github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Input updates for v7.3-rc3

Browse Source 
- Fixes for evdev and input compat handling to zero-initialize on-stack
   absinfo and force-feedback effect structures before partial or compat
   copies from userspace, preventing kernel stack memory disclosure
 
 - Fixes for the Synaptics RMI4 driver to prevent an out-of-bounds read
   when writing multi-chunk blocks over SMBus and to avoid a NULL pointer
   dereference during suspend/resume when the RMI device is unbound
 
 - Fixes for the soc_button_array driver to propagate -EPROBE_DEFER on
   non-Bay Trail/Cherry Trail platforms (fixing broken power and volume
   buttons on the Microsoft Surface Pro 11) and to validate the ACPI
   package element count before dereferencing
 
 - A fix for the adp5588-keys driver to cache the initial GPIO hardware
   state before registering the gpiochip so pre-configured pin states are
   not clobbered by GPIO hogs during registration
 
 - A fix for the cyttsp5 touchscreen driver to clamp the device-supplied
   HID report size before copying into the response buffer, preventing a
   buffer overflow
 
 - A fix for the HP SDC serio driver to use timer_shutdown_sync() on
   module exit so the periodic kicker timer cannot rearm itself during
   teardown
 
 - A fix for the eeti_ts touchscreen driver to export its OF module alias
   so the module autoloads on Device Tree platforms
 
 - Updates to the xpad joystick driver adding support for the Victrix Pro
   BFG controller and Azeron devices, and fixing the device type
   classification for the PDP Marvel Xbox 360 controller
 
 - Quirks for the i8042 and atkbd drivers to keep the built-in keyboards
   functional on the Acer Aspire Go 15 AG15-42P and Xiaomi Redmi Book Pro
   16 2026
 
 - A quirk for the Synaptics PS/2 touchpad driver disabling SMBus
   InterTouch on the Lenovo ThinkPad T440p (board ID 2722) so the
   touchpad and TrackPoint respond immediately at boot
 
 - Other minor updates and documentation fixes, including reading the
   "ti,poll-period" property as u32 in tsc2007, adding the mt6572
   compatible to the MediaTek keypad Device Tree binding, fixing an
   attribute name typo in the trackpoint sysfs ABI documentation, and
   documenting that no new LED codes should be added to the input
   subsystem.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCaq9j+gAKCRBAj56VGEWX
 nJ5KAQDnTOivIghgIGnlKTIYLSV4cJ0fWJh7J1/ubx9soK+9RwD/bDUdyryAaSTr
 x95U7/fEvq/lXBFyK2LXyahuTC6vNQY=
 =Vsfi
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:

 - Fixes for evdev and input compat handling to zero-initialize on-stack
   absinfo and force-feedback effect structures before partial or compat
   copies from userspace, preventing kernel stack memory disclosure

 - Fixes for the Synaptics RMI4 driver to prevent an out-of-bounds read
   when writing multi-chunk blocks over SMBus and to avoid a NULL
   pointer dereference during suspend/resume when the RMI device is
   unbound

 - Fixes for the soc_button_array driver to propagate -EPROBE_DEFER on
   non-Bay Trail/Cherry Trail platforms (fixing broken power and volume
   buttons on the Microsoft Surface Pro 11) and to validate the ACPI
   package element count before dereferencing

 - A fix for the adp5588-keys driver to cache the initial GPIO hardware
   state before registering the gpiochip so pre-configured pin states
   are not clobbered by GPIO hogs during registration

 - A fix for the cyttsp5 touchscreen driver to clamp the device-supplied
   HID report size before copying into the response buffer, preventing a
   buffer overflow

 - A fix for the HP SDC serio driver to use timer_shutdown_sync() on
   module exit so the periodic kicker timer cannot rearm itself during
   teardown

 - A fix for the eeti_ts touchscreen driver to export its OF module
   alias so the module autoloads on Device Tree platforms

