From c1d13bfdb9c75c2885d10332174a887349eb0b51 Mon Sep 17 00:00:00 2001 From: Dmitry Torokhov Date: Sun, 11 Oct 2026 23:12:40 -0700 Subject: [PATCH] Input: always accept EV_SYN in input_event() Commit 0cd587735205 ("Input: preallocate memory to hold event values") moved allocation of dev->vals into input_allocate_device(), which caused input core to accumulate events reported while seeding initial device state before input_register_device(). However, because EV_SYN is only set in dev->evbit during input_register_device() (and some drivers also overwrite dev->evbit directly before registration), any EV_SYN/SYN_REPORT events sent before registration were dropped by is_event_supported(), leaving those seeded events stuck in dev->vals until the next SYN_REPORT after registration. Always accept EV_SYN in input_event() and input_inject_event() without checking dev->evbit so input_sync() flushes dev->vals as intended. Reported-by: Karlos Abel , Fixes: 0cd587735205 ("Input: preallocate memory to hold event values") Cc: stable@vger.kernel.org Assisted-by: LLM Acked-by: Jiri Kosina Link: https://patch.msgid.link/asx50uz6iafsyAd5@google.com Signed-off-by: Dmitry Torokhov --- drivers/input/input.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/input/input.c b/drivers/input/input.c index 1cca6d48f597..3e6af517c596 100644 --- a/drivers/input/input.c +++ b/drivers/input/input.c @@ -391,7 +391,7 @@ void input_handle_event(struct input_dev *dev, void input_event(struct input_dev *dev, unsigned int type, unsigned int code, int value) { - if (is_event_supported(type, dev->evbit, EV_MAX)) { + if (type == EV_SYN || is_event_supported(type, dev->evbit, EV_MAX)) { guard(spinlock_irqsave)(&dev->event_lock); input_handle_event(dev, type, code, value); } @@ -415,7 +415,7 @@ void input_inject_event(struct input_handle *handle, struct input_dev *dev = handle->dev; struct input_handle *grab; - if (is_event_supported(type, dev->evbit, EV_MAX)) { + if (type == EV_SYN || is_event_supported(type, dev->evbit, EV_MAX)) { guard(spinlock_irqsave)(&dev->event_lock); guard(rcu)();