Merge tag 'hid-for-linus-2024081901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

Pull HID fixes from Jiri Kosina:

- memory corruption fixes for hid-cougar (Camila Alvarez) and
hid-amd_sfh (Olivier Sobrie)

- fix for regression in Wacom driver of twist gesture handling (Jason
Gerecke)

- two new device IDs for hid-multitouch (Dmitry Savin) and hid-asus
(Luke D. Jones)

* tag 'hid-for-linus-2024081901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
HID: wacom: Defer calculation of resolution until resolution_code is known
HID: multitouch: Add support for GT7868Q
HID: amd_sfh: free driver_data after destroying hid device
hid-asus: add ROG Ally X prod ID to quirk list
HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup

Linus Torvalds 2 years ago 6e443653 b0da6408

+46 -3

6 changed files

expand all

drivers

hid

amd-sfh-hid

amd_sfh_hid.c

hid-asus.c

hid-cougar.c

hid-ids.h

hid-multitouch.c

wacom_wac.c

+3 -1

drivers/hid/amd-sfh-hid/amd_sfh_hid.c

··· 171 171 void amdtp_hid_remove(struct amdtp_cl_data *cli_data) 172 172 { 173 173 int i; 174 + struct amdtp_hid_data *hid_data; 174 175 175 176 for (i = 0; i < cli_data->num_hid_devices; ++i) { 176 177 if (cli_data->hid_sensor_hubs[i]) { 177 - kfree(cli_data->hid_sensor_hubs[i]->driver_data); 178 + hid_data = cli_data->hid_sensor_hubs[i]->driver_data; 178 179 hid_destroy_device(cli_data->hid_sensor_hubs[i]); 180 + kfree(hid_data); 179 181 cli_data->hid_sensor_hubs[i] = NULL; 180 182 } 181 183 }

drivers/hid/hid-asus.c

··· 1249 1249 USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY), 1250 1250 QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, 1251 1251 { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, 1252 + USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X), 1253 + QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, 1254 + { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, 1252 1255 USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD), 1253 1256 QUIRK_ROG_CLAYMORE_II_KEYBOARD }, 1254 1257 { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,

+1 -1

drivers/hid/hid-cougar.c

··· 106 106 static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, 107 107 unsigned int *rsize) 108 108 { 109 - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && 109 + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && 110 110 (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { 111 111 hid_info(hdev, 112 112 "usage count exceeds max: fixing up report descriptor\n");

drivers/hid/hid-ids.h

··· 210 210 #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3 0x1a30 211 211 #define USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR 0x18c6 212 212 #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY 0x1abe 213 + #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X 0x1b4c 213 214 #define USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD 0x196b 214 215 #define USB_DEVICE_ID_ASUSTEK_FX503VD_KEYBOARD 0x1869 215 216 ··· 521 520 #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100 522 521 523 522 #define I2C_VENDOR_ID_GOODIX 0x27c6 523 + #define I2C_DEVICE_ID_GOODIX_01E8 0x01e8 524 + #define I2C_DEVICE_ID_GOODIX_01E9 0x01e9 524 525 #define I2C_DEVICE_ID_GOODIX_01F0 0x01f0 525 526 526 527 #define USB_VENDOR_ID_GOODTOUCH 0x1aad

+33

drivers/hid/hid-multitouch.c

··· 1441 1441 return 0; 1442 1442 } 1443 1443 1444 + static __u8 *mt_report_fixup(struct hid_device *hdev, __u8 *rdesc, 1445 + unsigned int *size) 1446 + { 1447 + if (hdev->vendor == I2C_VENDOR_ID_GOODIX && 1448 + (hdev->product == I2C_DEVICE_ID_GOODIX_01E8 || 1449 + hdev->product == I2C_DEVICE_ID_GOODIX_01E9)) { 1450 + if (rdesc[607] == 0x15) { 1451 + rdesc[607] = 0x25; 1452 + dev_info( 1453 + &hdev->dev, 1454 + "GT7868Q report descriptor fixup is applied.\n"); 1455 + } else { 1456 + dev_info( 1457 + &hdev->dev, 1458 + "The byte is not expected for fixing the report descriptor. \ 1459 + It's possible that the touchpad firmware is not suitable for applying the fix. \ 1460 + got: %x\n", 1461 + rdesc[607]); 1462 + } 1463 + } 1464 + 1465 + return rdesc; 1466 + } 1467 + 1444 1468 static void mt_report(struct hid_device *hid, struct hid_report *report) 1445 1469 { 1446 1470 struct mt_device *td = hid_get_drvdata(hid); ··· 2059 2035 MT_BT_DEVICE(USB_VENDOR_ID_FRUCTEL, 2060 2036 USB_DEVICE_ID_GAMETEL_MT_MODE) }, 2061 2037 2038 + /* Goodix GT7868Q devices */ 2039 + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, 2040 + HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, 2041 + I2C_DEVICE_ID_GOODIX_01E8) }, 2042 + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, 2043 + HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, 2044 + I2C_DEVICE_ID_GOODIX_01E8) }, 2045 + 2062 2046 /* GoodTouch panels */ 2063 2047 { .driver_data = MT_CLS_NSMU, 2064 2048 MT_USB_DEVICE(USB_VENDOR_ID_GOODTOUCH, ··· 2302 2270 .feature_mapping = mt_feature_mapping, 2303 2271 .usage_table = mt_grabbed_usages, 2304 2272 .event = mt_event, 2273 + .report_fixup = mt_report_fixup, 2305 2274 .report = mt_report, 2306 2275 .suspend = pm_ptr(mt_suspend), 2307 2276 .reset_resume = pm_ptr(mt_reset_resume),

+3 -1

drivers/hid/wacom_wac.c

··· 1878 1878 int fmax = field->logical_maximum; 1879 1879 unsigned int equivalent_usage = wacom_equivalent_usage(usage->hid); 1880 1880 int resolution_code = code; 1881 - int resolution = hidinput_calc_abs_res(field, resolution_code); 1881 + int resolution; 1882 1882 1883 1883 if (equivalent_usage == HID_DG_TWIST) { 1884 1884 resolution_code = ABS_RZ; 1885 1885 } 1886 + 1887 + resolution = hidinput_calc_abs_res(field, resolution_code); 1886 1888 1887 1889 if (equivalent_usage == HID_GD_X) { 1888 1890 fmin += features->offset_left;