linux-stable.git/tools/testing/selftests/hid, branch linux-rolling-lts

selftests/hid: Cover hid_bpf_get_data() size overflow

2026-07-24T14:16:46+00:00

[ Upstream commit eebbef7c468a5cb58c4772849ee5066441166cf0 ]

Add a HID-BPF regression check for hid_bpf_get_data() requests whose
size would overflow when added to the offset.

The new rdesc fixup callback asks for offset 2 and size ~0ULL, then
records whether the helper returns NULL. A vulnerable kernel returns a
non-NULL pointer because the runtime check wraps the addition. A fixed
kernel rejects the request. The callback records the helper result
without dereferencing any returned pointer.

The callback reports the helper result through BSS and returns 0
intentionally. hid_rdesc_fixup return values are consumed as report
descriptor fixup results, so a positive test-result value would be
interpreted as a replacement report descriptor size.

Also add KHDR_INCLUDES to the HID selftest build so hid_bpf.c sees the
current kernel UAPI HID definitions on systems whose installed headers do
not provide enum hid_report_type.

Fixes: 658ee5a64fcf ("HID: bpf: allocate data memory for device_event BPF programs")
Signed-off-by: Yiyang Chen 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Sasha Levin

selftests/hid: Load only requested struct_ops maps

2026-07-24T14:16:46+00:00

[ Upstream commit 5aad55011a37d999cf99d14bafb6a093a1a70466 ]

The HID selftest skeleton contains several struct_ops maps, but each test
usually wants to load only the programs named by that test.

load_programs() disabled auto-attach for all maps, but left struct_ops
autocreate enabled. libbpf can enable autoload for programs referenced by
autocreated struct_ops maps, so an unrelated program can be loaded and fail
even when the current test does not use it.

Disable autocreate for all struct_ops maps by default, then re-enable it
only for the maps selected by the test before loading the skeleton.

Signed-off-by: Yiyang Chen 
Fixes: f64c1a459339 ("selftests/hid: disable struct_ops auto-attach")
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Sasha Levin

selftests/hid: fix compilation when bpf_wq and hid_device are not exported

2026-03-25T10:10:30+00:00

commit 5d4c6c132ea9a967d48890dd03e6a786c060e968 upstream.

This can happen in situations when CONFIG_HID_SUPPORT is set to no, or
some complex situations where struct bpf_wq is not exported.

So do the usual dance of hiding them before including vmlinux.h, and
then redefining them and make use of CO-RE to have the correct offsets.

Reported-by: kernel test robot 
Closes: https://lore.kernel.org/oe-kbuild-all/202603111558.KLCIxsZB-lkp@intel.com/
Fixes: fe8d561db3e8 ("selftests/hid: add wq test for hid_bpf_input_report()")
Cc: stable@vger.kernel.org
Acked-by: Jiri Kosina 
Reviewed-by: Thomas Weißschuh 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Greg Kroah-Hartman

selftests/hid: add tests for missing release on the Dell Synaptics

2025-10-15T15:27:06+00:00

Add a simple test for the corner case not currently covered by the
sticky fingers quirk. Because it's a corner case test, we only test this
on a couple of devices, not on all of them because the value of adding
the same test over and over is rather moot.

Signed-off-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

Merge branch 'for-6.18/selftests' into for-linus

2025-09-30T14:51:38+00:00

- update vmtest.sh (Benjamin Tissoires)

selftests/hid: hidraw: forge wrong ioctls and tests them

2025-09-17T09:37:23+00:00

We also need coverage for when the malicious user is not using the
proper ioctls definitions and tries to work around the driver.

Most of the scaffholding has been generated by claude-4-sonnet and then
carefully reviewed.

Suggested-by: Arnd Bergmann 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

selftests/hid: hidraw: add more coverage for hidraw ioctls

2025-09-17T09:37:23+00:00

Try to ensure all ioctls are having at least one test.

Most of the scaffholding has been generated by claude-4-sonnet and then
carefully reviewed.

