Commit f0caa1d4 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'hid-for-linus-2026031701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid 

Pull HID fixes from Jiri Kosina:

 - various fixes dealing with (intentionally) broken devices in HID
   core, logitech-hidpp and multitouch drivers (Lee Jones)

 - fix for OOB in wacom driver (Benoît Sevens)

 - fix for potentialy HID-bpf-induced buffer overflow in () (Benjamin
   Tissoires)

 - various other small fixes and device ID / quirk additions

* tag 'hid-for-linus-2026031701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: multitouch: Check to ensure report responses match the request
  HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
  HID: bpf: prevent buffer overflow in hid_hw_request
  selftests/hid: fix compilation when bpf_wq and hid_device are not exported
  HID: core: Mitigate potential OOB by removing bogus memset()
  HID: intel-thc-hid: Set HID_PHYS with PCI BDF
  HID: appletb-kbd: add .resume method in PM
  HID: logitech-hidpp: Enable MX Master 4 over bluetooth
  HID: input: Add HID_BATTERY_QUIRK_DYNAMIC for Elan touchscreens
  HID: input: Drop Asus UX550* touchscreen ignore battery quirks
  HID: asus: add xg mobile 2022 external hardware support
  HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
parents 8a91ebb3 e716edaf

drivers/hid/bpf/hid_bpf_dispatch.c

+2 −0
Original line number Diff line number Diff line
@@ -444,6 +444,8 @@ hid_bpf_hw_request(struct hid_bpf_ctx *ctx, __u8 *buf, size_t buf__sz, 
					      (u64)(long)ctx,

					      true); /* prevent infinite recursions */



	if (ret > size)

		ret = size;

	if (ret > 0)

		memcpy(buf, dma_data, ret);

drivers/hid/hid-appletb-kbd.c

+3 −2
Original line number Diff line number Diff line
@@ -476,7 +476,7 @@ static int appletb_kbd_suspend(struct hid_device *hdev, pm_message_t msg) 
	return 0;

}



static int appletb_kbd_reset_resume(struct hid_device *hdev)

static int appletb_kbd_resume(struct hid_device *hdev)

{

	struct appletb_kbd *kbd = hid_get_drvdata(hdev);
@@ -500,7 +500,8 @@ static struct hid_driver appletb_kbd_hid_driver = { 
	.event = appletb_kbd_hid_event,

	.input_configured = appletb_kbd_input_configured,

	.suspend = pm_ptr(appletb_kbd_suspend),

	.reset_resume = pm_ptr(appletb_kbd_reset_resume),

	.resume = pm_ptr(appletb_kbd_resume),

	.reset_resume = pm_ptr(appletb_kbd_resume),

	.driver.dev_groups = appletb_kbd_groups,

};

module_hid_driver(appletb_kbd_hid_driver);

drivers/hid/hid-asus.c

+3 −0
Original line number Diff line number Diff line
@@ -1497,6 +1497,9 @@ static const struct hid_device_id asus_devices[] = { 
	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,

	    USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X),

	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD | QUIRK_ROG_ALLY_XPAD },

	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,

	    USB_DEVICE_ID_ASUSTEK_XGM_2022),

	},

	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,

	    USB_DEVICE_ID_ASUSTEK_XGM_2023),

	},

drivers/hid/hid-core.c

+4 −3
Original line number Diff line number Diff line
@@ -2057,9 +2057,10 @@ int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 * 
		rsize = max_buffer_size;



	if (csize < rsize) {

		dbg_hid("report %d is too short, (%d < %d)\n", report->id,

				csize, rsize);

		memset(cdata + csize, 0, rsize - csize);

		hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %d)\n",

				     report->id, rsize, csize);

		ret = -EINVAL;

		goto out;

	}



	if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)

drivers/hid/hid-ids.h

+1 −2
Original line number Diff line number Diff line
@@ -229,6 +229,7 @@ 
#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X		0x1b4c

#define USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD	0x196b

#define USB_DEVICE_ID_ASUSTEK_FX503VD_KEYBOARD	0x1869

#define USB_DEVICE_ID_ASUSTEK_XGM_2022	0x1970

#define USB_DEVICE_ID_ASUSTEK_XGM_2023	0x1a9a



#define USB_VENDOR_ID_ATEN		0x0557
@@ -454,8 +455,6 @@ 
#define USB_DEVICE_ID_TOSHIBA_CLICK_L9W	0x0401

#define USB_DEVICE_ID_HP_X2		0x074d

#define USB_DEVICE_ID_HP_X2_10_COVER	0x0755

#define USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN	0x2544

#define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN	0x2706

#define I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM	0x2F81



#define USB_VENDOR_ID_ELECOM		0x056e