summaryrefslogtreecommitdiff
path: root/drivers/input
AgeCommit message (Collapse)Author
2026-06-06Input: ims-pcu - add response length checksDmitry Torokhov
The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data. Add checks for the expected response length before accessing the buffers. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - fix DMA mapping violation in line setupDmitry Torokhov
In ims_pcu_line_setup(), the driver uses pcu->cmd_buf as a transfer buffer for usb_control_msg(). However, pcu->cmd_buf is embedded in the struct ims_pcu allocation, which violates DMA mapping rules regarding cacheline alignment. Use a heap-allocated buffer for the line coding data instead. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug loggingDmitry Torokhov
The debug logging in ims_pcu_irq() unconditionally prints data from pcu->urb_in_buf. However, if the interrupt fired for pcu->urb_ctrl, the actual data resides in pcu->urb_ctrl_buf. If urb->actual_length for the control URB exceeds pcu->max_in_size, this leads to an out-of-bounds read. Fix this by printing from the correct buffer associated with the URB. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - validate control endpoint typeDmitry Torokhov
The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint type, which would then be passed to usb_fill_int_urb(), potentially leading to kernel warnings or undefined behavior. Verify that the control endpoint is an interrupt IN endpoint. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - fix race condition in reset_device sysfs callbackDmitry Torokhov
The ims_pcu_reset_device() sysfs callback calls ims_pcu_execute_command() without acquiring pcu->cmd_mutex. This can lead to data races and corruption of the shared command buffer if triggered concurrently with other commands. Acquire pcu->cmd_mutex before calling ims_pcu_execute_command(). Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - fix firmware leak in async updateDmitry Torokhov
The firmware object was not being released if validation failed. Use __free(firmware) to ensure the firmware is always released. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - fix type confusion in CDC union descriptor parsingDmitry Torokhov
The driver currently trusts the bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead to the driver overwriting the private data of another interface. Validate that the control interface found in the descriptor is indeed the one we are probing. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - fix use-after-free and double-free in disconnectDmitry Torokhov
ims_pcu_disconnect() only intended to perform cleanup when the primary (control) interface is unbound. However, it currently relies on the interface class to distinguish between control and data interfaces. A malicious device could present a data interface with the same class as the control interface, leading to premature cleanup and potential use-after-free or double-free. Switch to verifying that the interface being disconnected is indeed the control interface. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - release data interface on disconnectDmitry Torokhov
During probe the driver claims the data interface, but it never releases it. Release it in disconnect to avoid leaving it permanently claimed. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - fix logic error in packet resetDmitry Torokhov
ims_pcu_reset_packet() incorrectly sets have_stx to true, which implies that the start-of-packet delimiter has already been received. This causes the protocol parser to skip waiting for the next STX byte and potentially process garbage data. Correctly set have_stx to false when resetting the packet state. Fixes: 875115b82c29 ("Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - only expose sysfs attributes on control interfaceDmitry Torokhov
When the driver was converted to use the driver core to instantiate device attributes (via .dev_groups in the usb_driver structure), the attributes started appearing on all interfaces bound to the driver. Since the ims-pcu driver manually claims the secondary data interface during probe, the driver core automatically creates the sysfs attributes for that interface as well. However, the driver only supports these attributes on the primary control interface. Data interfaces lack the necessary descriptors and internal state to handle these requests, and accessing them can lead to unexpected behavior or crashes. Fix this by updating the is_visible() callbacks for both the main and OFN attribute groups to verify that the interface being accessed is indeed the control interface. Fixes: 204d18a7a0c6 ("Input: ims-pcu - use driver core to instantiate device attributes") Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Cc: stable@vger.kernel.org Link: https://patch.msgid.link/ahp23lj4_vXIeUBl@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: atlas_btns - modernize the driverDmitry Torokhov
Rework the driver to use modern style: - Remove global state by introducing a per-device structure - Use devm for resource management (input device allocation) - Use dev_err_probe() for error reporting in the probe path - Clean up unused definitions and headers. Assisted-by: Gemini:gemini-3.1-pro Link: https://patch.msgid.link/ahp6qt_viW3l-NlX@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: apbps2 - simplify resource mapping and IRQ retrievalRosen Penev
