linux.git/drivers/input/tablet, branch master Linux kernel source tree Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-22T01:09:51+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-02-22T00:37:42+00:00 bf4afc53b77aeaa48b5409da5c8da6bb4eff7f43 This was done entirely with mindless brute force, using git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' | xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/' to convert the new alloc_obj() users that had a simple GFP_KERNEL argument to just drop that argument. Note that due to the extreme simplicity of the scripting, any slightly more complex cases spread over multiple lines would not be triggered: they definitely exist, but this covers the vast bulk of the cases, and the resulting diff is also then easier to check automatically. For the same reason the 'flex' versions will be done as a separate conversion. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 
This was done entirely with mindless brute force, using

    git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' |
        xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/'

to convert the new alloc_obj() users that had a simple GFP_KERNEL
argument to just drop that argument.

Note that due to the extreme simplicity of the scripting, any slightly
more complex cases spread over multiple lines would not be triggered:
they definitely exist, but this covers the vast bulk of the cases, and
the resulting diff is also then easier to check automatically.

For the same reason the 'flex' versions will be done as a separate
conversion.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21T09:02:28+00:00 Kees Cook kees@kernel.org 2026-02-21T07:49:23+00:00 69050f8d6d075dc01af7a5f2f550a8067510366f This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org> 
This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:

Single allocations:	kmalloc(sizeof(TYPE), ...)
are replaced with:	kmalloc_obj(TYPE, ...)

Array allocations:	kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with:	kmalloc_objs(TYPE, COUNT, ...)

Flex array allocations:	kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with:	kmalloc_flex(*PTR, FAM, COUNT, ...)

(where TYPE may also be *VAR)

The resulting allocations no longer return "void *", instead returning
"TYPE *".

Signed-off-by: Kees Cook <kees@kernel.org>
Input: pegasus-notetaker - fix potential out-of-bounds access 2025-10-18T01:04:15+00:00 Seungjin Bae eeodqql09@gmail.com 2025-10-17T22:36:31+00:00 69aeb507312306f73495598a055293fa749d454e In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buffer. Subsequently, if the device sends an interrupt packet with a specific pattern (e.g., where the first byte is 0x80 or 0x42), the pegasus_parse_packet() function parses the packet without checking the allocated buffer size. This leads to an out-of-bounds memory access. Fixes: 1afca2b66aac ("Input: add Pegasus Notetaker tablet driver") Signed-off-by: Seungjin Bae <eeodqql09@gmail.com> Link: https://lore.kernel.org/r/20251007214131.3737115-2-eeodqql09@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
In the pegasus_notetaker driver, the pegasus_probe() function allocates
the URB transfer buffer using the wMaxPacketSize value from
the endpoint descriptor. An attacker can use a malicious USB descriptor
to force the allocation of a very small buffer.

Subsequently, if the device sends an interrupt packet with a specific
pattern (e.g., where the first byte is 0x80 or 0x42),
the pegasus_parse_packet() function parses the packet without checking
the allocated buffer size. This leads to an out-of-bounds memory access.

Fixes: 1afca2b66aac ("Input: add Pegasus Notetaker tablet driver")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Link: https://lore.kernel.org/r/20251007214131.3737115-2-eeodqql09@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Merge tag 'input-for-v6.13-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2024-11-25T18:31:39+00:00 Linus Torvalds torvalds@linux-foundation.org 2024-11-25T18:31:39+00:00 3e51108c72e8adbcf3180ed40527a2a9d2d0123b Pull input updates from Dmitry Torokhov: - support for NT36672A touchscreen added to novatek-nvt-ts driver - a change to ads7846 driver to prevent XPT2046 from locking up - a change switching platform input dirves back to using remove() method (from remove_new()) - updates to a number of input drivers to use the new cleanup facilities (__free(...), guard(), and scoped-guard()) which ensure that the resources and locks are released properly and automatically - other assorted driver cleanups and fixes. * tag 'input-for-v6.13-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (109 commits) Input: mpr121 - use devm_regulator_get_enable_read_voltage() Input: sun4i-lradc-keys - don't include 'pm_wakeup.h' directly Input: spear-keyboard - don't include 'pm_wakeup.h' directly Input: cypress-sf - constify struct i2c_device_id Input: ads7846 - increase xfer array size in 'struct ser_req' Input: fix the input_event struct documentation Input: i8042 - fix typo dublicate to duplicate Input: ads7846 - add dummy command register clearing cycle Input: cs40l50 - fix wrong usage of INIT_WORK() Input: introduce notion of passive observers for input handlers Input: maple_keyb - use guard notation when acquiring mutex Input: locomokbd - use guard notation when acquiring spinlock Input: hilkbd - use guard notation when acquiring spinlock Input: synaptics-rmi4 - switch to using cleanup functions in F34 Input: synaptics - fix a typo dt-bindings: input: rotary-encoder: Fix "rotary-encoder,rollover" type Input: omap-keypad - use guard notation when acquiring mutex Input: imagis - fix warning regarding 'imagis_3038_data' being unused Input: userio - remove unneeded semicolon Input: sparcspkr - use cleanup facility for device_node ... 
Pull input updates from Dmitry Torokhov:

