The Elan I2C touchpad driver queries the device for its physical
dimensions and trace counts to calculate the device resolution and width.
However, if the device firmware or device tree provides invalid zero
values for x_traces or y_traces, it results in a fatal division-by-zero
exception leading to a kernel panic during device probe.

Add checks to ensure these parameters are non-zero before performing
the division. If invalid trace values are detected, fall back to a safe
default of 1.

Additionally, prevent an arithmetic underflow in the touch reporting
logic. Previously, if the calculated or fallback width was smaller than
ETP_FWIDTH_REDUCE (90), the subtraction would underflow, resulting in a
massive unsigned integer being reported to userspace. Clamp the adjusted
width to a minimum of 0 to safely handle small physical dimensions and
fallback scenarios.

Completing the probe with safe fallback values ensures the sysfs nodes
are created, keeping the firmware update path intact so a recovery
firmware can be flashed to the device.

Fixes: 6696777c6506 ("Input: add driver for Elan I2C/SMbus touchpad")
Fixes: e3a9a1290688 ("Input: elan_i2c - do not query the info if they are provided")
Signed-off-by: Ranjan Kumar <kumarranja@chromium.org>
Link: https://patch.msgid.link/20260612060339.3829666-1-kumarranja@chromium.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Sync up with mainline to pull in a fix to IMS PCU driver and other
enhancements.

Pull input fixes from Dmitry Torokhov:

 - updates to Elan I2C touchpad driver to handle a new IC type and to
   validate size of supplied firmware to prevent OOB access

 - updates to Xpad controller driver to recognize ASUS ROG RAIKIRI II
   and "Nova 2 Lite" from GameSir controllers as well as a fix to
   prevent a potential OOB access when handling "Share" button

 - an update to Synaptics touchpad driver to use RMI mode for touchpad
   in Thinkpad E490

 - updates to Atmel MXT driver adding checks to prevent potential OOB
   accesses

 - a fix to IMS PCU driver to free correct amount of memory when tearing
   it down

 - a fixup to the recent change to Atlas buttons driver

 - a small cleanup in fm801-fp for PCI IDs table initialisation

* tag 'input-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
  Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
  Input: atlas - check ACPI_COMPANION() against NULL
  Input: atmel_mxt_ts - check mem_size before calculating config memory size
  Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
  Input: fm801-gp - simplify initialisation of pci_device_id array
  Input: xpad - add "Nova 2 Lite" from GameSir
  Input: xpad - add support for ASUS ROG RAIKIRI II
  Input: elan_i2c - validate firmware size before use
  Input: xpad - fix out-of-bounds access for Share button
  Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
  Input: elan_i2c - increase device reset wait timeout after update FW
  Input: elan_i2c - add ic type 0x19

While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.

The mentioned robustness is relevant for a planned change to struct
i2c_device_id that replaces .driver_data by an anonymous union.

This patch doesn't modify the compiled arrays, only their representation
in source form benefits. The former was confirmed with x86 and arm64
builds.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260515164848.497608-2-u.kleine-koenig@baylibre.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The Lenovo ThinkPad E490 (PNP ID: LEN2058) has a Synaptics TM3471-020
touchpad that supports SMBus/RMI4 mode but is not listed in
smbus_pnp_ids[]. Without this entry, RMI4 over SMBus is not enabled
by default, and the touchpad falls back to PS/2 mode.

Adding LEN2058 to the passlist enables automatic RMI4 detection without
requiring the psmouse.synaptics_intertouch parameter, and matches
the behavior of similar ThinkPad models already in the list
(E480/LEN2054, E580/LEN2055).

Tested on ThinkPad E490 with kernel 7.0.5-zen1 and Arch Linux.
RMI4 over SMBus is confirmed working without any kernel parameters.

Signed-off-by: Nicolás Bazaes <contacto@bazaes.cl>
Assisted-by: Claude:claude-sonnet-4-6
Link: https://patch.msgid.link/20260514013552.14234-1-contacto@bazaes.cl
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Ensure that the firmware file is large enough to contain the expected
number of pages and the signature (which resides at the end of the
firmware blob) before accessing them to prevent potential out-of-bounds
reads.

Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/ae2dOgiFvXRm4BHo@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Extend wait_for_completion_timeout from 300ms to 700ms to ensure
sufficient time for device reset after firmware update.

Signed-off-by: Jingle Wu <jingle.wu@emc.com.tw>
Link: https://patch.msgid.link/KL1PR01MB5116031986614B3214EF2F30DC2C2@KL1PR01MB5116.apcprd01.prod.exchangelabs.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The 0x19 is valid 3000 serial ic type too.