Simplify resource mapping by using devm_platform_ioremap_resource() instead of the longer devm_platform_get_and_ioremap_resource() helper as the last argument is NULL. Additionally, use platform_get_irq() to retrieve the interrupt instead of irq_of_parse_and_map() and propagate its error code on failure. irq_of_parse_and_map() requires irq_dispose_mapping, which is missing. Assisted-by: Antigravity:Gemini-3.5-Flash Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260603192415.6679-1-rosenp@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: xilinx_ps2 - remove driverRosen Penev
Remove the Xilinx XPS PS/2 controller driver. This driver supports an old Xilinx EDK IP core that is no longer in active use. The hardware is not available on modern platforms, and the driver has no users here. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Michal Simek <michal.simek@amd.com> Link: https://patch.msgid.link/20260603054217.442016-1-rosenp@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboardCryolitia PukNgae
After commit 9cf6e24c9fbf17e52de9fff07f12be7565ea6d61 ("Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID"), HONOR BCC-N, aka HONOR MagicBook 14 2026's internal keyboard stops working. Adding the atkbd_deactivate_fixup quirk fixes it. DMI: HONOR BCC-N/BCC-N-PCB, BIOS 1.04 04/07/2026 Fixes: 9cf6e24c9fbf17e52de9fff07f12be7565ea6d61 ("Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID") Reported-by: Hongfei Ren <lcrhf@outlook.com> Link: https://github.com/colorcube/Linux-on-Honor-Magicbook-14-Pro/issues/1#issuecomment-4562679891 Tested-by: Hongfei Ren <lcrhf@outlook.com> Cc: stable@kernel.org Signed-off-by: Cryolitia PukNgae <cryolitia.pukngae@linux.dev> Link: https://patch.msgid.link/20260605-honor-v1-1-78e05e491193@linux.dev Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-02Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)Zeyu WANG
The Lenovo Yoga Air 14 (83QK) laptop keyboard becomes unresponsive after the standard atkbd init sequence. Controlled testing on the actual hardware shows the F5 (ATKBD_CMD_RESET_DIS / deactivate) command specifically corrupts the EC state, causing zero IRQ1 interrupts after init. Skipping only the deactivate command (while keeping F4 ENABLE) resolves the issue completely: both keystroke input and CapsLock LED toggle work correctly. The reverse test - skipping only F4 while keeping F5 - makes the problem worse (zero keystroke interrupts), confirming F5 is the sole culprit. Add a DMI quirk entry for LENOVO/83QK using the existing atkbd_deactivate_fixup callback, consistent with the existing entries for LG Electronics and HONOR FMB-P that address the same EC F5 deactivate issue. Signed-off-by: Zeyu WANG <zeyu.thomas.wang@gmail.com> Link: https://patch.msgid.link/20260602170909.14725-1-zeyu.thomas.wang@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-01Input: userio - allow setting other id valuesVicki Pfau
Previously, only the type value was settable. The proto value is used internally for choosing the right drivers, so we should expose it. The other values make sense to expose as well. Signed-off-by: Vicki Pfau <vi@endrift.com> Link: https://patch.msgid.link/20260522015040.3953472-2-vi@endrift.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-01Input: userio - update maintainer nameVicki Pfau
She's been committing under the name Lyude Paul for a while Signed-off-by: Vicki Pfau <vi@endrift.com> Link: https://patch.msgid.link/20260522015040.3953472-1-vi@endrift.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-31Merge tag 'v7.1-rc6' into nextDmitry Torokhov
Sync up with mainline to pull in a fix to IMS PCU driver and other enhancements.
2026-05-31Merge tag 'input-for-v7.1-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - updates to Elan I2C touchpad driver to handle a new IC type and to validate size of supplied firmware to prevent OOB access - updates to Xpad controller driver to recognize ASUS ROG RAIKIRI II and "Nova 2 Lite" from GameSir controllers as well as a fix to prevent a potential OOB access when handling "Share" button - an update to Synaptics touchpad driver to use RMI mode for touchpad in Thinkpad E490 - updates to Atmel MXT driver adding checks to prevent potential OOB accesses - a fix to IMS PCU driver to free correct amount of memory when tearing it down - a fixup to the recent change to Atlas buttons driver - a small cleanup in fm801-fp for PCI IDs table initialisation * tag 'input-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Input: atlas - check ACPI_COMPANION() against NULL Input: atmel_mxt_ts - check mem_size before calculating config memory size Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Input: fm801-gp - simplify initialisation of pci_device_id array Input: xpad - add "Nova 2 Lite" from GameSir Input: xpad - add support for ASUS ROG RAIKIRI II Input: elan_i2c - validate firmware size before use Input: xpad - fix out-of-bounds access for Share button Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size Input: elan_i2c - increase device reset wait timeout after update FW Input: elan_i2c - add ic type 0x19
2026-05-30Input: iqs5xx - drop unused i2c driver_dataUwe Kleine-König (The Capable Hub)