 - support for NT36672A touchscreen added to novatek-nvt-ts driver

 - a change to ads7846 driver to prevent XPT2046 from locking up

 - a change switching platform input dirves back to using remove()
   method (from remove_new())

 - updates to a number of input drivers to use the new cleanup
   facilities (__free(...), guard(), and scoped-guard()) which ensure
   that the resources and locks are released properly and automatically

 - other assorted driver cleanups and fixes.

* tag 'input-for-v6.13-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (109 commits)
  Input: mpr121 - use devm_regulator_get_enable_read_voltage()
  Input: sun4i-lradc-keys - don't include 'pm_wakeup.h' directly
  Input: spear-keyboard - don't include 'pm_wakeup.h' directly
  Input: cypress-sf - constify struct i2c_device_id
  Input: ads7846 - increase xfer array size in 'struct ser_req'
  Input: fix the input_event struct documentation
  Input: i8042 - fix typo dublicate to duplicate
  Input: ads7846 - add dummy command register clearing cycle
  Input: cs40l50 - fix wrong usage of INIT_WORK()
  Input: introduce notion of passive observers for input handlers
  Input: maple_keyb - use guard notation when acquiring mutex
  Input: locomokbd - use guard notation when acquiring spinlock
  Input: hilkbd - use guard notation when acquiring spinlock
  Input: synaptics-rmi4 - switch to using cleanup functions in F34
  Input: synaptics - fix a typo
  dt-bindings: input: rotary-encoder: Fix "rotary-encoder,rollover" type
  Input: omap-keypad - use guard notation when acquiring mutex
  Input: imagis - fix warning regarding 'imagis_3038_data' being unused
  Input: userio - remove unneeded semicolon
  Input: sparcspkr - use cleanup facility for device_node
  ...
Input: pegasus_notetaker - use guard notation when acquiring mutex 2024-10-03T16:10:37+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2024-09-04T20:59:18+00:00 0e7b4bc31d171856fcb753f653e0f00855763bf3 Using guard notation makes the code more compact and error handling more robust by ensuring that mutexes are released in all code paths when control leaves critical section. Reviewed-by: Javier Carrasco <javier.carrasco.cruz@gmail.com> Link: https://lore.kernel.org/r/ZtjKJsArLu3byTU6@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Using guard notation makes the code more compact and error handling
more robust by ensuring that mutexes are released in all code paths
when control leaves critical section.

Reviewed-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Link: https://lore.kernel.org/r/ZtjKJsArLu3byTU6@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
move asm/unaligned.h to linux/unaligned.h 2024-10-02T21:23:23+00:00 Al Viro viro@zeniv.linux.org.uk 2024-10-01T19:35:57+00:00 5f60d5f6bbc12e782fac78110b0ee62698f3b576 asm/unaligned.h is always an include of asm-generic/unaligned.h; might as well move that thing to linux/unaligned.h and include that - there's nothing arch-specific in that header. auto-generated by the following: for i in `git grep -l -w asm/unaligned.h`; do sed -i -e "s/asm\/unaligned.h/linux\/unaligned.h/" $i done for i in `git grep -l -w asm-generic/unaligned.h`; do sed -i -e "s/asm-generic\/unaligned.h/linux\/unaligned.h/" $i done git mv include/asm-generic/unaligned.h include/linux/unaligned.h git mv tools/include/asm-generic/unaligned.h tools/include/linux/unaligned.h sed -i -e "/unaligned.h/d" include/asm-generic/Kbuild sed -i -e "s/__ASM_GENERIC/__LINUX/" include/linux/unaligned.h tools/include/linux/unaligned.h 
asm/unaligned.h is always an include of asm-generic/unaligned.h;
might as well move that thing to linux/unaligned.h and include
that - there's nothing arch-specific in that header.

