- Fixes for evdev and input compat handling to zero-initialize on-stack
absinfo and force-feedback effect structures before partial or compat
copies from userspace, preventing kernel stack memory disclosure
- Fixes for the Synaptics RMI4 driver to prevent an out-of-bounds read
when writing multi-chunk blocks over SMBus and to avoid a NULL pointer
dereference during suspend/resume when the RMI device is unbound
- Fixes for the soc_button_array driver to propagate -EPROBE_DEFER on
non-Bay Trail/Cherry Trail platforms (fixing broken power and volume
buttons on the Microsoft Surface Pro 11) and to validate the ACPI
package element count before dereferencing
- A fix for the adp5588-keys driver to cache the initial GPIO hardware
state before registering the gpiochip so pre-configured pin states are
not clobbered by GPIO hogs during registration
- A fix for the cyttsp5 touchscreen driver to clamp the device-supplied
HID report size before copying into the response buffer, preventing a
buffer overflow
- A fix for the HP SDC serio driver to use timer_shutdown_sync() on
module exit so the periodic kicker timer cannot rearm itself during
teardown
- A fix for the eeti_ts touchscreen driver to export its OF module alias
so the module autoloads on Device Tree platforms
- Updates to the xpad joystick driver adding support for the Victrix Pro
BFG controller and Azeron devices, and fixing the device type
classification for the PDP Marvel Xbox 360 controller
- Quirks for the i8042 and atkbd drivers to keep the built-in keyboards
functional on the Acer Aspire Go 15 AG15-42P and Xiaomi Redmi Book Pro
16 2026
- A quirk for the Synaptics PS/2 touchpad driver disabling SMBus
InterTouch on the Lenovo ThinkPad T440p (board ID 2722) so the
touchpad and TrackPoint respond immediately at boot
- Other minor updates and documentation fixes, including reading the
"ti,poll-period" property as u32 in tsc2007, adding the mt6572
compatible to the MediaTek keypad Device Tree binding, fixing an
attribute name typo in the trackpoint sysfs ABI documentation, and
documenting that no new LED codes should be added to the input
subsystem.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCaq9j+gAKCRBAj56VGEWX
nJ5KAQDnTOivIghgIGnlKTIYLSV4cJ0fWJh7J1/ubx9soK+9RwD/bDUdyryAaSTr
x95U7/fEvq/lXBFyK2LXyahuTC6vNQY=
=Vsfi
-----END PGP SIGNATURE-----
Merge tag 'input-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:
- Fixes for evdev and input compat handling to zero-initialize on-stack
absinfo and force-feedback effect structures before partial or compat
copies from userspace, preventing kernel stack memory disclosure
- Fixes for the Synaptics RMI4 driver to prevent an out-of-bounds read
when writing multi-chunk blocks over SMBus and to avoid a NULL
pointer dereference during suspend/resume when the RMI device is
unbound
- Fixes for the soc_button_array driver to propagate -EPROBE_DEFER on
non-Bay Trail/Cherry Trail platforms (fixing broken power and volume
buttons on the Microsoft Surface Pro 11) and to validate the ACPI
package element count before dereferencing
- A fix for the adp5588-keys driver to cache the initial GPIO hardware
state before registering the gpiochip so pre-configured pin states
are not clobbered by GPIO hogs during registration
- A fix for the cyttsp5 touchscreen driver to clamp the device-supplied
HID report size before copying into the response buffer, preventing a
buffer overflow
- A fix for the HP SDC serio driver to use timer_shutdown_sync() on
module exit so the periodic kicker timer cannot rearm itself during
teardown
- A fix for the eeti_ts touchscreen driver to export its OF module
alias so the module autoloads on Device Tree platforms
- Updates to the xpad joystick driver adding support for the Victrix
Pro BFG controller and Azeron devices, and fixing the device type
classification for the PDP Marvel Xbox 360 controller
- Quirks for the i8042 and atkbd drivers to keep the built-in keyboards
functional on the Acer Aspire Go 15 AG15-42P and Xiaomi Redmi Book
Pro 16 2026
- A quirk for the Synaptics PS/2 touchpad driver disabling SMBus
InterTouch on the Lenovo ThinkPad T440p (board ID 2722) so the
touchpad and TrackPoint respond immediately at boot
- Other minor updates and documentation fixes, including reading the
"ti,poll-period" property as u32 in tsc2007, adding the mt6572
compatible to the MediaTek keypad Device Tree binding, fixing an
attribute name typo in the trackpoint sysfs ABI documentation, and
documenting that no new LED codes should be added to the input
subsystem
* tag 'input-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: hp_sdc - shut down kicker timer on module exit
Input: xpad - add support for Victrix Pro BFG Controller
Input: tsc2007 - read "ti,poll-period" as u32
Input: trackpoint - fix the inertia attribute name in the ABI document
Input: eeti_ts - publish the OF module alias
Input: xpad - add support for Azeron devices
Input: xpad - fix PDP Marvel Xbox 360 controller
Input: document that no new LED codes should be added
Input: soc_button_array - check btns_desc->package.count
Input: soc_button_array - fix MS Surface Pro 11 probe failure
Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
Input: cyttsp5 - clamp the HID report size before memcpy
Input: zero ff_effect before compat copy in input_ff_effect_from_user
Input: evdev - zero absinfo before partial copy in EVIOCSABS
Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
dt-bindings: input: mediatek,mt6779-keypad: add mt6572
Input: adp5588-keys - cache GPIO state before registering the gpiochip
The "ti,poll-period" property is documented as a normal uint32 cell.
The driver used a u64 helper, which makes the helper type disagree with
the schema even though the stored value is still small.
Read "ti,poll-period" with the u32 helper matching the documented DT
cell size.
Assisted-by: Codex:gpt-5-5
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260831194352.1185860-1-robh@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The EETI driver matches eeti,exc3000-i2c Device Tree clients, but only
publishes the legacy eeti_ts I2C ID. The I2C core emits an OF modalias
for a Device Tree client.
Publish the existing OF match table within its CONFIG_OF guard.
Fixes: e32d7f1b24 ("Input: eeti - add device tree matching table")
Signed-off-by: hpp.iscas <hppiscas@163.com>
Link: https://patch.msgid.link/20260905134004.66336-1-hppiscas@163.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Here is the big set of char, misc, iio, counter, fpga, and other small
driver subsystems for 7.3-rc1.
Overall, due to some driver removals we only added a bit more code than
removed, which was a nice change. Highlights in this merge request are:
- Loads of IIO driver updates and additions
- binder driver updates (more on that below...)