The driver doesn't make use of the value that was explicitly assigned to the .driver_data members. Drop the assignment. While touching the array, convert it to use named initialization which is easier to understand. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20260515165135.498505-2-u.kleine-koenig@baylibre.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-30Input: Use named initializers for arrays of i2c_device_dataUwe Kleine-König (The Capable Hub)
While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. The mentioned robustness is relevant for a planned change to struct i2c_device_id that replaces .driver_data by an anonymous union. This patch doesn't modify the compiled arrays, only their representation in source form benefits. The former was confirmed with x86 and arm64 builds. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20260515164848.497608-2-u.kleine-koenig@baylibre.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-29Input: Add support for Wacom W9000-series penabled touchscreensHendrik Noack
Add driver for Wacom W9002 and two Wacom W9007A variants. These are penabled touchscreens supporting passive Wacom Pens and use I2C. Co-developed-by: Ferass El Hafidi <funderscore@postmarketos.org> Signed-off-by: Ferass El Hafidi <funderscore@postmarketos.org> Signed-off-by: Hendrik Noack <hendrik-noack@gmx.de> Link: https://patch.msgid.link/20260528074818.12151-3-hendrik-noack@gmx.de Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-22Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()Thomas Fourier
The input buffer size is pcu->max_in_size, but pcu->max_out_size is passed to usb_free_coherent(). Change size to match the allocation size. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com> Link: https://patch.msgid.link/20260522085412.45430-2-fourier.thomas@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-13Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490Nicolás Bazaes
The Lenovo ThinkPad E490 (PNP ID: LEN2058) has a Synaptics TM3471-020 touchpad that supports SMBus/RMI4 mode but is not listed in smbus_pnp_ids[]. Without this entry, RMI4 over SMBus is not enabled by default, and the touchpad falls back to PS/2 mode. Adding LEN2058 to the passlist enables automatic RMI4 detection without requiring the psmouse.synaptics_intertouch parameter, and matches the behavior of similar ThinkPad models already in the list (E480/LEN2054, E580/LEN2055). Tested on ThinkPad E490 with kernel 7.0.5-zen1 and Arch Linux. RMI4 over SMBus is confirmed working without any kernel parameters. Signed-off-by: Nicolás Bazaes <contacto@bazaes.cl> Assisted-by: Claude:claude-sonnet-4-6 Link: https://patch.msgid.link/20260514013552.14234-1-contacto@bazaes.cl Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-12Input: atlas - check ACPI_COMPANION() against NULLRafael J. Wysocki
Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the atlas_btns driver. Fixes: b8303880b641 ("Input: atlas - convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/8696590.T7Z3S40VBb@rafael.j.wysocki Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-07Input: atmel_mxt_ts - use __free() for obuf in mxt_object_showDmitry Torokhov
Use the __free(kfree) macro for the obuf allocation in mxt_object_show() to simplify the code. Assisted-by: Gemini:gemini-3.1-pro Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260504185448.4055973-3-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-07Input: atmel_mxt_ts - check mem_size before calculating config memory sizeDmitry Torokhov
In mxt_update_cfg(), the driver calculates the memory size needed to store the configuration as data->mem_size - cfg.start_ofs. If data->mem_size is less than or equal to cfg.start_ofs, this calculation will underflow or result in a zero-size buffer, neither of which is valid for a configuration update. Add a check to return -EINVAL if data->mem_size is too small. While at it, change the types of start_ofs and mem_size in struct mxt_cfg to u16 to match the device address space. Assisted-by: Gemini:gemini-3.1-pro Link: https://patch.msgid.link/20260504185448.4055973-2-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-07Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_memDmitry Torokhov
When a configuration file provides an object size that is larger than the driver's known mxt_obj_size(object), the driver intends to discard the extra bytes. The loop iterates using for (i = 0; i < size; i++). Inside the loop, the condition to skip processing extra bytes is: if (i > mxt_obj_size(object)) continue; Since i is a 0-based index, the valid indices for the object are 0 through mxt_obj_size(object) - 1. When i == mxt_obj_size(object), the condition evaluates to false, and the code processes the byte instead of discarding it. This causes the code to calculate byte_offset = reg + i - cfg->start_ofs and writes the byte there, overwriting exactly one byte of the adjacent instance or object. Update the boundary check to skip extra bytes correctly by using >=. Fixes: 50a77c658b80 ("Input: atmel_mxt_ts - download device config using firmware loader") Cc: stable@vger.kernel.org Assisted-by: Gemini:gemini-3.1-pro Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260504185448.4055973-1-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-07Input: fm801-gp - simplify initialisation of pci_device_id arrayUwe Kleine-König (The Capable Hub)
