Pull HID fixes from Jiri Kosina:

 - fixes for a few OOB/UAF in several HID drivers (Florian Pradines, Lee
   Jones, Michael Zaidman, Rosalie Wanders, Sangyun Kim and Tomasz
   Pakuła)

 - more general sanitation of input data, dealing with potentially
   malicious hardware in hid-core (Benjamin Tissoires)

 - a few device-specific quirks and fixups

* tag 'hid-for-linus-2026051401' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (22 commits)
  HID: logitech-hidpp: Add support for newer Bluetooth keyboards
  HID: pidff: Fix integer overflow in pidff_rescale
  HID: i2c-hid: add reset quirk for BLTP7853 touchpad
  HID: core: introduce hid_safe_input_report()
  HID: pass the buffer size to hid_report_raw_event
  HID: google: hammer: stop hardware on devres action failure
  HID: appletb-kbd: run inactivity autodim from workqueues
  HID: appletb-kbd: fix UAF in inactivity-timer cleanup path
  HID: playstation: Clamp num_touch_reports
  HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
  HID: mcp2221: fix OOB write in mcp2221_raw_event()
  HID: quirks: really enable the intended work around for appledisplay
  HID: hid-sjoy: race between init and usage
  HID: uclogic: Fix regression of input name assignment
  HID: intel-thc-hid: Intel-quickspi: Fix some error codes
  HID: hid-lenovo-go-s: restore OS_TYPE after resume from s2idle
  HID: elan: Add support for ELAN SB974D touchpad
  HID: sony: add missing size validation for Rock Band 3 Pro instruments
  HID: sony: add missing size validation for SMK-Link remotes
  HID: sony: remove unneeded WARN_ON() in sony_leds_init()
  ...

The BLTP7853 I2C HID touchpad may fail to probe after reboot or
reprobe because reset completion is not signalled to the host. The
driver then waits for the reset-complete interrupt until it times out
and the device probe fails:

  i2c_hid i2c-BLTP7853:00: failed to reset device.
  i2c_hid i2c-BLTP7853:00: can't add hid device: -61
  i2c_hid: probe of i2c-BLTP7853:00 failed with error -61

Add I2C_HID_QUIRK_NO_IRQ_AFTER_RESET for the device so i2c-hid does
not wait for a reset interrupt that may never arrive.

Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>

hid_input_report() is used in too many places to have a commit that
doesn't cross subsystem borders. Instead of changing the API, introduce
a new one when things matters in the transport layers:
- usbhid
- i2chid

This effectively revert to the old behavior for those two transport
layers.

Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>

Sync up with the mainline to brig up the latest changes, specifically
changes to ALPS driver.

Parade-tc3408 requires reset to pull down time greater than 10ms,
so the configuration post_power_delay_ms is 10, and the chipset
initial time is required to be greater than 300ms,
so the post_gpio_reset_on_delay_ms is set to 300.

Signed-off-by: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Acked-by: Jiri Kosina <jkosina@suse.com>
Link: https://patch.msgid.link/20260108063524.742464-3-yelangyan@huaqin.corp-partner.google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Pull input updates from Dmitry Torokhov:

 - support for FocalTech FT8112 added to i2c-hid driver

 - support for FocalTech FT3518 added to edt-ft5x06 driver

 - support for power buttons in TWL603x chips added to twl4030-pwrbutton
   driver

 - an update to gpio-decoder driver to make it usable on non-OF
   platforms and to clean up the code

 - an update to synaptics_i2c driver switching it to use managed
   resources and a fix to restarting polling after resume

 - an update to gpio-keys driver to fall back to getting IRQ from
   resources if not specified using other means

 - an update to ili210x driver to support polling mode

 - a number of input drivers switched to scnprintf() to suppress
   truncation warnings