- Removal of the SGI XP and GRU drivers as they are not used anymore
and turn out to be pretty insecure overall
- Removal of the obsolete ibmasm driver as it's not being used anymore
- Coresight driver updates and additions
- Mei driver udpates
- Counter driver updates
- FPGA driver updates
- ICC driver updates
- lots and lots of other tiny driver updates to resolve reported
issues
All of these have been in linux-next for a while, with the only reported
issues being some major merge conflicts. Miguel pointed out some of
these with the Rust tree merge, which is the majority of them. I'll
follow up with a diffstat of the merge resolution I made against your
most recent tree, which works for me.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao143A8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ymtUgCeKB62gT1JfA86cg3NDB1opp+10N0An3oBBegQ
IJLqJgK45dTNtMGBwGFV
=68af
-----END PGP SIGNATURE-----
Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc/IIO/etc driver updates from Greg KH:
"Here is the big set of char, misc, iio, counter, fpga, and other small
driver subsystems for 7.3-rc1.
Overall, due to some driver removals we only added a bit more code
than removed, which was a nice change. Highlights in this merge
request are:
- Loads of IIO driver updates and additions
- binder driver updates (more on that below...)
- Removal of the SGI XP and GRU drivers as they are not used anymore
and turn out to be pretty insecure overall
- Removal of the obsolete ibmasm driver as it's not being used
anymore
- Coresight driver updates and additions
- Mei driver udpates
- Counter driver updates
- FPGA driver updates
- ICC driver updates
- lots and lots of other tiny driver updates to resolve reported
issues
All of these have been in linux-next for a while"
* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
iio: adc: pac1921: fix wrong channel used in trigger handler read
iio: light: gp2ap002: re-enable irq if runtime suspend fails
iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
iio: light: apds9306: fix PM reference leak in apds9306_read_data()
iio: gyro: mpu3050: fix sign of raw angular velocity readings
iio: srf04: fix pm_runtime handling on probe error path
iio: adc: ad4080: configure backend data size
iio: adc: adi-axi-adc: add data size support for AD408X backend
iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
iio: dac: ad5446: fix OF module device table
iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
iio: light: opt4001: Reject integration times with a non-zero seconds part
iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
iio: light: opt4001: Fix power down clearing bits of the wrong register
iio: light: opt4060: Fix incorrect register name in threshold read error message
iio: light: opt4060: Fix pointer type passed to div_u64_rem()
iio: light: opt4060: Reject integration times with a non-zero seconds part
iio: light: ltrf216a: fix runtime PM reference leak in error path
iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
...
Includes a merge of 7.2-rc2 to pick up the changes around
mod_devicetable.h and reduce resulting conflicts around includes.
New device support
------------------
adi,ad3530R
- Add support for the AD3532R and AD3532 16 channel DACs.
adi,ad4080
- Add support for the AD4883 ADC.
adi,ad5686
- Add support for AD5313R, AD5317R, AD5674, AD5687R, AD5689, AD5689R DACs
over SPI
- Add support for AD5316R, AD5674, AD5697R and AD5696 DACs over I2C
- Significant driver refactoring prior to these additions, partly to reduce
bus traffic and to add triggered buffer and gain control support. An
earlier set added support for missing supplies, reset and LDAC GPIO.
adi,adf41513
- New driver to support this PLL frequency synthesizer that runs up to
26.5 GHz.
- Included infrastructure to handle higher precision attributes with
extensive tests
adi,ltc2378-20
- New driver supporting LTC2338, LTC2364, LTC2367, LTC2368, LT2369, LTC2370
LTC2376, LTC2377, LTC2378, LTC2379 and LTC23980 ADCs with both high speed
capture via appropriate backend and conventional triggered buffer SPI
capture.
invensense,icm42607
- New driver for this IMU.
mediateck,mt6323
- New driver for this PMIC ADC.
microchip,mcp47a1
- New driver for this I2C 6 bit DAC.
nxp,mcf54415-dac
- New driver for this DAC found in NXP SoCs.
qst,qmc5884l
- New driver for this 3 axis magnetometer. Included dt vendor entry for qst.
qst,qmc6308
- New driver for this 3 axis magnetometer.
sensiron,slf3s
- New driver for this liquid flow sensor. Includes adding IIO_VOLUMEFLOW
channel type.
st,vl53l1x
- Refactors to improve readability.
ti,ads112c14
- New driver supporting the ADS112C14 and ADS122C14 ADCs. These bring
some new ABI for input chopping, particular useful for resistive sensors
like thermocouples or Wheatstone bridges.
- Support CRC8 detection of corruption on the bus.
- Support buffered reads.
ti,tmp117
- (trivial) Add support for the tmp119 temperature sensor.
xilinx,versal-sysmon
- New ADC driver for this block found on various FPGAs including various
bus interfaces, threshold and oversampling support.
dt binding updates
------------------
new shared bindings
- excitation-channels and excitation-current-nanoamp allow per channel
specification of currents used for resistive sensor measurement.
- reference-sources property to allow selection of a per channel reference.
rockchip,saradc
- Add RV1106 which is compatible with the RV3588.
Features
--------
buffer-dmaengine
- Allow cyclic buffers, useful for repeating sequence generation with DACs.
devantech,dmard09
- Implement read back of channel scale - previously interface always
returned an error.
hid,sensors-als
- Enable separate channel scaling for hardware that supports it.
invensense,timestamp library
- Various precision improvements.
invensense,icm42600
- Add support for hwfifo watermark interfaces.
taos,tcs3472
- Support wait time and sampling frequency control.
Cleanups, minor fixes
---------------------
Minor cleanups not mentioned at all in this summary such
as white space fixes or typos.
Affecting various drivers
- Cleanup of conditionals that had no affect.
- Drop some runtime pm local wrappers as now runtime_pm does the
mark_last_busy part inside the put, these provide no useful code
deduplication or readability advantages over directly calling the
runtime_pm functions.
- Return 0 from write_raw() on success.
- Use of dev_err_probe() to simplify code and sometimes provide useful
info for deferred probe debugging.
- Drop some redundant error prints where the called function already
provides information on errors.
- Make some read only arrays in functions static.
- Fix up missing handling of regcache_sync() errors.
- Drop some false kernel-doc markings.
- Add missing MODULE_DEVICE_TABLE for some of_match_id tables.
- Use local variables for things like the struct device to shorten and
improve readability of code.
- Drop some unused structure elements.
- Reorder dds.h macro parameters to be inline with others.
- Header reorders and IWYU. Often part of a more significant series.
