Commit 48976c0e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'hid-for-linus-2026030601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid 

Pull HID fixes from Benjamin Tissoires:

 - fix a few memory leaks (Günther Noack)

 - fix potential kernel crashes in cmedia, creative-sb0540 and zydacron
   (Greg Kroah-Hartman)

 - fix NULL pointer dereference in pidff (Tomasz Pakuła)

 - fix battery reporting for Apple Magic Trackpad 2 (Julius Lehmann)

 - mcp2221 proper handling of failed read operation (Romain Sioen)

 - various device quirks / device ID additions

* tag 'hid-for-linus-2026030601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: mcp2221: cancel last I2C command on read error
  HID: asus: add xg mobile 2023 external hardware support
  HID: multitouch: Keep latency normal on deactivate for reactivation gesture
  HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list
  HID: intel-ish-hid: ipc: Add Nova Lake-H/S PCI device IDs
  selftests: hid: tests: test_wacom_generic: add tests for display devices and opaque devices
  HID: multitouch: new class MT_CLS_EGALAX_P80H84
  HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
  HID: pidff: Fix condition effect bit clearing
  HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
  HID: asus: avoid memory leak in asus_report_fixup()
  HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
  HID: apple: avoid memory leak in apple_report_fixup()
  HID: Document memory allocation properties of report_fixup()
parents 54de8b83 e31b556c

drivers/hid/hid-apple.c

+4 −3
Original line number Diff line number Diff line
@@ -365,6 +365,9 @@ static const struct apple_non_apple_keyboard non_apple_keyboards[] = { 
	{ "A3R" },

	{ "hfd.cn" },

	{ "WKB603" },

	{ "TH87" },			/* EPOMAKER TH87 BT mode */

	{ "HFD Epomaker TH87" },	/* EPOMAKER TH87 USB mode */

	{ "2.4G Wireless Receiver" },	/* EPOMAKER TH87 dongle */

};



static bool apple_is_non_apple_keyboard(struct hid_device *hdev)
@@ -686,9 +689,7 @@ static const __u8 *apple_report_fixup(struct hid_device *hdev, __u8 *rdesc, 
		hid_info(hdev,

			 "fixing up Magic Keyboard battery report descriptor\n");

		*rsize = *rsize - 1;

		rdesc = kmemdup(rdesc + 1, *rsize, GFP_KERNEL);

		if (!rdesc)

			return NULL;

		rdesc = rdesc + 1;



		rdesc[0] = 0x05;

		rdesc[1] = 0x01;

drivers/hid/hid-asus.c

+14 −4
Original line number Diff line number Diff line
@@ -1399,14 +1399,21 @@ static const __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc, 
		 */

		if (*rsize == rsize_orig &&

			rdesc[offs] == 0x09 && rdesc[offs + 1] == 0x76) {

			*rsize = rsize_orig + 1;

			rdesc = kmemdup(rdesc, *rsize, GFP_KERNEL);

			if (!rdesc)

				return NULL;

			__u8 *new_rdesc;



			new_rdesc = devm_kzalloc(&hdev->dev, rsize_orig + 1,

						 GFP_KERNEL);

			if (!new_rdesc)

				return rdesc;



			hid_info(hdev, "Fixing up %s keyb report descriptor\n",

				drvdata->quirks & QUIRK_T100CHI ?

				"T100CHI" : "T90CHI");



			memcpy(new_rdesc, rdesc, rsize_orig);

			*rsize = rsize_orig + 1;

			rdesc = new_rdesc;



			memmove(rdesc + offs + 4, rdesc + offs + 2, 12);

			rdesc[offs] = 0x19;

			rdesc[offs + 1] = 0x00;
@@ -1490,6 +1497,9 @@ static const struct hid_device_id asus_devices[] = { 
	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,

	    USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X),

	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD | QUIRK_ROG_ALLY_XPAD },

	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,

	    USB_DEVICE_ID_ASUSTEK_XGM_2023),

	},

	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,

	    USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD),

	  QUIRK_ROG_CLAYMORE_II_KEYBOARD },

drivers/hid/hid-cmedia.c

+1 −1
Original line number Diff line number Diff line
@@ -99,7 +99,7 @@ static int cmhid_raw_event(struct hid_device *hid, struct hid_report *report, 
{

	struct cmhid *cm = hid_get_drvdata(hid);



	if (len != CM6533_JD_RAWEV_LEN)

	if (len != CM6533_JD_RAWEV_LEN || !(hid->claimed & HID_CLAIMED_INPUT))

		goto out;

	if (memcmp(data+CM6533_JD_SFX_OFFSET, ji_sfx, sizeof(ji_sfx)))

		goto out;

drivers/hid/hid-creative-sb0540.c

+1 −1
Original line number Diff line number Diff line
@@ -153,7 +153,7 @@ static int creative_sb0540_raw_event(struct hid_device *hid, 
	u64 code, main_code;

	int key;



	if (len != 6)

	if (len != 6 || !(hid->claimed & HID_CLAIMED_INPUT))

		return 0;



	/* From daemons/hw_hiddev.c sb0540_rec() in lirc */

drivers/hid/hid-ids.h

+1 −0
Original line number Diff line number Diff line
@@ -229,6 +229,7 @@ 
#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X		0x1b4c

#define USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD	0x196b

#define USB_DEVICE_ID_ASUSTEK_FX503VD_KEYBOARD	0x1869

#define USB_DEVICE_ID_ASUSTEK_XGM_2023	0x1a9a



#define USB_VENDOR_ID_ATEN		0x0557

#define USB_DEVICE_ID_ATEN_UC100KM	0x2004