 - a number of updates and conversions of device tree bindings to yaml
   format

 - fixes to spelling in comments and messages in several drivers

 - other assorted fixups

* tag 'input-for-v7.0-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (57 commits)
  dt-bindings: input: qcom,pm8941-pwrkey: Document PMM8654AU
  dt-bindings: input: touchscreen: imagis: allow linux,keycodes for ist3038
  Input: apbps2 - fix comment style and typos
  Input: gpio_keys - fall back to platform_get_irq() for interrupt-only keys
  Input: novatek-nvt-ts - drop wake_type check
  dt-bindings: input: touchscreen: tsc2007: document '#io-channel-cells'
  Input: ili210x - add support for polling mode
  dt-bindings: touchscreen: trivial-touch: Drop 'interrupts' requirement for old Ilitek
  Input: appletouch - fix potential race between resume and open
  HID: i2c-hid: Add FocalTech FT8112
  dt-bindings: input: i2c-hid: Introduce FocalTech FT8112
  Input: synaptics_i2c - switch to using managed resources
  Input: synaptics_i2c - guard polling restart in resume
  Input: gpio_decoder - don't use "proxy" headers
  Input: gpio_decoder - make use of the macros from bits.h
  Input: gpio_decoder - replace custom loop by gpiod_get_array_value_cansleep()
  Input: gpio_decoder - unify messages with help of dev_err_probe()
  Input: gpio_decoder - make use of device properties
  Input: serio - complete sizeof(*pointer) conversions
  Input: wdt87xx_i2c - switch to use dev_err_probe()
  ...

Information for touchscreen model HKO/RB116AS01-2 as below:
- HID :FTSC1000
- slave address:0X38
- Interface:HID over I2C
- Touch control lC:FT8112
- I2C ID: PNP0C50

Signed-off-by: Daniel Peng <Daniel_Peng@pegatron.corp-partner.google.com>
Acked-by: Jiri Kosina <jkosina@suse.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20251117094041.300083-2-Daniel_Peng@pegatron.corp-partner.google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

`i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data
into `ihid->rawbuf`.

The former can come from the userspace in the hidraw driver and is only
bounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set
`max_buffer_size` field of `struct hid_ll_driver` which we do not).

The latter has size determined at runtime by the maximum size of
different report types you could receive on any particular device and
can be a much smaller value.

Fix this by truncating `recv_len` to `ihid->bufsize - sizeof(__le16)`.

The impact is low since access to hidraw devices requires root.

Signed-off-by: Kwok Kin Ming <kenkinming2002@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

Pull HID updates from Benjamin Tissoires:

 - haptic touchpad support (Angela Czubak and Jonathan Denose)

 - support for audio jack handling on DualSense Playstation controllers
   (Cristian Ciocaltea)

 - allow HID-BPF to rebind a driver to hid-multitouch (Benjamin
   Tissoires)

 - rework hidraw ioctls to make them safer (and tested) (Benjamin
   Tissoires)

 - various PIDFF and universal-PIDFF fixes/improvements (Tomasz Pakuła)

 - better configuration of Intel QuickI2C through ACPI (Xinpeng Sun)

 - other assorted cleanups and fixes

* tag 'hid-for-linus-2025093001' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (58 commits)
  HID: playstation: Switch to scoped_guard() in {dualsense|dualshock4}_output_worker()
  HID: playstation: Silence sparse warnings for locking context imbalances
  HID: playstation: Update SP preamp gain comment line
  HID: intel-thc-hid: intel-quicki2c: support ACPI config for advanced features
  HID: core: Change hid_driver to use a const char* for name
  HID: hidraw: tighten ioctl command parsing
  selftests/hid: hidraw: forge wrong ioctls and tests them
  selftests/hid: hidraw: add more coverage for hidraw ioctls
  selftests/hid: update vmtest.sh for virtme-ng
  HID: playstation: Support DualSense audio jack event reporting
  HID: playstation: Support DualSense audio jack hotplug detection
  HID: playstation: Redefine DualSense input report status field
  HID: playstation: Prefer kzalloc(sizeof(*buf)...)
  HID: playstation: Document spinlock_t usage
  HID: playstation: Fix all alignment and line length issues
  HID: playstation: Correct spelling in comment sections
  HID: playstation: Replace uint{32,16,8}_t with u{32,16,8}
  HID: playstation: Simplify locking with guard() and scoped_guard()
  HID: playstation: Add spaces around arithmetic operators
  HID: playstation: Make use of bitfield macros
  ...

Dell systems utilize an EC-based touchpad emulation when the ACPI
touchpad _DSM is not invoked. This emulation acts as a secondary
master on the I2C bus, designed for scenarios where the I2C touchpad
driver is absent, such as in BIOS menus. Typically, loading the
i2c-hid module triggers the _DSM at initialization, disabling the
EC-based emulation.

However, if the i2c-hid module is missing from the boot kernel
used for hibernation snapshot restoration, the _DSM remains
uncalled, resulting in dual masters on the I2C bus and
subsequent arbitration errors. This issue arises when i2c-hid
resides in the rootfs instead of the kernel or initramfs.

To address this, switch from using the SYSTEM_SLEEP_PM_OPS()
macro to dedicated callbacks, introducing a specific
callback for restoring the S4 image. This callback ensures
the _DSM is invoked.

Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>