- Remove abstractions designed to allow a driver to support multiple device
types, when they have been around a long time and only the original part
showed up.
- Initialize spi_device_id arrays using member names following dropping of
driver data from drivers that didn't actually use it.
- Catch up with i2c_device_id tables added since previous effort to use
named initializers for all those.
- Use kernel types in a few places instead of standard C ones or bare
unsigned.
Misc
- Update Xilinx AMS maintainer.
- Update email address for Maxwell Doose.
- Update email address for Siratul Islam.
- Update email address for Tomasz Duszynski and re-add Tomasz to
various maintainer entries.
Docs
- Encourage use of differential channel naming even when there is no
flexibility in input to differential pair mapping. Intended to
provide a strong signal to userspace that a channel is differential.
adi,ad_sigma_delta
- Allow COMPILE_TEST without any users.
adi,ad2s1201
- Refactor trigger handler to avoid mix of guard() and goto.
adi,ad5686
- Avoid potential NULL dereference is user forces a driver bind.
adi,ad5696
- Add a couple of missing entries to the of_match_id table and update
binding to match.
atmel,ad91_adc
- Use const char * for DT string property allowing a cast to be dropped.
avia,hx711
- Various refactors and cleanup to enable support of additional parts
(to come)
- Add missing supply and gpio dt-bindings.
bosch,bmc150
- Harden against device reporting too large a FIFO sample count.
- Use FIELD_PREP() / FIELD_GET() to improve readability.
freescale,fxls8962af
- Harden against device reporting too large a FIFO sample count.
hid-sensors-*
- Reorder probe to not expose userspace interfaces until the rest of
the setup is done to avoid potentially dropping data.
honeywell,abp2030pa
- Drop an unreachable return.
invensens,icm45600
- Harden against bad value of FIFO sample count from device.
- Use i2c_match_data if firmware table sourced match data isn't available.
nxp,mpl1115
- Ensure runtime_pm is balanced on error in probe.
rohm,bm1390
- Make the driver slightly more likely to recover from transient errors.
sensiron,sgp30
- Handle thread creation errors.
st,lsm6dsx
- Update the enable mask when doing sensor fusion to avoid incorrect fifo
data handling.
st,stm32-dfsdm
- Treat dt flags as booleans.
ti,ads1015
- Switch to devm helpers which simplified code and closed a resource leak.
ti,opt3001
- Split complicated opt3001_get_processed() logic into irq an no irq
helper functions.
- Use devm to simplify code.
- Use guard() to simplify code.
- Reorder probe so final call exposes userspace interfaces.
- Various other more minor cleanup
taos,tsl2772
- Fix calibscale readback to check right channel type.
taos,tsl2583
- Use sysfs_emit() and sysfs_emit_at() to replace open coded equivalents.
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAmp1Pm8RHGppYzIzQGtl
cm5lbC5vcmcACgkQVIU0mcT0FoioNRAAi338gJ/xvG3rZlPr1RrTEgmsWaMqxxpr
FWxFApdjAGvINn6SGwcWWkdfmB+OYg8sbhLLGkOx07e9R/GbS0y3j2kODvZHodZz
k3wYXEy12HwuMgQRQWR+rNIke6bJdJFI10saJTfIRr3if7GkVvBTqd9exfoD2vGa
Xzj12YN6ZcRiv8eWgju4yqQuVomMkRigd2mDHwvN4H9/ZylBRMgGIHhteWoPjx3y
hs6lLeqc8lfocz1Azslb0ZEDPJ4+zPCO9eCBZ+1ZMwrzKUeqCfMYDQdE9TVUswpG
aHlr5E+R2PlpLn4Ijk0faFJUZYFaOFIn3II3ZZfzzgFop2C0cVORYuIf7bgDRsaD
zrLj2ybzSr/7+aAK2ry3hoVrxh9mkbv6G0Lf7bvFhQaXltJJBVQi98pU13p2AoFj
BT8+pHOwgKUsF+LyxNqch6LyLDEzNw0P3Fl7SmrH/k2RVfj/L4+8PMOAijBTLpCC
3J4k17laTYWJZ8sFpyBEXYyhgp6SZqr2UIIcizrc1nIUK+mJI2/XBVbtsBY/6jW8
7RM07TNqkm+ZhsV58YiMfKdDuqPiQpCp5TYjVcxjjmOK4aE5bFSbyzi5SvAcG6oG
C2l9k5vgZEpti6ZkFBj4qNUK0cVXinDWqHhlAXF7wjKCj69yEFLCtl+de//A0I+v
3FBEkBCsq+M=
=4ayG
-----END PGP SIGNATURE-----
Merge tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next
Jonathan writes:
IIO new device support, features, cleanup for 7.3
Includes a merge of 7.2-rc2 to pick up the changes around
mod_devicetable.h and reduce resulting conflicts around includes.
New device support
------------------
adi,ad3530R
- Add support for the AD3532R and AD3532 16 channel DACs.
adi,ad4080
- Add support for the AD4883 ADC.
adi,ad5686
- Add support for AD5313R, AD5317R, AD5674, AD5687R, AD5689, AD5689R DACs
over SPI
- Add support for AD5316R, AD5674, AD5697R and AD5696 DACs over I2C
- Significant driver refactoring prior to these additions, partly to reduce
bus traffic and to add triggered buffer and gain control support. An
earlier set added support for missing supplies, reset and LDAC GPIO.
adi,adf41513
- New driver to support this PLL frequency synthesizer that runs up to
26.5 GHz.
- Included infrastructure to handle higher precision attributes with
extensive tests
adi,ltc2378-20
- New driver supporting LTC2338, LTC2364, LTC2367, LTC2368, LT2369, LTC2370
LTC2376, LTC2377, LTC2378, LTC2379 and LTC23980 ADCs with both high speed
capture via appropriate backend and conventional triggered buffer SPI
capture.
invensense,icm42607
- New driver for this IMU.
mediateck,mt6323
- New driver for this PMIC ADC.
microchip,mcp47a1
- New driver for this I2C 6 bit DAC.
nxp,mcf54415-dac
- New driver for this DAC found in NXP SoCs.
qst,qmc5884l
- New driver for this 3 axis magnetometer. Included dt vendor entry for qst.
qst,qmc6308
- New driver for this 3 axis magnetometer.
sensiron,slf3s
- New driver for this liquid flow sensor. Includes adding IIO_VOLUMEFLOW
channel type.
st,vl53l1x
- Refactors to improve readability.
ti,ads112c14
- New driver supporting the ADS112C14 and ADS122C14 ADCs. These bring
some new ABI for input chopping, particular useful for resistive sensors
like thermocouples or Wheatstone bridges.
