Commit fe661d01 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'hid-for-linus-2025051501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid 

Pull HID fixes from Benjamin Tissoires:

 - fix a few potential memory leaks in the wacom driver (Qasim Ijaz)

 - AMD SFH fixes when there is only one SRA sensor (Mario Limonciello)

 - HID-BPF dispatch UAF fix that happens on removal of the Logitech DJ
   receiver (Rong Zhang)

 - various minor fixes and usual device ID additions

* tag 'hid-for-linus-2025051501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: bpf: abort dispatch if device destroyed
  HID: quirks: Add ADATA XPG alpha wireless mouse support
  HID: hid-steam: Remove the unused variable connected
  HID: amd_sfh: Avoid clearing reports for SRA sensor
  HID: amd_sfh: Fix SRA sensor when it's the only sensor
  HID: wacom: fix shift OOB in kfifo allocation for zero pktlen
  HID: uclogic: Add NULL check in uclogic_input_configured()
  HID: wacom: fix memory leak on size mismatch in wacom_wac_queue_flush()
  HID: wacom: handle kzalloc() allocation failure in wacom_wac_queue_flush()
  HID: thrustmaster: fix memory leak in thrustmaster_interrupts()
  HID: hid-appletb-kbd: Fix wrong date and kernel version in sysfs interface docs
  HID: bpf: fix BTN_STYLUS for the XP Pen ACK05 remote
parents ef935650 578e1b96

Documentation/ABI/testing/sysfs-driver-hid-appletb-kbd

+2 −2
Original line number Diff line number Diff line 
What:		/sys/bus/hid/drivers/hid-appletb-kbd/<dev>/mode

Date:		September, 2023

KernelVersion:	6.5

Date:		March, 2025

KernelVersion:	6.15

Contact:	linux-input@vger.kernel.org

Description:

		The set of keys displayed on the Touch Bar.

drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c

+8 −4
Original line number Diff line number Diff line
@@ -83,6 +83,9 @@ static int amd_sfh_hid_client_deinit(struct amd_mp2_dev *privdata) 
		case ALS_IDX:

			privdata->dev_en.is_als_present = false;

			break;

		case SRA_IDX:

			privdata->dev_en.is_sra_present = false;

			break;

		}



		if (cl_data->sensor_sts[i] == SENSOR_ENABLED) {
@@ -134,9 +137,6 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata) 
	for (i = 0; i < cl_data->num_hid_devices; i++) {

		cl_data->sensor_sts[i] = SENSOR_DISABLED;



		if (cl_data->num_hid_devices == 1 && cl_data->sensor_idx[0] == SRA_IDX)

			break;



		if (cl_data->sensor_idx[i] == SRA_IDX) {

			info.sensor_idx = cl_data->sensor_idx[i];

			writel(0, privdata->mmio + amd_get_p2c_val(privdata, 0));
@@ -145,8 +145,10 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata) 
				(privdata, cl_data->sensor_idx[i], ENABLE_SENSOR);



			cl_data->sensor_sts[i] = (status == 0) ? SENSOR_ENABLED : SENSOR_DISABLED;

			if (cl_data->sensor_sts[i] == SENSOR_ENABLED)

			if (cl_data->sensor_sts[i] == SENSOR_ENABLED) {

				cl_data->is_any_sensor_enabled = true;

				privdata->dev_en.is_sra_present = true;

			}

			continue;

		}
@@ -238,6 +240,8 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata) 
cleanup:

	amd_sfh_hid_client_deinit(privdata);

	for (i = 0; i < cl_data->num_hid_devices; i++) {

		if (cl_data->sensor_idx[i] == SRA_IDX)

			continue;

		devm_kfree(dev, cl_data->feature_report[i]);

		devm_kfree(dev, in_data->input_report[i]);

		devm_kfree(dev, cl_data->report_descr[i]);

drivers/hid/bpf/hid_bpf_dispatch.c

+9 −0
Original line number Diff line number Diff line
@@ -38,6 +38,9 @@ dispatch_hid_bpf_device_event(struct hid_device *hdev, enum hid_report_type type 
	struct hid_bpf_ops *e;

	int ret;



	if (unlikely(hdev->bpf.destroyed))

		return ERR_PTR(-ENODEV);



	if (type >= HID_REPORT_TYPES)

		return ERR_PTR(-EINVAL);
@@ -93,6 +96,9 @@ int dispatch_hid_bpf_raw_requests(struct hid_device *hdev, 
	struct hid_bpf_ops *e;

	int ret, idx;



	if (unlikely(hdev->bpf.destroyed))

		return -ENODEV;



	if (rtype >= HID_REPORT_TYPES)

		return -EINVAL;
@@ -130,6 +136,9 @@ int dispatch_hid_bpf_output_report(struct hid_device *hdev, 
	struct hid_bpf_ops *e;

	int ret, idx;



	if (unlikely(hdev->bpf.destroyed))

		return -ENODEV;



	idx = srcu_read_lock(&hdev->bpf.srcu);

	list_for_each_entry_srcu(e, &hdev->bpf.prog_list, list,

				 srcu_read_lock_held(&hdev->bpf.srcu)) {

drivers/hid/bpf/progs/XPPen__ACK05.bpf.c

+1 −0
Original line number Diff line number Diff line
@@ -157,6 +157,7 @@ static const __u8 fixed_rdesc_vendor[] = { 
			ReportCount(5) // padding

			Input(Const)

			// Byte 4 in report - just exists so we get to be a tablet pad

			UsagePage_Digitizers

			Usage_Dig_BarrelSwitch // BTN_STYLUS

			ReportCount(1)

			ReportSize(1)

drivers/hid/hid-ids.h

+4 −0
Original line number Diff line number Diff line
@@ -41,6 +41,10 @@ 
#define USB_VENDOR_ID_ACTIONSTAR	0x2101

#define USB_DEVICE_ID_ACTIONSTAR_1011	0x1011



#define USB_VENDOR_ID_ADATA_XPG 0x125f

#define USB_VENDOR_ID_ADATA_XPG_WL_GAMING_MOUSE 0x7505

#define USB_VENDOR_ID_ADATA_XPG_WL_GAMING_MOUSE_DONGLE 0x7506



#define USB_VENDOR_ID_ADS_TECH		0x06e1

#define USB_DEVICE_ID_ADS_TECH_RADIO_SI470X	0xa155