linux.git/drivers/staging/greybus, branch master

Merge tag 'hid-for-linus-2026051401' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

2026-05-14T21:30:01+00:00

Pull HID fixes from Jiri Kosina:

 - fixes for a few OOB/UAF in several HID drivers (Florian Pradines, Lee
   Jones, Michael Zaidman, Rosalie Wanders, Sangyun Kim and Tomasz
   Pakuła)

 - more general sanitation of input data, dealing with potentially
   malicious hardware in hid-core (Benjamin Tissoires)

 - a few device-specific quirks and fixups

* tag 'hid-for-linus-2026051401' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (22 commits)
  HID: logitech-hidpp: Add support for newer Bluetooth keyboards
  HID: pidff: Fix integer overflow in pidff_rescale
  HID: i2c-hid: add reset quirk for BLTP7853 touchpad
  HID: core: introduce hid_safe_input_report()
  HID: pass the buffer size to hid_report_raw_event
  HID: google: hammer: stop hardware on devres action failure
  HID: appletb-kbd: run inactivity autodim from workqueues
  HID: appletb-kbd: fix UAF in inactivity-timer cleanup path
  HID: playstation: Clamp num_touch_reports
  HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
  HID: mcp2221: fix OOB write in mcp2221_raw_event()
  HID: quirks: really enable the intended work around for appledisplay
  HID: hid-sjoy: race between init and usage
  HID: uclogic: Fix regression of input name assignment
  HID: intel-thc-hid: Intel-quickspi: Fix some error codes
  HID: hid-lenovo-go-s: restore OS_TYPE after resume from s2idle
  HID: elan: Add support for ELAN SB974D touchpad
  HID: sony: add missing size validation for Rock Band 3 Pro instruments
  HID: sony: add missing size validation for SMK-Link remotes
  HID: sony: remove unneeded WARN_ON() in sony_leds_init()
  ...

HID: pass the buffer size to hid_report_raw_event

2026-05-12T16:03:37+00:00

commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
bogus memset()") enforced the provided data to be at least the size of
the declared buffer in the report descriptor to prevent a buffer
overflow. However, we can try to be smarter by providing both the buffer
size and the data size, meaning that hid_report_raw_event() can make
better decision whether we should plaining reject the buffer (buffer
overflow attempt) or if we can safely memset it to 0 and pass it to the
rest of the stack.

Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires 
Acked-by: Johan Hovold 
Reviewed-by: Greg Kroah-Hartman 
Signed-off-by: Jiri Kosina

staging: greybus: audio: fix error message for BTN_3 button

2026-03-31T08:34:30+00:00

In gbaudio_init_jack(), when setting SND_JACK_BTN_3 key, the error
message incorrectly says "Failed to set BTN_0". This should be
"Failed to set BTN_3" to match the button being configured.

Signed-off-by: Haoyu Lu 
Reviewed-by: Johan Hovold 
Link: https://patch.msgid.link/20260330083425.266-1-hechushiguitu666@gmail.com
Signed-off-by: Greg Kroah-Hartman

greybus: raw: fix use-after-free if write is called after disconnect

2026-03-31T08:33:48+00:00

If a user writes to the chardev after disconnect has been called, the
kernel panics with the following trace (with
CONFIG_INIT_ON_FREE_DEFAULT_ON=y):

        BUG: kernel NULL pointer dereference, address: 0000000000000218
         ...
        Call Trace:
         
         gb_operation_create_common+0x61/0x180
         gb_operation_create_flags+0x28/0xa0
         gb_operation_sync_timeout+0x6f/0x100
         raw_write+0x7b/0xc7 [gb_raw]
         vfs_write+0xcf/0x420
         ? task_mm_cid_work+0x136/0x220
         ksys_write+0x63/0xe0
         do_syscall_64+0xa4/0x290
         entry_SYSCALL_64_after_hwframe+0x77/0x7f

Disconnect calls gb_connection_destroy, which ends up freeing the
connection object. When gb_operation_sync is called in the write file
operations, its gets a freed connection as parameter and the kernel
panics.

The gb_connection_destroy cannot be moved out of the disconnect
function, as the Greybus subsystem expect all connections belonging to a
bundle to be destroyed when disconnect returns.

To prevent this bug, use a rw lock to synchronize access between write
and disconnect. This guarantees that the write function doesn't try
to use a disconnected connection.