- Support CRC8 detection of corruption on the bus.
- Support buffered reads.
ti,tmp117
- (trivial) Add support for the tmp119 temperature sensor.
xilinx,versal-sysmon
- New ADC driver for this block found on various FPGAs including various
bus interfaces, threshold and oversampling support.
dt binding updates
------------------
new shared bindings
- excitation-channels and excitation-current-nanoamp allow per channel
specification of currents used for resistive sensor measurement.
- reference-sources property to allow selection of a per channel reference.
rockchip,saradc
- Add RV1106 which is compatible with the RV3588.
Features
--------
buffer-dmaengine
- Allow cyclic buffers, useful for repeating sequence generation with DACs.
devantech,dmard09
- Implement read back of channel scale - previously interface always
returned an error.
hid,sensors-als
- Enable separate channel scaling for hardware that supports it.
invensense,timestamp library
- Various precision improvements.
invensense,icm42600
- Add support for hwfifo watermark interfaces.
taos,tcs3472
- Support wait time and sampling frequency control.
Cleanups, minor fixes
---------------------
Minor cleanups not mentioned at all in this summary such
as white space fixes or typos.
Affecting various drivers
- Cleanup of conditionals that had no affect.
- Drop some runtime pm local wrappers as now runtime_pm does the
mark_last_busy part inside the put, these provide no useful code
deduplication or readability advantages over directly calling the
runtime_pm functions.
- Return 0 from write_raw() on success.
- Use of dev_err_probe() to simplify code and sometimes provide useful
info for deferred probe debugging.
- Drop some redundant error prints where the called function already
provides information on errors.
- Make some read only arrays in functions static.
- Fix up missing handling of regcache_sync() errors.
- Drop some false kernel-doc markings.
- Add missing MODULE_DEVICE_TABLE for some of_match_id tables.
- Use local variables for things like the struct device to shorten and
improve readability of code.
- Drop some unused structure elements.
- Reorder dds.h macro parameters to be inline with others.
- Header reorders and IWYU. Often part of a more significant series.
- Remove abstractions designed to allow a driver to support multiple device
types, when they have been around a long time and only the original part
showed up.
- Initialize spi_device_id arrays using member names following dropping of
driver data from drivers that didn't actually use it.
- Catch up with i2c_device_id tables added since previous effort to use
named initializers for all those.
- Use kernel types in a few places instead of standard C ones or bare
unsigned.
Misc
- Update Xilinx AMS maintainer.
- Update email address for Maxwell Doose.
- Update email address for Siratul Islam.
- Update email address for Tomasz Duszynski and re-add Tomasz to
various maintainer entries.
Docs
- Encourage use of differential channel naming even when there is no
flexibility in input to differential pair mapping. Intended to
provide a strong signal to userspace that a channel is differential.
adi,ad_sigma_delta
- Allow COMPILE_TEST without any users.
adi,ad2s1201
- Refactor trigger handler to avoid mix of guard() and goto.
adi,ad5686
- Avoid potential NULL dereference is user forces a driver bind.
adi,ad5696
- Add a couple of missing entries to the of_match_id table and update
binding to match.
atmel,ad91_adc
- Use const char * for DT string property allowing a cast to be dropped.
avia,hx711
- Various refactors and cleanup to enable support of additional parts
(to come)
- Add missing supply and gpio dt-bindings.
bosch,bmc150
- Harden against device reporting too large a FIFO sample count.
- Use FIELD_PREP() / FIELD_GET() to improve readability.
freescale,fxls8962af
- Harden against device reporting too large a FIFO sample count.
hid-sensors-*
- Reorder probe to not expose userspace interfaces until the rest of
the setup is done to avoid potentially dropping data.
honeywell,abp2030pa
- Drop an unreachable return.
invensens,icm45600
- Harden against bad value of FIFO sample count from device.
- Use i2c_match_data if firmware table sourced match data isn't available.
nxp,mpl1115
- Ensure runtime_pm is balanced on error in probe.
rohm,bm1390
- Make the driver slightly more likely to recover from transient errors.
sensiron,sgp30
- Handle thread creation errors.
st,lsm6dsx
- Update the enable mask when doing sensor fusion to avoid incorrect fifo
data handling.
st,stm32-dfsdm
- Treat dt flags as booleans.
ti,ads1015
- Switch to devm helpers which simplified code and closed a resource leak.
ti,opt3001
- Split complicated opt3001_get_processed() logic into irq an no irq
helper functions.
- Use devm to simplify code.
- Use guard() to simplify code.
- Reorder probe so final call exposes userspace interfaces.
- Various other more minor cleanup
taos,tsl2772
- Fix calibscale readback to check right channel type.
taos,tsl2583
- Use sysfs_emit() and sysfs_emit_at() to replace open coded equivalents.
* tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (232 commits)
iio: dac: mcp47a1: add support for new device
dt-bindings: iio: dac: add support for mcp47a1
iio: Update email for Maxwell Doose
iio: imu: st_lsm6dsx: Update enable mask when using sensor fusion
iio: light: cm32181: return zero after writing calibscale
iio: flow: add Sensirion SLF3S liquid flow sensor driver
iio: core: add IIO_VAL_DECIMAL64_FEMTO format type
dt-bindings: iio: flow: add Sensirion SLF3S liquid flow sensor
iio: types: add IIO_VOLUMEFLOW channel type
iio: ABI: Encourage differential voltage ABI usage
iio: adc: ltc2378: Add support for LTC2338-18
iio: adc: ltc2378: Enable triggered buffer data capture
iio: adc: ltc2378: Enable high-speed data capture
iio: adc: ltc2378: Add support for LTC2378-20 and similar ADCs
dt-bindings: iio: adc: Add ltc2378
iio: magnetometer: ak8974: remove conditional return with no effect
iio: light: tsl2583: remove conditional return with no effect
iio: adc: rcar-gyroadc: remove rcar_gyroadc_set_power() helper
iio: light: vcnl4000: remove vcnl4000_set_pm_runtime_state() helper
iio: light: vcnl4035: remove vcnl4035_set_pm_runtime_state() helper
...
In sur40_probe(), if video_register_device() fails, the error path jumps to
err_unreg_video. This incorrectly attempts to unregister a video device
that was never successfully registered, and fails to free the V4L2 control
handler (v4l2_ctrl_handler_free) that was initialized immediately prior.
Fix this by introducing an err_free_ctrl label to properly free the V4L2
control handler and bypass video_unregister_device() when video device
registration fails.