Signed-off-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

selftests/hid: update vmtest.sh for virtme-ng

2025-09-17T09:35:39+00:00

This commit is a rewrite almost from scratch of vmtest.sh.

By relying on virtme-ng, we get rid of boot2container, reducing the
total bootup time (and network requirements). That means that we are
relying on the programs being installed on the host, but that shouldn't
be an issue. The generation of the kconfig is also now handled by
virtme-ng, so that's one less thing to worry.

I used tools/testing/selftests/vsock/vmtest.sh as a base and modified it
to look mostly like my previous script:
- removed the custom ssh handling
- make use of vng for compiling, which allows to bring remote
  compilation (and potentially remote compilation on a remote container)
- change the verbosity logic by having 2 levels:
  - first one shows the tests outputs
  - second level also shows the VM logs
- instead of only running the compiled kernel when it is built, if we
  are in the kernel tree, use the kernel artifacts there (and complain
  if they are not built)
- adapted the tests list to match the HID subsystem tests

Signed-off-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

Merge tag 'hid-for-linus-2025073101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

2025-08-01T04:26:05+00:00

Pull HID updates from Jiri Kosina:

 - hardening of HID core parser against conversion to 0 bits in s32ton()
   by buggy/malicious devices (Alan Stern)

 - fix for potential NULL pointer dereference in hid-apple that could be
   caused by malicious device with APPLE_MAGIC_BACKLIGHT quirk present
   triggering overflow in data field (Qasim Ijaz)

 - support for Wake-on-touch in intel-thc (Even Xu)

 - support for "Input max input size control" and "Input interrupt
   delay" I2C features in order to improve compatibility of THC devices
   with legacy HIDI2C touch devices (Even Xu)

 - support for Touch Bars on x86 MacBook Pros (Kerem Karabay)

 - support for XP-PEN Artist 22R Pro (Joshua Goins)

 - third party trackpart support for MacBookPro15,1 (Aditya Garg)

 - Apple Magic Keyboard A311[89] USB-C support (Aditya Garg, Grigorii
   Sokoli)

 - support for operating modes in amd-sfh (Basavaraj Natikar)

 - avoid setting up battery timer for Apple and Magicmouse devices
   without battery (Aditya Garg)

 - fix for behavior of the hid-mcp2221 driver for !CONFIG_IIO cases
   (Heiko Schocher)

 - other assorted fixups and device ID additions

* tag 'hid-for-linus-2025073101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (54 commits)
  HID: core: Harden s32ton() against conversion to 0 bits
  HID: apple: validate feature-report field count to prevent NULL pointer dereference
  HID: core: Improve the kerneldoc for hid_report_len()
  selftests/hid: sync python tests to hid-tools 0.10
  selftests/hid: sync the python tests to hid-tools 0.8
  selftests/hid: run ruff format on the python part
  HID: magicmouse: use secs_to_jiffies() for battery timeout
  HID: apple: use secs_to_jiffies() for battery timeout
  HID: magicmouse: avoid setting up battery timer when not needed
  HID: apple: avoid setting up battery timer for devices without battery
  HID: amd_sfh: Enable operating mode
  HID: uclogic: Add support for XP-PEN Artist 22R Pro
  HID: rate-limit hid_warn to prevent log flooding
  HID: replace scnprintf() with sysfs_emit()
  HID: uclogic: make read-only array reconnect_event static const
  HID: mcp-2221: Replace manual comparison with min() macro
  HID: intel-thc-hid: Separate max input size control conditional list
  HID: mcp2221: set gpio pin mode
  HID: multitouch: add device ID for Apple Touch Bar
  HID: multitouch: specify that Apple Touch Bar is direct
  ...

Merge branch 'for-6.17/selftests' into for-linus

2025-07-31T20:53:29+00:00

- upgrade the python scripts in hid-selftests to match hid-tools
  version 0.10 (Benjamin Tissoires)