 - Updates to the xpad joystick driver adding support for the Victrix
   Pro BFG controller and Azeron devices, and fixing the device type
   classification for the PDP Marvel Xbox 360 controller

 - Quirks for the i8042 and atkbd drivers to keep the built-in keyboards
   functional on the Acer Aspire Go 15 AG15-42P and Xiaomi Redmi Book
   Pro 16 2026

 - A quirk for the Synaptics PS/2 touchpad driver disabling SMBus
   InterTouch on the Lenovo ThinkPad T440p (board ID 2722) so the
   touchpad and TrackPoint respond immediately at boot

 - Other minor updates and documentation fixes, including reading the
   "ti,poll-period" property as u32 in tsc2007, adding the mt6572
   compatible to the MediaTek keypad Device Tree binding, fixing an
   attribute name typo in the trackpoint sysfs ABI documentation, and
   documenting that no new LED codes should be added to the input
   subsystem

* tag 'input-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: hp_sdc - shut down kicker timer on module exit
  Input: xpad - add support for Victrix Pro BFG Controller
  Input: tsc2007 - read "ti,poll-period" as u32
  Input: trackpoint - fix the inertia attribute name in the ABI document
  Input: eeti_ts - publish the OF module alias
  Input: xpad - add support for Azeron devices
  Input: xpad - fix PDP Marvel Xbox 360 controller
  Input: document that no new LED codes should be added
  Input: soc_button_array - check btns_desc->package.count
  Input: soc_button_array - fix MS Surface Pro 11 probe failure
  Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
  Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
  Input: cyttsp5 - clamp the HID report size before memcpy
  Input: zero ff_effect before compat copy in input_ff_effect_from_user
  Input: evdev - zero absinfo before partial copy in EVIOCSABS
  Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
  Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
  Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
  dt-bindings: input: mediatek,mt6779-keypad: add mt6572
  Input: adp5588-keys - cache GPIO state before registering the gpiochip
This commit is contained in:
Linus Torvalds 2026-09-20 07:02:34 -07:00
commit b12dd0fa48
17 changed files with 85 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Documentation/ABI/testing/sysfs-devices-platform-trackpoint
View File

@ -5,7 +5,7 @@ Contact: linux-input@vger.kernel.org
Description:
(RW) Trackpoint sensitivity.
What: /sys/devices/platform/i8042/.../intertia
What: /sys/devices/platform/i8042/.../inertia
Date: Aug, 2005
KernelVersion: 2.6.14
Contact: linux-input@vger.kernel.org

1
Documentation/devicetree/bindings/input/mediatek,mt6779-keypad.yaml
View File

@ -26,6 +26,7 @@ properties:
- const: mediatek,mt6779-keypad
- items:
- enum:
- mediatek,mt6572-keypad
- mediatek,mt6873-keypad
- mediatek,mt8183-keypad
- mediatek,mt8365-keypad

2
drivers/input/evdev.c
View File

@ -1229,6 +1229,8 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
t = _IOC_NR(cmd) & ABS_MAX;
memset(&abs, 0, sizeof(abs));
if (copy_from_user(&abs, p, min_t(size_t,
size, sizeof(struct input_absinfo))))
return -EFAULT;

2
drivers/input/input-compat.c
View File

@ -76,6 +76,8 @@ int input_ff_effect_from_user(const char __user *buffer, size_t size,
*/
compat_effect = (struct ff_effect_compat *)effect;
memset(effect, 0, sizeof(*effect));
if (copy_from_user(compat_effect, buffer,
sizeof(struct ff_effect_compat)))
return -EFAULT;