Fixes: e806c7fb8e9b ("greybus: raw: add raw greybus kernel driver")
Reviewed-by: Johan Hovold 
Signed-off-by: Damien Riégel 
Link: https://patch.msgid.link/20260324140039.40001-2-damien.riegel@silabs.com
Signed-off-by: Greg Kroah-Hartman

greybus: raw: fix use-after-free on cdev close

2026-03-31T08:33:48+00:00

This addresses a use-after-free bug when a raw bundle is disconnected
but its chardev is still opened by an application. When the application
releases the cdev, it causes the following panic when init on free is
enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y):

        refcount_t: underflow; use-after-free.
        WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130
         ...
        Call Trace:
         
         cdev_put+0x18/0x30
         __fput+0x255/0x2a0
         __x64_sys_close+0x3d/0x80
         do_syscall_64+0xa4/0x290
         entry_SYSCALL_64_after_hwframe+0x77/0x7f

The cdev is contained in the "gb_raw" structure, which is freed in the
disconnect operation. When the cdev is released at a later time,
cdev_put gets an address that points to freed memory.

To fix this use-after-free, convert the struct device from a pointer to
being embedded, that makes the lifetime of the cdev and of this device
the same. Then, use cdev_device_add, which guarantees that the device
won't be released until all references to the cdev have been released.
Finally, delegate the freeing of the structure to the device release
function, instead of freeing immediately in the disconnect callback.

Fixes: e806c7fb8e9b ("greybus: raw: add raw greybus kernel driver")
Reviewed-by: Johan Hovold 
Signed-off-by: Damien Riégel 
Link: https://patch.msgid.link/20260324140039.40001-1-damien.riegel@silabs.com
Signed-off-by: Greg Kroah-Hartman

staging: greybus: loopback: remove unused argument from macro

2026-03-18T15:49:22+00:00

The gb_dev_loopback_ro_attr macro accepted a 'conn' argument which
was never used in its expansion. Remove it from both the macro
definition and its invocation.

Signed-off-by: Giacomo Di Clerico 
Link: https://patch.msgid.link/20260315105853.34609-1-giacomodiclerico@gmail.com
Signed-off-by: Greg Kroah-Hartman

staging: greybus: loopback: use sysfs_emit in sysfs show functions

2026-03-18T15:48:48+00:00

As per the kernel's documentation, sysfs_emit() is the preferred way
to format strings for sysfs attributes. It handles buffer overruns
safely. Replace sprintf calls with sysfs_emit across all loopback
sysfs show macros.

Signed-off-by: Luis Soza Rodriguez 
Reviewed-by: Dan Carpenter 
Link: https://patch.msgid.link/20260309230507.4931-1-contact@sluisr.com
Signed-off-by: Greg Kroah-Hartman

staging: greybus: remove redundant 'int' from unsigned long long

2026-03-09T16:03:23+00:00

Replace 'unsigned long long int' with 'unsigned long long' as the
'int' suffix is unnecessary and not preferred by kernel coding style.

Signed-off-by: Oskar Ray-Frayssinet 
Link: https://patch.msgid.link/20260304193206.4992-1-rayfraytech@gmail.com
Signed-off-by: Greg Kroah-Hartman

staging: greybus: arche: use sysfs_emit() instead of sprintf()

2026-03-09T16:02:59+00:00

Replace sprintf() with sysfs_emit() in state_show() sysfs attribute
callbacks in arche-platform.c and arche-apb-ctrl.c.

Checkpatch complains about code using sprintf(). This code here is
obviously safe as-is, but it would be more appropriate to use
sysfs_emit().

Signed-off-by: Ruslan Valiyev 
Reviewed-by: Dan Carpenter 
Link: https://patch.msgid.link/20260226074858.67635-1-linuxoid@gmail.com
Signed-off-by: Greg Kroah-Hartman

staging: greybus: arche-platform: Use sysfs_emit instead of sprintf

2026-03-09T16:02:34+00:00

Refactor sprintf to sysfs_emit in the show function of the arche platform
driver. This follows the standard kernel practice of using sysfs_emit for
sysfs attributes, ensuring consistent output formatting and newline
handling.

Signed-off-by: Shubham Chakraborty 
Link: https://patch.msgid.link/20260226065239.11698-1-chakrabortyshubham66@gmail.com
Signed-off-by: Greg Kroah-Hartman