Instead of assigning the pci_device_id members using a list (which is hard to read as you need to look at the order of the members in that struct in parallel) use the PCI_VDEVICE() convenience macro to compact the initialisation while improving readability. Also drop trailing zeros that the compiler will care about then. The change doesn't introduce binary changes to the compiled driver, verified on both ARCH=x86 and ARCH=arm64. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20260507160051.3315630-2-u.kleine-koenig@baylibre.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-04Input: tsc2007 - reduce I2C transactions for Z2 readYuki Horii
The current implementation sends a separate power-down command after reading the Z2 value, resulting in an extra I2C transaction per measurement cycle. The TSC2007 command byte contains a 2-bit power-down mode selection field. By selecting the power-down state in the Z2 measurement command, the device powers down after the Z2 A/D conversion completes, eliminating the subsequent power-down transaction. This reduces the number of I2C transactions by one per touch measurement cycle, decreasing I2C bus overhead and improving touch sampling performance. Signed-off-by: Yuki Horii <yuuki198708@gmail.com> Tested-by: Andreas Kemnade <andreas@kemnade.info> # GTA04 Link: https://patch.msgid.link/20260410074100.1660-1-horiiyuk@ishida.co.jp Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-04Input: atmel_mxt_ts - set byte_offset as signedRicardo Ribalda
The calculations done to obtain byte_offset can result into a negative number, fix its type. This patch fixes the following sparse error: drivers/input/touchscreen/atmel_mxt_ts.c:1481:44: warning: unsigned value that used to be signed checked against zero? drivers/input/touchscreen/atmel_mxt_ts.c:1479:49: signed value source Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260504-fix-sparse-v1-1-1071137cd280@chromium.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-30Input: xpad - add "Nova 2 Lite" from GameSirQbeliw Tanaka
Add support for the gamepad "Nova 2 Lite" from GameSir, compatible with the Xbox 360 gamepad. Signed-off-by: Qbeliw Tanaka <q.tanaka@gmx.com> Link: https://patch.msgid.link/20260429.162040.930225048583399359.q.tanaka@gmx.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-30Input: xpad - add support for ASUS ROG RAIKIRI IIDmitriy Zharov
Add the VID/PIDs for the ASUS ROG RAIKIRI II controller to xpad_device and the VID to xpad_table. The controller has a physical PC/XBOX toggle which switches between XBOX360 and XBOXONE protocols. Signed-off-by: Dmitriy Zharov <contact@zharov.dev> Link: https://patch.msgid.link/20260430183522.122151-1-contact@zharov.dev Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-30Input: pcap_ts - remove unused driverArnd Bergmann
Support for the ezx series of phones was removed in 2022, this driver is just dead code. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://patch.msgid.link/20260430164326.2766500-2-arnd@kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-30Input: pcap_keys - remove unused driverArnd Bergmann
Support for the ezx series of phones was removed in 2022, this driver is just dead code. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://patch.msgid.link/20260430164326.2766500-1-arnd@kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-29Input: elan_i2c - validate firmware size before useDmitry Torokhov
Ensure that the firmware file is large enough to contain the expected number of pages and the signature (which resides at the end of the firmware blob) before accessing them to prevent potential out-of-bounds reads. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/ae2dOgiFvXRm4BHo@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: xpad - fix out-of-bounds access for Share buttonDmitry Torokhov
xpadone_process_packet() receives len directly from urb->actual_length and uses it to index the share-button byte at data[len - 18] or data[len - 26]. Since both len and data[0] are under the device's control, a broken controller can send a GIP_CMD_INPUT packet with actual_length < 18 (e.g. 5 bytes) and reach this code path, causing accesses beyond the actual array. Fix this by calculating the offset and checking bounds against the packet length. Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Fixes: 4ef46367073b ("Input: xpad - fix Share button on Xbox One controllers") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer sizeGreg Kroah-Hartman
nexio_read_data() pulls data_len and x_len from a packed __be16 header in the device's interrupt packet and then walks packet->data[0..x_len) and packet->data[x_len..data_len) comparing each byte against a threshold. Both fields are 16-bit on the wire (max 65535). The existing adjustments shave at most 0x100 / 0x80 off, so the loop bound can still reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size (1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the packed header — so packet->data[] has 1017 valid bytes. read_data() callbacks are not given urb->actual_length, and nothing else bounds the walk. A device that lies about its length can get a ~64 KiB out-of-bounds read past the coherent DMA allocation. The first index whose byte exceeds NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the reported touch coordinates, so adjacent kernel memory contents leak to userspace as ABS_X / ABS_Y events. Far enough out, the read can also hit an unmapped page and fault. Fix this all by clamping data_len to the buffer's data[] capacity and x_len to data_len. Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com> Fixes: 5197424cdccc ("Input: usbtouchscreen - add NEXIO (or iNexio) support") Cc: stable <stable@kernel.org> Assisted-by: gkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/2026042026-chlorine-epidermis-fd6d@gregkh Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - fix formatting issuesDmitry Torokhov