10
drivers/input/joystick/xpad.c
View File

@ -215,7 +215,7 @@ static const struct xpad_device {
{ 0x0e6f, 0x0139, "Afterglow Prismatic Wired Controller", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x013a, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x0146, "Rock Candy Wired Controller for Xbox One", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x0147, "PDP Marvel Xbox One Controller", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x0147, "PDP Marvel Xbox 360 Controller", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x015c, "PDP Xbox One Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
{ 0x0e6f, 0x015d, "PDP Mirror's Edge Official Wired Controller for Xbox One", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x0161, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
@ -227,6 +227,7 @@ static const struct xpad_device {
{ 0x0e6f, 0x0213, "Afterglow Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x021f, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x0246, "Rock Candy Gamepad for Xbox One 2015", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x024c, "PDP Victrix Pro BFG Wired Controller for Xbox", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x02a0, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x02a1, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x02a2, "PDP Wired Controller for Xbox One - Crimson Red", 0, XTYPE_XBOXONE },
@ -292,6 +293,12 @@ static const struct xpad_device {
{ 0x1689, 0xfd00, "Razer Onza Tournament Edition", 0, XTYPE_XBOX360 },
{ 0x1689, 0xfd01, "Razer Onza Classic Edition", 0, XTYPE_XBOX360 },
{ 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 },
{ 0x16d0, 0x1103, "Azeron Cyro", 0, XTYPE_XBOX360 },
{ 0x16d0, 0x113c, "Azeron Cyborg", 0, XTYPE_XBOX360 },
{ 0x16d0, 0x1192, "Azeron Classic/Compact", 0, XTYPE_XBOX360 },
{ 0x16d0, 0x1212, "Azeron Cyro Lefty", 0, XTYPE_XBOX360 },
{ 0x16d0, 0x12f7, "Azeron Cyborg II", 0, XTYPE_XBOX360 },
{ 0x16d0, 0x13ea, "Azeron Keyzen", 0, XTYPE_XBOX360 },
{ 0x17ef, 0x6182, "Lenovo Legion Controller for Windows", 0, XTYPE_XBOX360 },
{ 0x1949, 0x041a, "Amazon Game Controller", 0, XTYPE_XBOX360 },
{ 0x1a86, 0xe310, "Legion Go S", 0, XTYPE_XBOX360 },
@ -534,6 +541,7 @@ static const struct usb_device_id xpad_table[] = {
XPAD_XBOX360_VENDOR(0x15e4), /* Numark Xbox 360 controllers */
XPAD_XBOX360_VENDOR(0x162e), /* Joytech Xbox 360 controllers */
XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */
XPAD_XBOX360_VENDOR(0x16d0), /* Azeron controllers */
XPAD_XBOX360_VENDOR(0x17ef), /* Lenovo */
XPAD_XBOX360_VENDOR(0x1949), /* Amazon controllers */
XPAD_XBOX360_VENDOR(0x1a86), /* Nanjing Qinheng Microelectronics (WCH) */

12
drivers/input/keyboard/adp5588-keys.c
View File

@ -446,12 +446,6 @@ static int adp5588_gpio_add(struct adp5588_kpad *kpad)
mutex_init(&kpad->gpio_lock);
error = devm_gpiochip_add_data(dev, &kpad->gc, kpad);
if (error) {
dev_err(dev, "gpiochip_add failed: %d\n", error);
return error;
}
for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++) {
kpad->dat_out[i] = adp5588_read(kpad->client,
GPIO_DAT_OUT1 + i);
@ -459,6 +453,12 @@ static int adp5588_gpio_add(struct adp5588_kpad *kpad)
kpad->pull_dis[i] = adp5588_read(kpad->client, GPIO_PULL1 + i);
}
error = devm_gpiochip_add_data(dev, &kpad->gc, kpad);
if (error) {
dev_err(dev, "gpiochip_add failed: %d\n", error);
return error;
}
return 0;
}

8
drivers/input/keyboard/atkbd.c
View File

@ -1946,6 +1946,14 @@ static const struct dmi_system_id atkbd_dmi_quirk_table[] __initconst = {
},
.callback = atkbd_deactivate_fixup,
},
{
/* Xiaomi Redmi Book Pro 16 2026 (TM2425) */
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "XIAOMI"),
DMI_MATCH(DMI_PRODUCT_NAME, "REDMI Book Pro 16 2026"),
},
.callback = atkbd_deactivate_fixup,
},
{ }
};