Reported-by: sashiko-bot@kernel.org
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260616051235.1549517-2-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
In sur40_probe(), input_register_device() was previously called early before
the V4L2 video device and vb2_queue components were fully initialized. If
userspace opened the input device immediately upon registration, sur40_open()
would trigger and start the sur40_poll() worker thread. This worker thread
invokes sur40_process_video() and accesses the uninitialized vb2_queue
structure, leading to a data race and potential system crash.
Furthermore, if V4L2 or video registration failed after input_register_device()
succeeded, the error path fell through to calling input_free_device() on a
successfully registered device instead of input_unregister_device(), corrupting
input core state.
Move input_register_device() to the very end of sur40_probe(). This ensures
the V4L2 and video queue structures are fully initialized before polling can
start, and naturally resolves the error path bug since input_free_device()
is now only called when input registration has not yet occurred.
To maintain strict LIFO (Last-In, First-Out) teardown ordering, also move
input_unregister_device() to the very beginning of sur40_disconnect(). This
guarantees that the input polling worker thread is stopped before V4L2
video components or control handlers are unregistered.
Reported-by: sashiko-bot@kernel.org
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260616051235.1549517-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The driver allocates max_touch_num input slots, which are indexed from
zero through max_touch_num - 1. The current check allows a finger ID
equal to max_touch_num to reach cst3xx_report_contact(). While the input
core ignores out-of-range slot indices, reporting touch data without a
valid slot change corrupts the touch state of the previously active slot.
The touch count is read from the controller's report and is used to
index the fixed-size report buffer without first checking its range.
Reject counts larger than the supported number of touch slots before
checking the trailing byte or parsing touch data.
Reject finger IDs equal to or greater than max_touch_num, and return
immediately when an invalid finger ID is encountered so that corrupt
touch frames are discarded instead of reporting partial contact state.
The V821 Avaota F1 board configures the vendor driver with one touch
slot, so finger ID 1 is already invalid on that device.
Fixes: 66603243f5 ("Input: add driver for Hynitron cstxxx touchscreens")
Signed-off-by: Jianing Li <m13940358460@163.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260804031339.2379-1-m13940358460@163.com
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Replace printk(KERN_DEBUG) with dev_dbg() using the serio device,
which is the correct logging style for driver code. Also fix missing
space after comma in the function argument, and remove the redundant
'inexio.c:' filename prefix from the message.
Signed-off-by: Bivash Kumar Singh <bivashraj750@gmail.com>
Link: https://patch.msgid.link/20260725130803.6763-1-bivashraj750@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Fix two checkpatch warnings in elo_setup_10():
- Add missing space around '-' operator in array index expression
- Add missing 'const' qualifier to elo_types pointer array, since
the array is never modified after initialization
Signed-off-by: Bivash Kumar Singh <bivashraj750@gmail.com>
Link: https://patch.msgid.link/20260725113638.5147-1-bivashraj750@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The firmware record parser checks that the record address starts within
the programmable map, but does not check that the complete record data
fits in that map. A record near the end of the map can therefore make
the copy to pmap exceed its destination span.
Check the record length against the remaining programmable map range
before copying the record data.
Fixes: 7b5bb55d0d ("Input: add support for Azoteq IQS550/572/525")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260715083850.32155-1-pengpeng@iscas.ac.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The per-contact slot id is taken from the top nibble of the third
report byte, so it can be any value from 0 to 15. The driver only
allocates max_support_points MT slots (2 to 10 depending on the
variant), so a report that carries an id at or above that count - be it
a genuinely higher-numbered contact or a corrupted byte - is outside the
range the input core was told about.
input_mt_slot() silently ignores an ABS_MT_SLOT beyond num_slots and
leaves the current slot unchanged, so the following
input_mt_report_slot_state()/touchscreen_report_pos() pair is applied to
whichever slot happened to be selected last, reporting the contact at the
wrong position. Skip such entries instead.
Signed-off-by: Alexandre Hamamdjian <azkali.limited@gmail.com>
Link: https://patch.msgid.link/20260723-b4-ft5426-v2-1-cd2bed168051@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
In preparation for removing the strlcat() API[1], replace its five
uses with a small append helper built on strnlen() and strscpy().
The five calls append device name fragments to a basename buffer
that grows in place across the setup functions. The helper takes
the same arguments as strlcat() and writes the same bytes, including
when a fragment is truncated.
Link: https://github.com/KSPP/linux/issues/370 [1]
Signed-off-by: Ian Bridges <icb@fastmail.org>
Link: https://patch.msgid.link/albg4Rv7QxvLJD05@dev
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
In mms114_setup_regs(), the driver mistakenly uses props->max_x instead
of props->max_y when configuring the low bits of the Y resolution
(MMS114_Y_RESOLUTION).
Fix this by using the correct property.
Fixes: 07b8481d4a ("Input: add MELFAS mms114 touchscreen driver")
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260704060115.353049-3-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The driver defines the I2C packet layout using C bitfields in struct
mms114_touch. This is not portable as the layout of bitfields within a
byte is compiler-dependent and varies with endianness. On Big Endian
systems, the fields will be parsed incorrectly.
Fix this by redefining struct mms114_touch with plain u8 fields and
introducing bitwise macros to extract the values portably.
Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260704060115.353049-2-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-----BEGIN PGP SIGNATURE-----
iQFSBAABCgA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmpUBDceHHRvcnZhbGRz
QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGgyoH/ivB80eG0N5qxekB
0w6Xwa5EXEcZrWOXFgYs+ur2D+KMIy8c1Q540ysYmu9OGjZjL+rtNE/czWsBtD57
9gv4Cxs1Ak+V3pfxXdwjeXzGZwtL0ysAmfbQAo5LeYbcwEmjCm26giU5pYlwqTf5
oggkS13GuDEtF/+2bTUFbBVPTMFd6xgZFAOLJkZrfNm3bGOWtqJRDVweVz0IR5Bv
ZVq1WvgrTpsf34ORrYXqyDtxIBxBRM9Dz5O2H5srOnG9yGtk691j1Ud6u8oftDBx
w0UYd1WQDaKYRM/A/mVGHgvwuk5dOThdN5IBXq6R9JC4QgBqFOk0srmJ6JtMWGw7
q8B/WiE=
=IBMl
-----END PGP SIGNATURE-----
Merge tag 'v7.2-rc3' into next
Sync up with mainline to pull in stable fixes to avoid merge conflicts.