auto-generated by the following:

for i in `git grep -l -w asm/unaligned.h`; do
	sed -i -e "s/asm\/unaligned.h/linux\/unaligned.h/" $i
done
for i in `git grep -l -w asm-generic/unaligned.h`; do
	sed -i -e "s/asm-generic\/unaligned.h/linux\/unaligned.h/" $i
done
git mv include/asm-generic/unaligned.h include/linux/unaligned.h
git mv tools/include/asm-generic/unaligned.h tools/include/linux/unaligned.h
sed -i -e "/unaligned.h/d" include/asm-generic/Kbuild
sed -i -e "s/__ASM_GENERIC/__LINUX/" include/linux/unaligned.h tools/include/linux/unaligned.h
Input: tablet - use sizeof(*pointer) instead of sizeof(type) 2024-06-03T04:32:03+00:00 Erick Archer erick.archer@outlook.com 2024-06-03T04:30:48+00:00 2960d4c8e77aba365df80b69e72f88b29011b111 It is preferred to use sizeof(*pointer) instead of sizeof(type) due to the type of the variable can change and one needs not change the former (unlike the latter). This patch has no effect on runtime behavior. Signed-off-by: Erick Archer <erick.archer@outlook.com> Link: https://lore.kernel.org/r/AS8PR02MB7237B05083487507CFAF96B08BFE2@AS8PR02MB7237.eurprd02.prod.outlook.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
It is preferred to use sizeof(*pointer) instead of sizeof(type)
due to the type of the variable can change and one needs not
change the former (unlike the latter). This patch has no effect
on runtime behavior.

Signed-off-by: Erick Archer <erick.archer@outlook.com>
Link: https://lore.kernel.org/r/AS8PR02MB7237B05083487507CFAF96B08BFE2@AS8PR02MB7237.eurprd02.prod.outlook.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: pegasus-notetaker - check pipe type when probing 2023-04-10T02:19:14+00:00 Soumya Negi soumya.negi97@gmail.com 2023-04-10T02:12:04+00:00 b3d80fd27a3c2d8715a40cbf876139b56195f162 Fix WARNING in pegasus_open/usb_submit_urb Syzbot bug: https://syzkaller.appspot.com/bug?id=bbc107584dcf3262253ce93183e51f3612aaeb13 Warning raised because pegasus_driver submits transfer request for bogus URB (pipe type does not match endpoint type). Add sanity check at probe time for pipe value extracted from endpoint descriptor. Probe will fail if sanity check fails. Reported-and-tested-by: syzbot+04ee0cb4caccaed12d78@syzkaller.appspotmail.com Signed-off-by: Soumya Negi <soumya.negi97@gmail.com> Link: https://lore.kernel.org/r/20230404074145.11523-1-soumya.negi97@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Fix WARNING in pegasus_open/usb_submit_urb
Syzbot bug: https://syzkaller.appspot.com/bug?id=bbc107584dcf3262253ce93183e51f3612aaeb13

Warning raised because pegasus_driver submits transfer request for
bogus URB (pipe type does not match endpoint type). Add sanity check at
probe time for pipe value extracted from endpoint descriptor. Probe
will fail if sanity check fails.

Reported-and-tested-by: syzbot+04ee0cb4caccaed12d78@syzkaller.appspotmail.com
Signed-off-by: Soumya Negi <soumya.negi97@gmail.com>
Link: https://lore.kernel.org/r/20230404074145.11523-1-soumya.negi97@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
input: drop empty comment blocks 2022-09-29T23:25:42+00:00 Christophe JAILLET christophe.jaillet@wanadoo.fr 2022-09-29T19:11:36+00:00 2d09ac951b7750780ecb3de3ccb642dffd7ef62b Commit 1a59d1b8e05e ("treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156") has left some empty comment blocks. Remove them to save a few lines of code. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Link: https://lore.kernel.org/r/26a2b905b259bfffaf2de5b26f2007b8606970ed.1664478665.git.christophe.jaillet@wanadoo.fr Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Commit 1a59d1b8e05e ("treewide: Replace GPLv2 boilerplate/reference with
SPDX - rule 156") has left some empty comment blocks.

Remove them to save a few lines of code.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/26a2b905b259bfffaf2de5b26f2007b8606970ed.1664478665.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: aiptek - switch to using dev_groups for driver-specific attributes 2022-09-03T19:31:18+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2022-09-03T05:11:19+00:00 f4e7a254299bcdfe7bced700a7d96690b1b9a6f2 The driver core now has the ability to handle the creation and removal of device-specific sysfs files, let's use it instead of registering and unregistering attributes by hand. Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20220903051119.1332808-3-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
The driver core now has the ability to handle the creation and removal
of device-specific sysfs files, let's use it instead of registering and
unregistering attributes by hand.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20220903051119.1332808-3-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>