16
drivers/input/misc/soc_button_array.c
View File

@ -15,6 +15,7 @@
#include <linux/dmi.h>
#include <linux/gpio/consumer.h>
#include <linux/gpio_keys.h>
#include <linux/platform_data/x86/soc.h>
#include <linux/platform_device.h>
static bool use_low_level_irq;
@ -159,7 +160,7 @@ soc_button_device_create(struct platform_device *pdev,
struct gpio_keys_platform_data *gpio_keys_pdata;
const struct dmi_system_id *dmi_id;
int invalid_acpi_index = -1;
int error, gpio, irq;
int error, gpio, irq = 0;
int n_buttons = 0;
for (info = button_info; info->name; info++)
@ -190,8 +191,9 @@ soc_button_device_create(struct platform_device *pdev,
error = soc_button_lookup_gpio(&pdev->dev, info->acpi_index, &gpio, &irq);
if (error || irq < 0) {
/*
* Skip GPIO if not present. Note we deliberately
* ignore -EPROBE_DEFER errors here. On some devices
* Propagate -EPROBE_DEFER, skip button on other errors.
*
* -EPROBE_DEFER is ignored on Bay & Cherry Trail. Here
* Intel is using so called virtual GPIOs which are not
* GPIOs at all but some way for AML code to check some
* random status bits without need a custom opregion.
@ -200,6 +202,12 @@ soc_button_device_create(struct platform_device *pdev,
* we do not have a driver for these so they will never
* show up, therefore we ignore -EPROBE_DEFER.
*/
if ((error == -EPROBE_DEFER || irq == -EPROBE_DEFER) &&
!(soc_intel_is_byt() || soc_intel_is_cht())) {
error = -EPROBE_DEFER;
goto err_free_mem;
}
continue;
}
@ -368,7 +376,7 @@ static struct soc_button_info *soc_button_get_button_info(struct device *dev)
}
}
if (!btns_desc) {
if (!btns_desc || !btns_desc->package.count) {
dev_err(dev, "ACPI Button Descriptors not found\n");
button_info = ERR_PTR(-ENODEV);
goto out;

8
drivers/input/mouse/synaptics.c
View File

@ -1838,6 +1838,14 @@ static int synaptics_setup_intertouch(struct psmouse *psmouse,
return -ENXIO;
}
/* Disable intertouch on known-broken board revisions */
if (info->board_id == 2722) {
psmouse_info(psmouse,
"Disabling intertouch for board id %u\n",
info->board_id);
return -ENXIO;
}
}
psmouse_info(psmouse, "Trying to set up SMBus access\n");

13
drivers/input/rmi4/rmi_driver.c
View File

@ -991,6 +991,15 @@ int rmi_driver_suspend(struct rmi_device *rmi_dev, bool enable_wake)
{
int retval;
/*
* Transport driver will try to suspend RMI device even if physical
* driver did not bind to the RMI device, because transport device
* (I2C, SPI) is fully registered and operational. Exit early if
* there is no driver data attached to the RMI device.
*/
if (!dev_get_drvdata(&rmi_dev->dev))
return 0;
retval = rmi_suspend_functions(rmi_dev);
if (retval)
dev_warn(&rmi_dev->dev, "Failed to suspend functions: %d\n",
@ -1005,6 +1014,10 @@ int rmi_driver_resume(struct rmi_device *rmi_dev, bool clear_wake)
{
int retval;
/* Skip if not fully bound to RMI driver */
if (!dev_get_drvdata(&rmi_dev->dev))
return 0;
rmi_enable_irq(rmi_dev, clear_wake);
retval = rmi_resume_functions(rmi_dev);