- A fix for MELFAS MMS114 touchscreen driver to reject invalid touch IDs
and avoid multi-touch slot corruption
- A fix for a crash in Sega Dreamcast (Maple) mouse driver when opening
the device, caused by missing driver data
- Fixes for Maple drivers (keyboard, mouse, joystick) to properly order
setting driver data and device registration to avoid races.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCalLC2QAKCRBAj56VGEWX
nLLwAQDExlB/cWm2Hpmim13SIetpNbnRNDDUBXZqlx26U6tCUgD9Ek85LvbRiWOJ
dTqs7ieSn2iPQxHFvHOAZD5ohSGj/wI=
=g2px
-----END PGP SIGNATURE-----
Merge tag 'input-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:
- fix MELFAS MMS114 touchscreen driver to reject invalid touch IDs and
avoid multi-touch slot corruption
- fix a crash in the Sega Dreamcast (Maple) mouse driver when opening
the device, caused by missing driver data
- fixes for Maple drivers (keyboard, mouse, joystick) to properly order
setting driver data and device registration to avoid races
* tag 'input-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: mms114 - fix multi-touch slot corruption
Input: maple_keyb - set driver data before registering input device
Input: maplecontrol - set driver data before registering input device
Input: maplemouse - set driver data before registering input device
Input: maplemouse - fix NULL pointer dereference in open()
If the touchscreen controller reports a touch ID of 0, the driver
calculates the slot ID as touch->id - 1, which underflows to UINT_MAX.
This is passed to input_mt_slot() as -1.
Since the input core ignores negative slot values, the active slot remains
unchanged. The driver then reports the touch coordinates for the previously
active slot, corrupting its state.
Fix this by rejecting touch reports with ID 0.
Fixes: 07b8481d4a ("Input: add MELFAS mms114 touchscreen driver")
Cc: stable@vger.kernel.org
Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260704060115.353049-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-----BEGIN PGP SIGNATURE-----
iQFSBAABCgA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmpK+lYeHHRvcnZhbGRz
QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGsv8H/Rn7Hr3Hp8t6au8B
xQueZThJWjqQ4v8pyLnXF6OomKiDR24OTXMCrFgDkcmZ7RK2ALqowI3tQVwLUTuI
yUN0qL2z2y+LyTcO0CYf3Lple8KlgLAXYMsv7pGLsOvhS7BW2jW97/bcbpUNxoHb
eghxqbIEnyRImUbbyg+nW7VVk65RKdPUNkBPXfQ2NMVwe+SDE5Rl+NXNVqDNjGad
soDTUBrD9yXkWX+4s0myleE62UzzH5nYgGPQeQgYmzWgq7LybH6WBlbQK9D7ODJR
Cw3LCq1hwZZ2w04Yx+XwMHquGJYHW8L2pj77h95uhzksz8buKnM0AGwBCTC6RMoi
AyUQvdc=
=JUWl
-----END PGP SIGNATURE-----
Merge tag 'v7.2-rc2' into togreg
Linux 7.2-rc2
Done to resolve conflicts with header reorg around mod_devicetable.h
and provide a base for other inflight series that touch the includes.
Use namespaced exports for IIO consumer API functions.
This will make it easier to manage the IIO export surface. Consumer drivers
will only be provided access to a specific set of functions, thereby
restricting usage of internal IIO functions by other parts of the kernel.
This change cannot be split into several parts without breaking
bisectability, thus all of the affected drivers are modified at once.
Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com> # for power-supply
Acked-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Romain Gantois <romain.gantois@bootlin.com>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Replace the #include of <linux/mod_devicetable.h> by the more specific
<linux/device-id/*.h> where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.
Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
The Samsung SUR40 with Microsoft PixelSense is offically specified to
support 52 simultaneuous touch contacts, not 64. The value of 64 was an
unverified guess as noted by the FIXME comment. Update MAX_CONTACTS to
match the documented hardware specification and remove the FIXME.
Signed-off-by: Oliver <oliverburns.kernel@gmail.com>
Link: https://patch.msgid.link/20260614230847.4938-1-oliverburns.kernel@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Instead of using an enum and conditional switch/if statements throughout
the driver to handle differences between chip variants (MMS114, MMS134S,
MMS136, MMS152, MMS345L), introduce a variant-specific descriptor
structure that encapsulates variant-specific properties (name, event
size, presence of configuration registers) and callbacks (such as
get_version). Define descriptors for each supported chip and associate
them with the matching entries in the OF and I2C device ID tables.
This eliminates the need for variant checks in the driver logic, making
it easier to support new chip variants in the future.
Note that there is slight change in device names:
MMS134S: "MELFAS MMS134 Touchscreen" -> "MELFAS MMS134S Touchscreen"
MMS345L: "MELFAS MMS345 Touchscreen" -> "MELFAS MMS345L Touchscreen"
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260616050912.1531241-6-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Avoid taking the machine down with BUG() if a caller ever requests a
read spanning the write-only MODE_CONTROL register; warn and return
-EINVAL so the driver can recover.
Additionally, fix parameter alignment to match the open parenthesis
in several functions to conform to the kernel coding style.
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260616050912.1531241-5-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The driver currently uses udelay(MMS114_I2C_DELAY) (50us) to ensure a
mandatory delay between I2C transfers in __mms114_read_reg() and
mms114_write_reg().
Both functions invoke underlying I2C core operations (i2c_transfer,
i2c_master_send) which acquire mutexes and sleep. Furthermore, the
interrupt handler mms114_interrupt() is registered as a threaded IRQ
handler. Since the entire execution path is fully sleepable,
busy-waiting with udelay() for 50us unnecessarily wastes CPU cycles.
Replace udelay() with usleep_range() to allow the CPU to enter low-power
states or execute other tasks during the delay.
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260616050912.1531241-4-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The MMS114 I2C touch controller uses 8-bit register addresses (0x01 to
0xF2) and 8-bit single-register data values. The helper functions
previously declared reg and val as 32-bit unsigned int, requiring
explicit bitwise masking (& 0xff) to narrow the values down to u8 before
populating the I2C transfer buffers.
Update reg and val parameters to u8 across mms114_read_reg(),
mms114_write_reg(), and __mms114_read_reg() to accurately reflect the
hardware specification and eliminate the redundant & 0xff masking.
Additionally, update the val buffer pointer in __mms114_read_reg() from
u8 * to void * to allow callers to pass data structures directly without
requiring explicit casting.
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260616050912.1531241-3-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
As explained in commit bf7fbeeae6 ("module: Cure the MODULE_LICENSE
"GPL" vs. "GPL v2" bogosity"), "GPL" and "GPL v2" have identical
semantics in the module loader, but "GPL" is preferred to avoid
unnecessary confusion and maintain consistency across the kernel.