Signed-off-by: Jingle Wu <jingle.wu@emc.com.tw>
Link: https://patch.msgid.link/KL1PR01MB511699853D1B66D137C06806DC2C2@KL1PR01MB5116.apcprd01.prod.exchangelabs.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Pull input updates from Dmitry Torokhov:

 - a new charlieplex GPIO keypad driver

 - an update to aw86927 driver to support 86938 chip

 - an update for Chrome OS EC keyboard driver to support Fn-<key> keymap
   extension

 - an UAF fix in debugfs teardown in EDT touchscreen driver

 - a number of conversions for input drivers to use guard() and __free()
   cleanup primitives

 - several drivers for bus mice (inport, logibm) and other very old
   devices have been removed

 - OLPC HGPK PS/2 protocol has been removed as it's been broken and
   inactive for 10 something years

 - dedicated kpsmoused has been removed from psmouse driver

 - other assorted cleanups and fixups

* tag 'input-for-v7.1-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (101 commits)
  Input: charlieplex_keypad - add GPIO charlieplex keypad
  dt-bindings: input: add GPIO charlieplex keypad
  dt-bindings: input: add settling-time-us common property
  dt-bindings: input: add debounce-delay-ms common property
  Input: imx_keypad - fix spelling mistake "Colums" -> "Columns"
  Input: edt-ft5x06 - fix use-after-free in debugfs teardown
  Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
  Input: ct82c710 - remove driver
  Input: mk712 - remove driver
  Input: logibm - remove driver
  Input: inport - remove driver
  Input: qt1070 - inline i2c_check_functionality check
  Input: qt1050 - inline i2c_check_functionality check
  Input: aiptek - validate raw macro indices before updating state
  Input: gf2k - skip invalid hat lookup values
  Input: xpad - add RedOctane Games vendor id
  Input: xpad - remove stale TODO and changelog header
  Input: usbtouchscreen - refactor endpoint lookup
  Input: aw86927 - add support for Awinic AW86938
  dt-bindings: input: awinic,aw86927: Add Awinic AW86938
  ...

Pull x86 platform driver updates from Ilpo Järvinen:
 "asus-wmi:
   - Retain battery charge threshold during boot which avoids
     unsolicited change to 100%. Return -ENODATA when the limit
     is not yet known
   - Improve screenpad power/brightness handling consistency
   - Fix screenpad brightness range

  barco-p50-gpio:
   - Normalize gpio_get return values

  bitland-mifs-wmi:
   - Add driver for Bitland laptops (supports platform profile,
     hwmon, kbd backlight, gpu mode, hotkeys, and fan boost)

  dell_rbu:
   - Fix using uninitialized value in sysfs write function

  dell-wmi-sysman:
   - Respect destination length when constructing enum strings

  hp-wmi:
   - Propagate fan setting apply failures and log an error
   - Fix sysfs write vs work handler cancel_delayed_work_sync() deadlock
   - Correct keepalive schedule_delayed_work() to mod_delayed_work()
   - Fix u8 underflows in GPU delta calculation
   - Use mutex to protect fan pwm/mode
   - Ignore kbd backlight and FnLock key events that are handled by FW
   - Fix fan table parsing (use correct field)
   - Add support for Omen 14-fb0xxx, 16-n0xxx, 16-wf1xxx, and
     Omen MAX 16-ak0xxxx

  input: trackpoint & thinkpad_acpi:
   - Enable doubletap by default and add sysfs enable/disable

  int3472:
   - Add support for GPIO type 0x02 (IR flood LED)

  intel-speed-select: (updated to v1.26)
   - Avoid using current base frequency as maximum
   - Fix CPU extended family ID decoding
   - Fix exit code
   - Improve error reporting

  intel/vsec:
   - Refactor to support ACPI-enumerated PMT endpoints.

  pcengines-apuv2:
   - Attach software node to the gpiochip

  uniwill:
   - Refactor hwmon to smaller parts to accomodate HW diversity
   - Support USB-C power/performance priority switch through sysfs
   - Add another XMG Fusion 15 (L19) DMI vendor
   - Enable fine-grained features to device lineup mapping

  wmi:
   - Perform output size check within WMI core to allow simpler WMI
     drivers

  misc:
   - acpi_driver -> platform driver conversions (a large number of
     changes from Rafael J. Wysocki)
   - cleanups / refactoring / improvements"

* tag 'platform-drivers-x86-v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (106 commits)
  platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C77)
  platform/x86: hp-wmi: Add support for Omen 16-n0xxx (8A44)
  platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8D87)
  platform/x86: hp-wmi: fix fan table parsing
  platform/x86: hp-wmi: add Omen 14-fb0xxx (board 8C58) support
  platform/wmi: Replace .no_notify_data with .min_event_size
  platform/wmi: Extend wmidev_query_block() to reject undersized data
  platform/wmi: Extend wmidev_invoke_method() to reject undersized data
  platform/wmi: Prepare to reject undersized unmarshalling results
  platform/wmi: Convert drivers to use wmidev_invoke_procedure()
  platform/wmi: Add wmidev_invoke_procedure()
  platform/x86: int3472: Add support for GPIO type 0x02 (IR flood LED)
  platform/x86: int3472: Parameterize LED con_id in registration
  platform/x86: int3472: Rename pled to led in LED registration code
  platform/x86: int3472: Use local variable for LED struct access
  platform/x86: thinkpad_acpi: remove obsolete TODO comment
  platform/x86: dell-wmi-sysman: bound enumeration string aggregation
  platform/x86: hp-wmi: Ignore backlight and FnLock events
  platform/x86: uniwill-laptop: Fix signedness bug
  platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()
  ...