linux.git/drivers/hid/usbhid, branch master Linux kernel source tree HID: pidff: Fix integer overflow in pidff_rescale 2026-05-12T16:13:40+00:00 Tomasz Pakuła tomasz.pakula.oficjalny@gmail.com 2026-05-10T12:23:52+00:00 48d1677779ad6816978ad4a4f7588aec5ec960fe Rescaling values close to the max (U16_MAX) temporarily creates values that exceed the s32 range. This caused value overflow in case when, for example, a periodic effect phase was higer than 180 degrees. In turn, rescale function could return values outised of the logical range of the HID field. Fix by using 64 bit signed integer to store the value during calculation but still return only 32 bit integer. Closes: https://github.com/JacKeTUs/universal-pidff/issues/116 Fixes: 224ee88fe395 ("Input: add force feedback driver for PID devices") Cc: stable@vger.kernel.org Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> 
Rescaling values close to the max (U16_MAX) temporarily creates values
that exceed the s32 range. This caused value overflow in case when, for
example, a periodic effect phase was higer than 180 degrees. In turn,
rescale function could return values outised of the logical range of the
HID field.

Fix by using 64 bit signed integer to store the value during calculation
but still return only 32 bit integer.

Closes: https://github.com/JacKeTUs/universal-pidff/issues/116
Fixes: 224ee88fe395 ("Input: add force feedback driver for PID devices")
Cc: stable@vger.kernel.org
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
HID: core: introduce hid_safe_input_report() 2026-05-12T16:03:58+00:00 Benjamin Tissoires bentiss@kernel.org 2026-05-04T08:47:23+00:00 206342541fc887ae919774a43942dc883161fece hid_input_report() is used in too many places to have a commit that doesn't cross subsystem borders. Instead of changing the API, introduce a new one when things matters in the transport layers: - usbhid - i2chid This effectively revert to the old behavior for those two transport layers. Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> Signed-off-by: Jiri Kosina <jkosina@suse.com> 
hid_input_report() is used in too many places to have a commit that
doesn't cross subsystem borders. Instead of changing the API, introduce
a new one when things matters in the transport layers:
- usbhid
- i2chid

This effectively revert to the old behavior for those two transport
layers.

Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Merge branch 'for-7.1/pidff' into for-linus 2026-04-16T19:05:37+00:00 Jiri Kosina jkosina@suse.com 2026-04-16T19:05:37+00:00 38d76018bb412dc66b08837097eff53d21e8df29 - various new per-device(-group) type quirks for pidff driver (Tomasz Pakuła) 
- various new per-device(-group) type quirks for pidff driver (Tomasz Pakuła)
Merge branch 'for-7.1/core-v2' into for-linus 2026-04-16T19:01:18+00:00 Jiri Kosina jkosina@suse.com 2026-04-16T19:01:18+00:00 d4eb7b2da66c848709e31585b9c371fa234abc39 - fixed handling of 0-sized reports (Dmitry Torokhov) - convert core code to __free() (Dmitry Torokhov) - support for multiple batteries per HID device (Lucas Zampieri) 
- fixed handling of 0-sized reports (Dmitry Torokhov)
- convert core code to __free() (Dmitry Torokhov)
- support for multiple batteries per HID device (Lucas Zampieri)
HID: usbhid: refactor endpoint lookup 2026-04-09T15:58:12+00:00 Johan Hovold johan@kernel.org 2026-03-30T09:50:34+00:00 2fcc5e0ee7989154c4a5d169bcc9565cf2d62147 Use the common USB helper for looking up interrupt-in endpoints instead of open coding. Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Jiri Kosina <jkosina@suse.com> 
Use the common USB helper for looking up interrupt-in endpoints instead
of open coding.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
HID: usbhid: fix deadlock in hid_post_reset() 2026-04-09T15:48:05+00:00 Oliver Neukum oneukum@suse.com 2026-03-24T14:24:54+00:00 8df2c1b47ee3cd50fd454f75c7a7e2ae8a6adf72 You can build a USB device that includes a HID component and a storage or UAS component. The components can be reset only together. That means that hid_pre_reset() and hid_post_reset() are in the block IO error handling. Hence no memory allocation used in them may do block IO because the IO can deadlock on the mutex held while resetting a device and calling the interface drivers. Use GFP_NOIO for all allocations in them. Fixes: dc3c78e434690 ("HID: usbhid: Check HID report descriptor contents after device reset") Signed-off-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> 
You can build a USB device that includes a HID component
and a storage or UAS component. The components can be reset
only together. That means that hid_pre_reset() and hid_post_reset()
are in the block IO error handling. Hence no memory allocation
used in them may do block IO because the IO can deadlock
on the mutex held while resetting a device and calling the
interface drivers.
Use GFP_NOIO for all allocations in them.

