Commit 02d6eeed authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'hid-for-linus-2025082901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid 

Pull HID fixes from Jiri Kosina:

 - fixes for memory corruption in intel-thc-hid, hid-multitouch,
   hid-mcp2221 and hid-asus (Aaron Ma, Qasim Ijaz, Arnaud Lecomte)

 - power management/resume fix for intel-ish-hid (Zhang Lixu)

 - driver reinitialization fix for intel-thc-hid (Even Xu)

 - ensure that battery level status is reported as soon as possible,
   which is required at least for some Android use-cases (José Expósito)

 - quite a few new device ID additions and device-specific quirks

* tag 'hid-for-linus-2025082901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: quirks: add support for Legion Go dual dinput modes
  HID: elecom: add support for ELECOM M-DT2DRBK
  HID: logitech: Add ids for G PRO 2 LIGHTSPEED
  HID: input: report battery status changes immediately
  HID: input: rename hidinput_set_battery_charge_status()
  HID: intel-thc-hid: Intel-quicki2c: Enhance driver re-install flow
  HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
  HID: asus: fix UAF via HID_CLAIMED_INPUT validation
  hid: fix I2C read buffer overflow in raw_event() for mcp2221
  HID: wacom: Add a new Art Pen 2
  HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
  HID: Kconfig: Fix spelling mistake "enthropy" -> "entropy"
  HID: intel-ish-hid: Increase ISHTP resume ack timeout to 300ms
  HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
  HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length
parents ec1abfc8 1f3214aa

drivers/hid/Kconfig

+1 −1
Original line number Diff line number Diff line
@@ -1243,7 +1243,7 @@ config HID_U2FZERO 


	  U2F Zero supports custom commands for blinking the LED

	  and getting data from the internal hardware RNG.

	  The internal hardware can be used to feed the enthropy pool.

	  The internal hardware can be used to feed the entropy pool.



	  U2F Zero only supports blinking its LED, so this driver doesn't

	  allow setting the brightness to anything but 1, which will

drivers/hid/hid-asus.c

+7 −1
Original line number Diff line number Diff line
@@ -1213,7 +1213,13 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id) 
		return ret;

	}



	if (!drvdata->input) {

	/*

	 * Check that input registration succeeded. Checking that

	 * HID_CLAIMED_INPUT is set prevents a UAF when all input devices

	 * were freed during registration due to no usages being mapped,

	 * leaving drvdata->input pointing to freed memory.

	 */

	if (!drvdata->input || !(hdev->claimed & HID_CLAIMED_INPUT)) {

		hid_err(hdev, "Asus input not registered\n");

		ret = -ENOMEM;

		goto err_stop_hw;

drivers/hid/hid-elecom.c

+2 −0
Original line number Diff line number Diff line
@@ -101,6 +101,7 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, 
		 */

		mouse_button_fixup(hdev, rdesc, *rsize, 12, 30, 14, 20, 8);

		break;

	case USB_DEVICE_ID_ELECOM_M_DT2DRBK:

	case USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C:

		/*

		 * Report descriptor format:
@@ -123,6 +124,7 @@ static const struct hid_device_id elecom_devices[] = { 
	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) },

	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },

	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) },

	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT2DRBK) },

	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_010C) },

	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_019B) },

	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },

drivers/hid/hid-ids.h

+4 −0
Original line number Diff line number Diff line
@@ -451,6 +451,7 @@ 
#define USB_DEVICE_ID_ELECOM_M_XT4DRBK	0x00fd

#define USB_DEVICE_ID_ELECOM_M_DT1URBK	0x00fe

#define USB_DEVICE_ID_ELECOM_M_DT1DRBK	0x00ff

#define USB_DEVICE_ID_ELECOM_M_DT2DRBK	0x018d

#define USB_DEVICE_ID_ELECOM_M_HT1URBK_010C	0x010c

#define USB_DEVICE_ID_ELECOM_M_HT1URBK_019B	0x019b

#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D	0x010d
@@ -834,6 +835,8 @@ 
#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019	0x6019

#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_602E	0x602e

#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6093	0x6093

#define USB_DEVICE_ID_LENOVO_LEGION_GO_DUAL_DINPUT	0x6184

#define USB_DEVICE_ID_LENOVO_LEGION_GO2_DUAL_DINPUT	0x61ed



#define USB_VENDOR_ID_LETSKETCH		0x6161

#define USB_DEVICE_ID_WP9620N		0x4d15
@@ -907,6 +910,7 @@ 
#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_2		0xc534

#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1	0xc539

#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_1	0xc53f

#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_2	0xc543

#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_POWERPLAY	0xc53a

#define USB_DEVICE_ID_LOGITECH_BOLT_RECEIVER	0xc548

#define USB_DEVICE_ID_SPACETRAVELLER	0xc623

drivers/hid/hid-input-test.c

+5 −5
Original line number Diff line number Diff line
@@ -7,7 +7,7 @@ 


#include <kunit/test.h>



static void hid_test_input_set_battery_charge_status(struct kunit *test)

static void hid_test_input_update_battery_charge_status(struct kunit *test)

{

	struct hid_device *dev;

	bool handled;
@@ -15,15 +15,15 @@ static void hid_test_input_set_battery_charge_status(struct kunit *test) 
	dev = kunit_kzalloc(test, sizeof(*dev), GFP_KERNEL);

	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev);



	handled = hidinput_set_battery_charge_status(dev, HID_DG_HEIGHT, 0);

	handled = hidinput_update_battery_charge_status(dev, HID_DG_HEIGHT, 0);

	KUNIT_EXPECT_FALSE(test, handled);

	KUNIT_EXPECT_EQ(test, dev->battery_charge_status, POWER_SUPPLY_STATUS_UNKNOWN);



	handled = hidinput_set_battery_charge_status(dev, HID_BAT_CHARGING, 0);

	handled = hidinput_update_battery_charge_status(dev, HID_BAT_CHARGING, 0);

	KUNIT_EXPECT_TRUE(test, handled);

	KUNIT_EXPECT_EQ(test, dev->battery_charge_status, POWER_SUPPLY_STATUS_DISCHARGING);



	handled = hidinput_set_battery_charge_status(dev, HID_BAT_CHARGING, 1);

	handled = hidinput_update_battery_charge_status(dev, HID_BAT_CHARGING, 1);

	KUNIT_EXPECT_TRUE(test, handled);

	KUNIT_EXPECT_EQ(test, dev->battery_charge_status, POWER_SUPPLY_STATUS_CHARGING);

}
@@ -63,7 +63,7 @@ static void hid_test_input_get_battery_property(struct kunit *test) 
}



static struct kunit_case hid_input_tests[] = {

	KUNIT_CASE(hid_test_input_set_battery_charge_status),

	KUNIT_CASE(hid_test_input_update_battery_charge_status),

	KUNIT_CASE(hid_test_input_get_battery_property),

	{ }

};