Commit 6b3e4588 authored Feb 19, 2026 by Günther Noack Committed by Benjamin Tissoires Feb 19, 2026

HID: Document memory allocation properties of report_fixup()



The memory pointer returned by the report_fixup() hook does not get
freed by the caller.  Instead, report_fixup() must return (in return
value and *rsize) a memory buffer with at least the same lifetime as
the input buffer (defined by rdesc and original *rsize).

This is usually achieved using one of the following techniques:

* Returning a pointer and size to a sub-portion of the input buffer
* Returning a pointer to a static buffer
* Allocating a buffer with a devm_*() function,
  which will automatically get freed when the device is removed.

Signed-off-by: Günther Noack <gnoack@google.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

parent f50822fd

include/linux/hid.h

+6 −0

Original line number	Diff line number	Diff line
		@@ -836,6 +836,12 @@ struct hid_usage_id {
		* raw_event and event should return negative on error, any other value will
		* pass the event on to .event() typically return 0 for success.
		*
		* report_fixup must return a report descriptor pointer whose lifetime is at
		* least that of the input rdesc. This is usually done by mutating the input
		* rdesc and returning it or a sub-portion of it. In case a new buffer is
		* allocated and returned, the implementation of report_fixup is responsible for
		* freeing it later.
		*
		* input_mapping shall return a negative value to completely ignore this usage
		* (e.g. doubled or invalid usage), zero to continue with parsing of this
		* usage by generic code (no special handling needed) or positive to skip