Commit a1f76426 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus-2022083101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid 

Pull HID fixes from Jiri Kosina:

 - NULL pointer dereference fix for Steam driver (Lee Jones)

 - memory leak fix for hidraw (Karthik Alapati)

 - regression fix for functionality of some UCLogic tables (Benjamin
   Tissoires)

 - a few new device IDs and device-specific quirks

* tag 'for-linus-2022083101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: nintendo: fix rumble worker null pointer deref
  HID: intel-ish-hid: ipc: Add Meteor Lake PCI device ID
  HID: input: fix uclogic tablets
  HID: Add Apple Touchbar on T2 Macs in hid_have_special_driver list
  HID: add Lenovo Yoga C630 battery quirk
  HID: AMD_SFH: Add a DMI quirk entry for Chromebooks
  HID: thrustmaster: Add sparco wheel and fix array length
  hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message
  HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo
  HID: asus: ROG NKey: Ignore portion of 0x5a report
  HID: hidraw: fix memory leak in hidraw_release()
  HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
parents 2361d384 1ff89e06

drivers/hid/amd-sfh-hid/amd_sfh_pcie.c

+18 −0
Original line number Diff line number Diff line
@@ -288,11 +288,29 @@ int amd_sfh_irq_init(struct amd_mp2_dev *privdata) 
	return 0;

}



static const struct dmi_system_id dmi_nodevs[] = {

	{

		/*

		 * Google Chromebooks use Chrome OS Embedded Controller Sensor

		 * Hub instead of Sensor Hub Fusion and leaves MP2

		 * uninitialized, which disables all functionalities, even

		 * including the registers necessary for feature detections.

		 */

		.matches = {

			DMI_MATCH(DMI_SYS_VENDOR, "Google"),

		},

	},

	{ }

};



static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)

{

	struct amd_mp2_dev *privdata;

	int rc;



	if (dmi_first_match(dmi_nodevs))

		return -ENODEV;



	privdata = devm_kzalloc(&pdev->dev, sizeof(*privdata), GFP_KERNEL);

	if (!privdata)

		return -ENOMEM;

drivers/hid/hid-asus.c

+7 −0
Original line number Diff line number Diff line
@@ -1212,6 +1212,13 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc, 
		rdesc = new_rdesc;

	}



	if (drvdata->quirks & QUIRK_ROG_NKEY_KEYBOARD &&

			*rsize == 331 && rdesc[190] == 0x85 && rdesc[191] == 0x5a &&

			rdesc[204] == 0x95 && rdesc[205] == 0x05) {

		hid_info(hdev, "Fixing up Asus N-KEY keyb report descriptor\n");

		rdesc[205] = 0x01;

	}



	return rdesc;

}

drivers/hid/hid-ids.h

+3 −0
Original line number Diff line number Diff line
@@ -185,6 +185,8 @@ 
#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021   0x029c

#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021   0x029a

#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2021   0x029f

#define USB_DEVICE_ID_APPLE_TOUCHBAR_BACKLIGHT 0x8102

#define USB_DEVICE_ID_APPLE_TOUCHBAR_DISPLAY 0x8302



#define USB_VENDOR_ID_ASUS		0x0486

#define USB_DEVICE_ID_ASUS_T91MT	0x0185
@@ -414,6 +416,7 @@ 
#define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN	0x2706

#define I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN	0x261A

#define I2C_DEVICE_ID_SURFACE_GO2_TOUCHSCREEN	0x2A1C

#define I2C_DEVICE_ID_LENOVO_YOGA_C630_TOUCHSCREEN	0x279F



#define USB_VENDOR_ID_ELECOM		0x056e

#define USB_DEVICE_ID_ELECOM_BM084	0x0061

drivers/hid/hid-input.c

+6 −1
Original line number Diff line number Diff line
@@ -383,6 +383,8 @@ static const struct hid_device_id hid_battery_quirks[] = { 
	  HID_BATTERY_QUIRK_IGNORE },

	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO2_TOUCHSCREEN),

	  HID_BATTERY_QUIRK_IGNORE },

	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_LENOVO_YOGA_C630_TOUCHSCREEN),

	  HID_BATTERY_QUIRK_IGNORE },

	{}

};
@@ -1532,7 +1534,10 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct 
			 * assume ours

			 */

			if (!report->tool)

				hid_report_set_tool(report, input, usage->code);

				report->tool = usage->code;



			/* drivers may have changed the value behind our back, resend it */

			hid_report_set_tool(report, input, report->tool);

		} else {

			hid_report_release_tool(report, input, usage->code);

		}

drivers/hid/hid-nintendo.c

+4 −2
Original line number Diff line number Diff line
@@ -1221,6 +1221,7 @@ static void joycon_parse_report(struct joycon_ctlr *ctlr, 


	spin_lock_irqsave(&ctlr->lock, flags);

	if (IS_ENABLED(CONFIG_NINTENDO_FF) && rep->vibrator_report &&

	    ctlr->ctlr_state != JOYCON_CTLR_STATE_REMOVED &&

	    (msecs - ctlr->rumble_msecs) >= JC_RUMBLE_PERIOD_MS &&

	    (ctlr->rumble_queue_head != ctlr->rumble_queue_tail ||

	     ctlr->rumble_zero_countdown > 0)) {
@@ -1545,12 +1546,13 @@ static int joycon_set_rumble(struct joycon_ctlr *ctlr, u16 amp_r, u16 amp_l, 
		ctlr->rumble_queue_head = 0;

	memcpy(ctlr->rumble_data[ctlr->rumble_queue_head], data,

	       JC_RUMBLE_DATA_SIZE);

	spin_unlock_irqrestore(&ctlr->lock, flags);



	/* don't wait for the periodic send (reduces latency) */

	if (schedule_now)

	if (schedule_now && ctlr->ctlr_state != JOYCON_CTLR_STATE_REMOVED)

		queue_work(ctlr->rumble_queue, &ctlr->rumble_worker);



	spin_unlock_irqrestore(&ctlr->lock, flags);



	return 0;

}