Change MODULE_LICENSE("GPL v2") to MODULE_LICENSE("GPL").
Assisted-by: Antigravity:gemini-3.5-flash
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260616050912.1531241-2-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The MMS134S and MMS136 touch controllers have an event size of 6 bytes
rather than 8 bytes. When __mms114_read_reg() reads the touch data
packet from the device into the touch buffer, the events are packed
tightly at 6-byte intervals. However, the driver iterates through the
events using standard C array indexing (touch[index]), where each
element is sizeof(struct mms114_touch) (8 bytes) apart. As a result, any
touch events beyond the first one are read from incorrect offsets and
parsed improperly.
Fix this by explicitly calculating the byte offset for each touch event
based on the device's specific event size.
Fixes: 53fefdd1d3 ("Input: mms114 - support MMS136")
Fixes: ab10867819 ("Input: mms114 - support MMS134S")
Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Reviewed-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260616050912.1531241-1-dmitry.torokhov@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
goodix_ts_read_input_report() copies the number of touch points reported
by the device into an on-stack buffer
u8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS];
which is sized for at most GOODIX_MAX_CONTACTS (10) contacts. The only
runtime check bounds the per-interrupt count against ts->max_touch_num,
but that value is taken verbatim from a 4-bit field of the device
configuration block and is never clamped:
ts->max_touch_num = ts->config[MAX_CONTACTS_LOC] & 0x0f;
The nibble can be 0..15, so a malfunctioning, malicious or counterfeit
controller (or an attacker tampering with the I2C bus) can advertise up
to 15 contacts. goodix_ts_read_input_report() then accepts a touch_num
of up to 15 and the second goodix_i2c_read() writes
ts->contact_size * (touch_num - 1) bytes past the one-contact header into
point_data - up to 30 bytes (45 with the 9-byte report format) beyond the
92-byte buffer: a stack out-of-bounds write.
Clamp max_touch_num to GOODIX_MAX_CONTACTS, the number of contacts
point_data[] is sized for, when reading it from the configuration.
Fixes: a7ac7c95d4 ("Input: goodix - use max touch number from device config")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Link: https://patch.msgid.link/20260612-b4-disp-6844625d-v1-1-df0aed080c9d@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
mms114_interrupt() reads a packet of touch data from the device into a
fixed-size on-stack buffer
struct mms114_touch touch[MMS114_MAX_TOUCH];
which holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes,
i.e. 80 bytes. The length of the I2C read into it is taken verbatim from
the device:
packet_size = mms114_read_reg(data, MMS114_PACKET_SIZE);
if (packet_size <= 0)
goto out;
...
error = __mms114_read_reg(data, MMS114_INFORMATION, packet_size,
(u8 *)touch);
packet_size is a single device register byte (0x0F) and the only check
is the lower bound packet_size <= 0; it is never bounded against the
size of touch[]. A malfunctioning, malicious or counterfeit controller
(or an attacker tampering with the I2C bus) can report a packet_size of
up to 255, so __mms114_read_reg() writes up to 175 bytes past the end of
touch[] on the IRQ-thread stack: a stack out-of-bounds write that can
overwrite the stack canary, saved registers and the return address.
A well-formed device never reports more than the buffer holds, so reject
an oversized packet and drop the report, consistent with the handler's
other error paths, rather than reading past the buffer.
Fixes: 07b8481d4a ("Input: add MELFAS mms114 touchscreen driver")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260612-b4-disp-dc4b8dc4-v1-1-d7cb0a828d92@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
tw_interrupt() accumulates each non-zero serial byte into a fixed
three-byte buffer with a running index that is only reset once a full
packet has been received *and* the device's two Y bytes agree:
tw->data[tw->idx++] = data;
if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) {
...
tw->idx = 0;
}
The reset is gated on tw->data[1] == tw->data[2], a value the device
controls. A malicious, malfunctioning or counterfeit Touchwindow
peripheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the
index reaches TW_LENGTH without the equality holding, is never reset, and
keeps growing, so tw->data[tw->idx++] walks off the end of the three-byte
array and the rest of the heap-allocated struct tw, one attacker-chosen
byte at a time -- an unbounded, device-driven heap out-of-bounds write.
Reset the index on every completed packet and report an event only when
the two Y bytes match, like the other serio touchscreen drivers do.
Fixes: 11ea3173d5 ("Input: add driver for Touchwin serial touchscreens")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260613-b4-disp-69921bfd-v1-1-82c036899959@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The workaround for XPT2046 clears the command register, giving the
touchscreen controller a NOP. The change incorrectly re-uses the
req->scratch variable which is used as rx_buf for xfer[5], so by
the time xfer[6] occurs, the contents of req->scratch may not be
0. It was found that the touchscreen controller can end up in
a completely unresponsive state due to it being given a command
the driver does not expect.
Instead, rely on the spi_transfer behavior of tx_buf being NULL to
transmit all 0 bits and use the scratch variable for the rx_buf for
both the 1 byte command to and 2 byte response from the controller.
Also relocates the scratch member of struct ser_req to force it
into a different cache line to prevent any potential issues of
DMA stepping on unrelated data in other struct members due to
sharing the same cache line.
This change was tested on real TSC2046 and ADS7843 controllers,
but not the XPT2046 the workaround was originally created for.
Confirming that the original modification to clear the command
register does not impact either real controller.
Fixes: 781a07da9b ("Input: ads7846 - add dummy command register clearing cycle")
Cc: stable@vger.kernel.org
Co-developed-by: Mark Featherston <mark@embeddedTS.com>
Signed-off-by: Mark Featherston <mark@embeddedTS.com>
Signed-off-by: Kris Bahnsen <kris@embeddedTS.com>
Link: https://patch.msgid.link/20260507164943.760009-1-kris@embeddedTS.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
On some boards, the SPI controller is limited to half-duplex and the driver
fails spamming "ads7846 spi2.1: spi_sync --> -22". Restore half-duplex
support with multiple SPI transfers.