10
drivers/input/rmi4/rmi_smbus.c
View File

@ -140,7 +140,7 @@ static int rmi_smb_write_block(struct rmi_transport_dev *xport, u16 rmiaddr,
u8 commandcode;
struct rmi_smb_xport *rmi_smb =
container_of(xport, struct rmi_smb_xport, xport);
int cur_len = (int)len;
size_t cur_len = len;
mutex_lock(&rmi_smb->page_mutex);
@ -148,7 +148,7 @@ static int rmi_smb_write_block(struct rmi_transport_dev *xport, u16 rmiaddr,
/*
* break into 32 bytes chunks to write get command code
*/
int block_len = min_t(int, len, SMB_MAX_COUNT);
int block_len = min_t(size_t, cur_len, SMB_MAX_COUNT);
retval = rmi_smb_get_command_code(xport, rmiaddr, block_len,
false, &commandcode);
@ -161,9 +161,9 @@ static int rmi_smb_write_block(struct rmi_transport_dev *xport, u16 rmiaddr,
goto exit;
/* prepare to write next block of bytes */
cur_len -= SMB_MAX_COUNT;
databuff += SMB_MAX_COUNT;
rmiaddr += SMB_MAX_COUNT;
cur_len -= block_len;
databuff += block_len;
rmiaddr += block_len;
}
exit:
mutex_unlock(&rmi_smb->page_mutex);

2
drivers/input/serio/hp_sdc.c
View File

@ -981,7 +981,7 @@ static void hp_sdc_exit(void)
free_irq(hp_sdc.irq, &hp_sdc);
write_unlock_irq(&hp_sdc.lock);
timer_delete_sync(&hp_sdc.kicker);
timer_shutdown_sync(&hp_sdc.kicker);
tasklet_kill(&hp_sdc.task);

7
drivers/input/serio/i8042-acpipnpio.h
View File

@ -259,6 +259,13 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = {
},
.driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
},
{
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
DMI_MATCH(DMI_PRODUCT_NAME, "Aspire AG15-42P"),
},
.driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
},
{
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "Acer"),

1
drivers/input/touchscreen/cyttsp5.c
View File

@ -710,6 +710,7 @@ static irqreturn_t cyttsp5_handle_irq(int irq, void *handle)
size = 2;
} else {
report_id = ts->input_buf[2];
size = min(size, CY_MAX_INPUT);
}
switch (report_id) {

1
drivers/input/touchscreen/eeti_ts.c
View File

@ -276,6 +276,7 @@ static const struct of_device_id of_eeti_ts_match[] = {
{ .compatible = "eeti,exc3000-i2c", },
{ }
};
MODULE_DEVICE_TABLE(of, of_eeti_ts_match);
#endif
static struct i2c_driver eeti_ts_driver = {

5
drivers/input/touchscreen/tsc2007_core.c
View File

@ -221,7 +221,6 @@ static int tsc2007_get_pendown_state_gpio(struct device *dev)
static int tsc2007_probe_properties(struct device *dev, struct tsc2007 *ts)
{
u32 val32;
u64 val64;
if (!device_property_read_u32(dev, "ti,max-rt", &val32))
ts->max_rt = val32;
@ -237,8 +236,8 @@ static int tsc2007_probe_properties(struct device *dev, struct tsc2007 *ts)
if (!device_property_read_u32(dev, "ti,fuzzz", &val32))
ts->fuzzz = val32;
if (!device_property_read_u64(dev, "ti,poll-period", &val64))
ts->poll_period = msecs_to_jiffies(val64);
if (!device_property_read_u32(dev, "ti,poll-period", &val32))
ts->poll_period = msecs_to_jiffies(val32);
else
ts->poll_period = msecs_to_jiffies(1);

6
include/uapi/linux/input-event-codes.h
View File

@ -970,6 +970,12 @@
/*
* LEDs
*
* Do not add any new LED definitions to the input subsystem. The existing
* definitions are legacy and grandfathered for backwards compatibility with
* userspace (via evdev). Any new LEDs should be implemented using the
* LED subsystem (struct led_classdev). The input core provides a bridge to
* the LED subsystem in drivers/input/input-leds.c.
*/
#define LED_NUML 0x00