Fixes: dc3c78e434690 ("HID: usbhid: Check HID report descriptor contents after device reset")
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Merge tag 'hid-for-linus-2026030601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid 2026-03-06T18:00:58+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-03-06T18:00:58+00:00 48976c0eba2ff3a3b893c35853bdf27369b16655 Pull HID fixes from Benjamin Tissoires: - fix a few memory leaks (Günther Noack) - fix potential kernel crashes in cmedia, creative-sb0540 and zydacron (Greg Kroah-Hartman) - fix NULL pointer dereference in pidff (Tomasz Pakuła) - fix battery reporting for Apple Magic Trackpad 2 (Julius Lehmann) - mcp2221 proper handling of failed read operation (Romain Sioen) - various device quirks / device ID additions * tag 'hid-for-linus-2026030601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: mcp2221: cancel last I2C command on read error HID: asus: add xg mobile 2023 external hardware support HID: multitouch: Keep latency normal on deactivate for reactivation gesture HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list HID: intel-ish-hid: ipc: Add Nova Lake-H/S PCI device IDs selftests: hid: tests: test_wacom_generic: add tests for display devices and opaque devices HID: multitouch: new class MT_CLS_EGALAX_P80H84 HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 HID: pidff: Fix condition effect bit clearing HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them HID: asus: avoid memory leak in asus_report_fixup() HID: magicmouse: avoid memory leak in magicmouse_report_fixup() HID: apple: avoid memory leak in apple_report_fixup() HID: Document memory allocation properties of report_fixup() 
Pull HID fixes from Benjamin Tissoires:

 - fix a few memory leaks (Günther Noack)

 - fix potential kernel crashes in cmedia, creative-sb0540 and zydacron
   (Greg Kroah-Hartman)

 - fix NULL pointer dereference in pidff (Tomasz Pakuła)

 - fix battery reporting for Apple Magic Trackpad 2 (Julius Lehmann)

 - mcp2221 proper handling of failed read operation (Romain Sioen)

 - various device quirks / device ID additions

* tag 'hid-for-linus-2026030601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: mcp2221: cancel last I2C command on read error
  HID: asus: add xg mobile 2023 external hardware support
  HID: multitouch: Keep latency normal on deactivate for reactivation gesture
  HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list
  HID: intel-ish-hid: ipc: Add Nova Lake-H/S PCI device IDs
  selftests: hid: tests: test_wacom_generic: add tests for display devices and opaque devices
  HID: multitouch: new class MT_CLS_EGALAX_P80H84
  HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
  HID: pidff: Fix condition effect bit clearing
  HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
  HID: asus: avoid memory leak in asus_report_fixup()
  HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
  HID: apple: avoid memory leak in apple_report_fixup()
  HID: Document memory allocation properties of report_fixup()
HID: pidff: Add MISSING_DEADBAND quirk 2026-02-26T14:46:00+00:00 Tomasz Pakuła tomasz.pakula.oficjalny@gmail.com 2026-02-03T17:45:30+00:00 7daaa0fc44f47882e7b2efff7b95c5f72bb08c26 Some devices (mainly Asetek) do not have deadband field in set conditional usage. Do not fail set conditional usage search if it's missing. Allows conditional effect playback on Asetek wheelbases. Deadband is practically never used in simracing anyway. Align property name in the whole driver to use 'deadband' without space. Co-developed-by: Oleg Makarenko <oleg@makarenk.ooo> Signed-off-by: Oleg Makarenko <oleg@makarenk.ooo> Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> 
Some devices (mainly Asetek) do not have deadband field in set
conditional usage. Do not fail set conditional usage search if it's
missing. Allows conditional effect playback on Asetek wheelbases.

Deadband is practically never used in simracing anyway.

Align property name in the whole driver to use 'deadband' without space.

Co-developed-by: Oleg Makarenko <oleg@makarenk.ooo>
Signed-off-by: Oleg Makarenko <oleg@makarenk.ooo>
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
HID: pidff: Add MISSING_NEG_SATURATION quirk 2026-02-26T14:46:00+00:00 Tomasz Pakuła tomasz.pakula.oficjalny@gmail.com 2026-02-03T17:45:29+00:00 d9cef0989ace79582dac90a2915c100144460e9f This is the same case as the previous MISSING_NEG_COEFFICIENT quirk Co-developed-by: Oleg Makarenko <oleg@makarenk.ooo> Signed-off-by: Oleg Makarenko <oleg@makarenk.ooo> Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> 
This is the same case as the previous MISSING_NEG_COEFFICIENT quirk

Co-developed-by: Oleg Makarenko <oleg@makarenk.ooo>
Signed-off-by: Oleg Makarenko <oleg@makarenk.ooo>
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
HID: pidff: Add MISSING_NEG_COEFFICIENT quirk 2026-02-26T14:46:00+00:00 Tomasz Pakuła tomasz.pakula.oficjalny@gmail.com 2026-02-03T17:45:28+00:00 cf3bf7ad4e7722735d085b5fd5ab90a01be831d4 Windows/Directinput allows devices with missing negative coefficient for conditional effects. Negative coefficient is ignored in such cases. Donot fail set_condition usage search if negative coefficient is missing. Fixes conditional effect playback on Asetek wheelbases. https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ee416601(v=vs.85) Co-developed-by: Oleg Makarenko <oleg@makarenk.ooo> Signed-off-by: Oleg Makarenko <oleg@makarenk.ooo> Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> 
Windows/Directinput allows devices with missing negative coefficient for
conditional effects. Negative coefficient is ignored in such cases.

Donot fail set_condition usage search if negative coefficient is missing.
Fixes conditional effect playback on Asetek wheelbases.

https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ee416601(v=vs.85)

Co-developed-by: Oleg Makarenko <oleg@makarenk.ooo>
Signed-off-by: Oleg Makarenko <oleg@makarenk.ooo>
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>