Fixes: 9c9509717b ("Input: ads7846 - convert to full duplex")
Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Link: https://patch.msgid.link/20260419161848.825831-2-aaro.koskinen@iki.fi
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-----BEGIN PGP SIGNATURE-----
iQFSBAABCgA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmocssAeHHRvcnZhbGRz
QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGsvMIAIYkDW1HujnkP3/G
SzQuQozH30O8Fpxdo+axRG6DweP2DTW1lD35YPJJsVto0G2BJZVjzsrx8RSgV6uz
DDY+Y0x0/VknMZ4JDrDoWRIyHaVV6p3+NcSHhwrxctQsa8UdEf4aXGaTf91nIBSB
GCX5R2YxxuQSTMZ19F/e+UShnRC5OO0FbCB5xhSnUJX3+eoRe0mcGAQB4DBUKxsx
BZ5DMOmoiEyPFJbdmy11X0epgJ32qgL7HPYLEo44Vcfy/Ot9lrL9b4vKbG+b3N1P
YAZccYH/dlpUuk7piR37H87Ntgz/SZcYbJlx2iAWoNk4tMmfRUO16igar8yFHjSt
FLN2Zx4=
=ufVr
-----END PGP SIGNATURE-----
Merge tag 'v7.1-rc6' into next
Sync up with mainline to pull in a fix to IMS PCU driver and other
enhancements.
The driver doesn't make use of the value that was explicitly assigned to
the .driver_data members. Drop the assignment. While touching the array,
convert it to use named initialization which is easier to understand.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260515165135.498505-2-u.kleine-koenig@baylibre.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.
The mentioned robustness is relevant for a planned change to struct
i2c_device_id that replaces .driver_data by an anonymous union.
This patch doesn't modify the compiled arrays, only their representation
in source form benefits. The former was confirmed with x86 and arm64
builds.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260515164848.497608-2-u.kleine-koenig@baylibre.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Add driver for Wacom W9002 and two Wacom W9007A variants. These are
penabled touchscreens supporting passive Wacom Pens and use I2C.
Co-developed-by: Ferass El Hafidi <funderscore@postmarketos.org>
Signed-off-by: Ferass El Hafidi <funderscore@postmarketos.org>
Signed-off-by: Hendrik Noack <hendrik-noack@gmx.de>
Link: https://patch.msgid.link/20260528074818.12151-3-hendrik-noack@gmx.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Use the __free(kfree) macro for the obuf allocation in mxt_object_show()
to simplify the code.
Assisted-by: Gemini:gemini-3.1-pro
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://patch.msgid.link/20260504185448.4055973-3-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
In mxt_update_cfg(), the driver calculates the memory size needed to store
the configuration as data->mem_size - cfg.start_ofs. If data->mem_size is
less than or equal to cfg.start_ofs, this calculation will underflow or
result in a zero-size buffer, neither of which is valid for a configuration
update.
Add a check to return -EINVAL if data->mem_size is too small. While at it,
change the types of start_ofs and mem_size in struct mxt_cfg to u16 to
match the device address space.
Assisted-by: Gemini:gemini-3.1-pro
Link: https://patch.msgid.link/20260504185448.4055973-2-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
When a configuration file provides an object size that is larger than the
driver's known mxt_obj_size(object), the driver intends to discard the
extra bytes.
The loop iterates using for (i = 0; i < size; i++). Inside the loop, the
condition to skip processing extra bytes is:
if (i > mxt_obj_size(object))
continue;
Since i is a 0-based index, the valid indices for the object are 0 through
mxt_obj_size(object) - 1.
When i == mxt_obj_size(object), the condition evaluates to false, and the
code processes the byte instead of discarding it.
This causes the code to calculate byte_offset = reg + i - cfg->start_ofs
and writes the byte there, overwriting exactly one byte of the adjacent
instance or object.
Update the boundary check to skip extra bytes correctly by using >=.
Fixes: 50a77c658b ("Input: atmel_mxt_ts - download device config using firmware loader")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://patch.msgid.link/20260504185448.4055973-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The current implementation sends a separate power-down command
after reading the Z2 value, resulting in an extra I2C
transaction per measurement cycle.
The TSC2007 command byte contains a 2-bit power-down mode
selection field. By selecting the power-down state in the Z2
measurement command, the device powers down after the Z2 A/D
conversion completes, eliminating the subsequent power-down
transaction.
This reduces the number of I2C transactions by one per touch
measurement cycle, decreasing I2C bus overhead and improving
touch sampling performance.
Signed-off-by: Yuki Horii <yuuki198708@gmail.com>
Tested-by: Andreas Kemnade <andreas@kemnade.info> # GTA04
Link: https://patch.msgid.link/20260410074100.1660-1-horiiyuk@ishida.co.jp
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
The calculations done to obtain byte_offset can result into a negative
number, fix its type.
This patch fixes the following sparse error:
drivers/input/touchscreen/atmel_mxt_ts.c:1481:44: warning: unsigned value that used to be signed checked against zero?
drivers/input/touchscreen/atmel_mxt_ts.c:1479:49: signed value source
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://patch.msgid.link/20260504-fix-sparse-v1-1-1071137cd280@chromium.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Support for the ezx series of phones was removed in 2022, this
driver is just dead code.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260430164326.2766500-2-arnd@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
nexio_read_data() pulls data_len and x_len from a packed __be16 header
in the device's interrupt packet and then walks packet->data[0..x_len)
and packet->data[x_len..data_len) comparing each byte against a
threshold.
Both fields are 16-bit on the wire (max 65535). The existing
adjustments shave at most 0x100 / 0x80 off, so the loop bound can still
reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size
(1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the
packed header — so packet->data[] has 1017 valid bytes. read_data()
callbacks are not given urb->actual_length, and nothing else bounds the
walk.
A device that lies about its length can get a ~64 KiB out-of-bounds read
past the coherent DMA allocation. The first index whose byte exceeds
NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the
reported touch coordinates, so adjacent kernel memory contents leak to
userspace as ABS_X / ABS_Y events. Far enough out, the read can also
hit an unmapped page and fault.
Fix this all by clamping data_len to the buffer's data[] capacity and
x_len to data_len.
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Fixes: 5197424cdc ("Input: usbtouchscreen - add NEXIO (or iNexio) support")
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/2026042026-chlorine-epidermis-fd6d@gregkh
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Add support for an optional "reset-gpios" property. If present, the
driver drives the reset line high at probe time and releases it during
power-on, after the regulators have been enabled.
Signed-off-by: Petr Hodina <petr.hodina@protonmail.com>
Co-developed-by: David Heidelberg <david@ixit.cz>
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260409-stmfts5-v4-8-64fe62027db5@ixit.cz
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Make code cleaner, compiler will optimize it away anyway.
Preparation for FTM5 support, where more steps are needed.
Signed-off-by: Petr Hodina <petr.hodina@protonmail.com>
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260409-stmfts5-v4-6-64fe62027db5@ixit.cz
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
We must power off regulators and ensure that IRQ is disabled when
failing at power on phase. Create stmfts_configure function to limit
use of goto.
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260409-stmfts5-v4-5-64fe62027db5@ixit.cz
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