Fix a few formatting issues reported by checkpatch. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - add optional reset GPIO supportPetr Hodina
Add support for an optional "reset-gpios" property. If present, the driver drives the reset line high at probe time and releases it during power-on, after the regulators have been enabled. Signed-off-by: Petr Hodina <petr.hodina@protonmail.com> Co-developed-by: David Heidelberg <david@ixit.cz> Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-8-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - use client to make future code cleanerPetr Hodina
Make code cleaner, compiler will optimize it away anyway. Preparation for FTM5 support, where more steps are needed. Signed-off-by: Petr Hodina <petr.hodina@protonmail.com> Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-6-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - disable regulators and disable irq when power on failsDavid Heidelberg
We must power off regulators and ensure that IRQ is disabled when failing at power on phase. Create stmfts_configure function to limit use of goto. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-5-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - abstract reading information from the firmwareDavid Heidelberg
Improves readability and makes splitting power on function in following commit easier. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-4-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - switch to devm_regulator_bulk_get_constDavid Heidelberg
Switch to devm_regulator_bulk_get_const() to stop setting the supplies list in probe(), and move the regulator_bulk_data struct in static const. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-3-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - use dev struct directlyDavid Heidelberg
Makes the code better readable and noticably shorter. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-2-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - fix the MODULE_LICENSE() stringDavid Heidelberg
Replace the bogus "GPL v2" with "GPL" as MODULE_LICNSE() string. The value does not declare the module's exact license, but only lets the module loader test whether the module is Free Software or not. See commit bf7fbeeae6db ("module: Cure the MODULE_LICENSE "GPL" vs. "GPL v2" bogosity") in the details of the issue. The fix is to use "GPL" for all modules under any variant of the GPL. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-1-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-23Input: elan_i2c - increase device reset wait timeout after update FWJingle Wu 吳金國
Extend wait_for_completion_timeout from 300ms to 700ms to ensure sufficient time for device reset after firmware update. Signed-off-by: Jingle Wu <jingle.wu@emc.com.tw> Link: https://patch.msgid.link/KL1PR01MB5116031986614B3214EF2F30DC2C2@KL1PR01MB5116.apcprd01.prod.exchangelabs.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-23Input: elan_i2c - add ic type 0x19Jingle Wu 吳金國
The 0x19 is valid 3000 serial ic type too. Signed-off-by: Jingle Wu <jingle.wu@emc.com.tw> Link: https://patch.msgid.link/KL1PR01MB511699853D1B66D137C06806DC2C2@KL1PR01MB5116.apcprd01.prod.exchangelabs.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-22Merge tag 'input-for-v7.1-rc0' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - a new charlieplex GPIO keypad driver - an update to aw86927 driver to support 86938 chip - an update for Chrome OS EC keyboard driver to support Fn-<key> keymap extension - an UAF fix in debugfs teardown in EDT touchscreen driver - a number of conversions for input drivers to use guard() and __free() cleanup primitives - several drivers for bus mice (inport, logibm) and other very old devices have been removed - OLPC HGPK PS/2 protocol has been removed as it's been broken and inactive for 10 something years - dedicated kpsmoused has been removed from psmouse driver - other assorted cleanups and fixups * tag 'input-for-v7.1-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (101 commits) Input: charlieplex_keypad - add GPIO charlieplex keypad dt-bindings: input: add GPIO charlieplex keypad dt-bindings: input: add settling-time-us common property dt-bindings: input: add debounce-delay-ms common property Input: imx_keypad - fix spelling mistake "Colums" -> "Columns" Input: edt-ft5x06 - fix use-after-free in debugfs teardown Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Input: ct82c710 - remove driver Input: mk712 - remove driver Input: logibm - remove driver Input: inport - remove driver Input: qt1070 - inline i2c_check_functionality check Input: qt1050 - inline i2c_check_functionality check Input: aiptek - validate raw macro indices before updating state Input: gf2k - skip invalid hat lookup values Input: xpad - add RedOctane Games vendor id Input: xpad - remove stale TODO and changelog header Input: usbtouchscreen - refactor endpoint lookup Input: aw86927 - add support for Awinic AW86938 dt-bindings: input: awinic,aw86927: Add Awinic AW86938 ...
generated by cgit v1.2.3 (git 2.25.1) at 2026-07-20 14:20:20 +0000