linux-toradex.git/drivers/hid/hid-multitouch.c, branch v6.17

HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()

2025-08-12T12:53:11+00:00

A malicious HID device can trigger a slab out-of-bounds during
mt_report_fixup() by passing in report descriptor smaller than
607 bytes. mt_report_fixup() attempts to patch byte offset 607
of the descriptor with 0x25 by first checking if byte offset
607 is 0x15 however it lacks bounds checks to verify if the
descriptor is big enough before conducting this check. Fix
this bug by ensuring the descriptor size is at least 608
bytes before accessing it.

Below is the KASAN splat after the out of bounds access happens:

[   13.671954] ==================================================================
[   13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110
[   13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10
[   13.673297]
[   13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3
[   13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04
[   13.673297] Call Trace:
[   13.673297]  
[   13.673297]  dump_stack_lvl+0x5f/0x80
[   13.673297]  print_report+0xd1/0x660
[   13.673297]  kasan_report+0xe5/0x120
[   13.673297]  __asan_report_load1_noabort+0x18/0x20
[   13.673297]  mt_report_fixup+0x103/0x110
[   13.673297]  hid_open_report+0x1ef/0x810
[   13.673297]  mt_probe+0x422/0x960
[   13.673297]  hid_device_probe+0x2e2/0x6f0
[   13.673297]  really_probe+0x1c6/0x6b0
[   13.673297]  __driver_probe_device+0x24f/0x310
[   13.673297]  driver_probe_device+0x4e/0x220
[   13.673297]  __device_attach_driver+0x169/0x320
[   13.673297]  bus_for_each_drv+0x11d/0x1b0
[   13.673297]  __device_attach+0x1b8/0x3e0
[   13.673297]  device_initial_probe+0x12/0x20
[   13.673297]  bus_probe_device+0x13d/0x180
[   13.673297]  device_add+0xe3a/0x1670
[   13.673297]  hid_add_device+0x31d/0xa40
[...]

Fixes: c8000deb6836 ("HID: multitouch: Add support for GT7868Q")
Cc: stable@vger.kernel.org
Signed-off-by: Qasim Ijaz 
Reviewed-by: Jiri Slaby 
Signed-off-by: Jiri Kosina

Merge branch 'for-6.17/multitouch' into for-linus

2025-07-31T20:51:29+00:00

- support for Touch Bars on x86 MacBook Pros (Kerem Karabay)

Merge tag 'hid-for-linus-2025062701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

2025-06-27T00:06:01+00:00

Pull HID fixes from Jiri Kosina:

 - fix for stalls during suspend/resume cycles with hid-nintendo (Daniel
   J. Ogorchock)

 - memory leak and reference count fixes in hid-wacom and in-appletb-kdb
   (Qasim Ijaz)

 - race condition (leading to kernel crash) fix during device removal in
   hid-wacom (Thomas Zeitlhofer)

 - fix for missed interrupt in intel-thc-hid (Intel-thc-hid:)

 - support for a bunch of new device IDs

* tag 'hid-for-linus-2025062701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
  HID: appletb-kbd: fix "appletb_backlight" backlight device reference counting
  HID: wacom: fix crash in wacom_aes_battery_handler()
  HID: intel-ish-hid: ipc: Add Wildcat Lake PCI device ID
  hid: intel-ish-hid: Use PCI_DEVICE_DATA() macro for ISH device table
  HID: lenovo: Restrict F7/9/11 mode to compact keyboards only
  HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
  HID: input: lower message severity of 'No inputs registered, leaving' to debug
  HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
  HID: Intel-thc-hid: Intel-quicki2c: Enhance QuickI2C reset flow
  HID: nintendo: avoid bluetooth suspend/resume stalls
  HID: wacom: fix kobject reference count leak
  HID: wacom: fix memory leak on sysfs attribute creation failure
  HID: wacom: fix memory leak on kobject creation failure

HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2

2025-06-20T07:10:14+00:00

Add "Thinkpad X1 Tablet Gen 2 Keyboard" PID to hid-lenovo driver to fix trackpoint not working issue.

Signed-off-by: Akira Inoue 
Signed-off-by: Jiri Kosina

HID: multitouch: add device ID for Apple Touch Bar

2025-06-11T09:25:26+00:00

This patch adds the device ID of Apple Touch Bar found on x86 MacBook Pros
to the hid-multitouch driver.

Note that this is device ID is for T2 Macs. Testing on T1 Macs would be
appreciated.

Signed-off-by: Kerem Karabay 
Co-developed-by: Aditya Garg 
Signed-off-by: Aditya Garg 
Signed-off-by: Jiri Kosina

HID: multitouch: specify that Apple Touch Bar is direct

2025-06-11T09:25:26+00:00

Currently the driver determines the device type based on the
application, but this value is not reliable on Apple Touch Bar, where
the application is HID_DG_TOUCHPAD even though this device is direct,
so add a quirk for the same.

Acked-by: Benjamin Tissoires 
Signed-off-by: Kerem Karabay 
Co-developed-by: Aditya Garg 
Signed-off-by: Aditya Garg 
Signed-off-by: Jiri Kosina

HID: multitouch: take cls->maxcontacts into account for Apple Touch Bar even without a HID_DG_CONTACTMAX field

2025-06-11T09:25:26+00:00

In Apple Touch Bar, the HID_DG_CONTACTMAX is not present, but the maximum
contact count is still greater than the default. Add quirks for the same.

Acked-by: Benjamin Tissoires 
Signed-off-by: Kerem Karabay 
Co-developed-by: Aditya Garg 
Signed-off-by: Aditya Garg 
Signed-off-by: Jiri Kosina

HID: multitouch: support getting the tip state from HID_DG_TOUCH fields in Apple Touch Bar

2025-06-11T09:25:26+00:00

In Apple Touch Bar, the tip state is contained in fields with the
HID_DG_TOUCH usage. This feature is gated by a quirk in order to
prevent breaking other devices, see commit c2ef8f21ea8f
("HID: multitouch: add support for trackpads").

Acked-by: Benjamin Tissoires 
Signed-off-by: Kerem Karabay 
Co-developed-by: Aditya Garg 
Signed-off-by: Aditya Garg 
Signed-off-by: Jiri Kosina

HID: multitouch: Get the contact ID from HID_DG_TRANSDUCER_INDEX fields in case of Apple Touch Bar

2025-06-11T09:25:26+00:00

In Apple Touch Bar, the contact ID is contained in fields with the
HID_DG_TRANSDUCER_INDEX usage rather than HID_DG_CONTACTID, thus differing
from the HID spec. Add a quirk for the same.

Acked-by: Benjamin Tissoires 
Signed-off-by: Kerem Karabay 
Co-developed-by: Aditya Garg 
Signed-off-by: Aditya Garg 
Signed-off-by: Jiri Kosina

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08T07:07:37+00:00

Move this API to the canonical timer_*() namespace.

[ tglx: Redone against pre rc1 ]

Signed-off-by: Ingo Molnar 
Signed-off-by: Thomas Gleixner 
Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com