ratelimited() is needed. Add the others as part of the block.

Signed-off-by: Vicki Pfau 
Signed-off-by: Jiri Kosina

Merge tag 'hid-for-linus-2025093001' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

2025-10-04T22:38:04+00:00

Pull HID updates from Benjamin Tissoires:

 - haptic touchpad support (Angela Czubak and Jonathan Denose)

 - support for audio jack handling on DualSense Playstation controllers
   (Cristian Ciocaltea)

 - allow HID-BPF to rebind a driver to hid-multitouch (Benjamin
   Tissoires)

 - rework hidraw ioctls to make them safer (and tested) (Benjamin
   Tissoires)

 - various PIDFF and universal-PIDFF fixes/improvements (Tomasz Pakuła)

 - better configuration of Intel QuickI2C through ACPI (Xinpeng Sun)

 - other assorted cleanups and fixes

* tag 'hid-for-linus-2025093001' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (58 commits)
  HID: playstation: Switch to scoped_guard() in {dualsense|dualshock4}_output_worker()
  HID: playstation: Silence sparse warnings for locking context imbalances
  HID: playstation: Update SP preamp gain comment line
  HID: intel-thc-hid: intel-quicki2c: support ACPI config for advanced features
  HID: core: Change hid_driver to use a const char* for name
  HID: hidraw: tighten ioctl command parsing
  selftests/hid: hidraw: forge wrong ioctls and tests them
  selftests/hid: hidraw: add more coverage for hidraw ioctls
  selftests/hid: update vmtest.sh for virtme-ng
  HID: playstation: Support DualSense audio jack event reporting
  HID: playstation: Support DualSense audio jack hotplug detection
  HID: playstation: Redefine DualSense input report status field
  HID: playstation: Prefer kzalloc(sizeof(*buf)...)
  HID: playstation: Document spinlock_t usage
  HID: playstation: Fix all alignment and line length issues
  HID: playstation: Correct spelling in comment sections
  HID: playstation: Replace uint{32,16,8}_t with u{32,16,8}
  HID: playstation: Simplify locking with guard() and scoped_guard()
  HID: playstation: Add spaces around arithmetic operators
  HID: playstation: Make use of bitfield macros
  ...

Merge branch 'for-6.18/haptic' into for-linus

2025-09-30T14:43:15+00:00

- Implement haptic touchpad support (Angela Czubak and Jonathan Denose)

HID: core: Change hid_driver to use a const char* for name

2025-09-17T09:48:01+00:00

name is never mutated by the core HID stack. Making name a const char*
simplifies passing the string from Rust to C. Otherwise, it becomes
difficult to pass a 'static lifetime CStr from Rust to a char*, rather than
a const char*, due to lack of guarantee that the underlying data of the
CStr will not be mutated by the C code.

Signed-off-by: Rahul Rameshbabu 
Signed-off-by: Benjamin Tissoires

HID: add haptics page defines

2025-09-15T12:32:54+00:00

Introduce haptic usages as defined in HID Usage Tables specification.
Add HID units for newton and gram.

Signed-off-by: Angela Czubak 
Co-developed-by: Jonathan Denose 
Signed-off-by: Jonathan Denose 
Signed-off-by: Benjamin Tissoires