linux-toradex.git/drivers/input, branch v6.19-rc2 Linux kernel for Apalis and Colibri modules Merge tag 'input-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2025-12-21T23:21:10+00:00 Linus Torvalds torvalds@linux-foundation.org 2025-12-21T23:21:10+00:00 10a0e846d806b779a059b6ee35df729b96cc3ad1 Pull input fixes from Dmitry Torokhov: - a quirk for i8042 to better handle another TUXEDO model - a quirk to atkbd to handle incorcet behavior of HONOR FMB-P internal keyboard - a definition for a new ABS_SND_PROFILE event - fixes to alps and lkkbd drivers to reliably shut down pending work on removal - a fix to apple_z2 driver tightening input report parsing - a fix for "off-by-one" error when validating config in ti_am335x_tsc driver - addition of CRKD Guitars device IDs to xpad driver. * tag 'input-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: ti_am335x_tsc - fix off-by-one error in wire_order validation Input: xpad - add support for CRKD Guitars Input: add ABS_SND_PROFILE Input: apple_z2 - fix reading incorrect reports after exiting sleep Input: alps - fix use-after-free bugs caused by dev3_register_work Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Input: lkkbd - disable pending work before freeing device 
Pull input fixes from Dmitry Torokhov:

 - a quirk for i8042 to better handle another TUXEDO model

 - a quirk to atkbd to handle incorcet behavior of HONOR FMB-P internal
   keyboard

 - a definition for a new ABS_SND_PROFILE event

 - fixes to alps and lkkbd drivers to reliably shut down pending work on
   removal

 - a fix to apple_z2 driver tightening input report parsing

 - a fix for "off-by-one" error when validating config in ti_am335x_tsc
   driver

 - addition of CRKD Guitars device IDs to xpad driver.

* tag 'input-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
  Input: xpad - add support for CRKD Guitars
  Input: add ABS_SND_PROFILE
  Input: apple_z2 - fix reading incorrect reports after exiting sleep
  Input: alps - fix use-after-free bugs caused by dev3_register_work
  Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
  Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
  Input: lkkbd - disable pending work before freeing device
Input: ti_am335x_tsc - fix off-by-one error in wire_order validation 2025-12-19T06:00:07+00:00 Junjie Cao junjie.cao@intel.com 2025-12-19T05:56:59+00:00 248d3a73a0167dce15ba100477c3e778c4787178 The current validation 'wire_order[i] > ARRAY_SIZE(config_pins)' allows wire_order[i] to equal ARRAY_SIZE(config_pins), which causes out-of-bounds access when used as index in 'config_pins[wire_order[i]]'. Since config_pins has 4 elements (indices 0-3), the valid range for wire_order should be 0-3. Fix the off-by-one error by using >= instead of > in the validation check. Signed-off-by: Junjie Cao <junjie.cao@intel.com> Link: https://patch.msgid.link/20251114062817.852698-1-junjie.cao@intel.com Fixes: bb76dc09ddfc ("input: ti_am33x_tsc: Order of TSC wires, made configurable") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
The current validation 'wire_order[i] > ARRAY_SIZE(config_pins)' allows
wire_order[i] to equal ARRAY_SIZE(config_pins), which causes out-of-bounds
access when used as index in 'config_pins[wire_order[i]]'.

Since config_pins has 4 elements (indices 0-3), the valid range for
wire_order should be 0-3. Fix the off-by-one error by using >= instead
of > in the validation check.

Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Link: https://patch.msgid.link/20251114062817.852698-1-junjie.cao@intel.com
Fixes: bb76dc09ddfc ("input: ti_am33x_tsc: Order of TSC wires, made configurable")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: xpad - add support for CRKD Guitars 2025-12-19T05:50:07+00:00 Sanjay Govind sanjay.govind9@gmail.com 2025-11-29T07:37:11+00:00 806ec7b797adc1cc9b11535307638a55ddfb873c Add support for various CRKD Guitar Controllers. Signed-off-by: Sanjay Govind <sanjay.govind9@gmail.com> Link: https://patch.msgid.link/20251129073720.2750-2-sanjay.govind9@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Add support for various CRKD Guitar Controllers.

Signed-off-by: Sanjay Govind <sanjay.govind9@gmail.com>
Link: https://patch.msgid.link/20251129073720.2750-2-sanjay.govind9@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: apple_z2 - fix reading incorrect reports after exiting sleep 2025-12-18T20:17:10+00:00 Sasha Finkelstein fnkl.kernel@gmail.com 2025-12-18T18:15:23+00:00 d579478cee228bdc0029a0c12a1f6a63ea9d1c77 Under certain conditions (more prevalent after a suspend/resume cycle), the touchscreen controller can send the "boot complete" interrupt before it actually finished booting. In those cases, attempting to read touch data resuls in a stream of "not ready" messages being read and interpreted as a touch report. Check that the response is in fact a touch report and discard it otherwise. Reported-by: pitust <piotr@stelmaszek.com> Closes: https://oftc.catirclogs.org/asahi/2025-12-17#34878715; Fixes: 471a92f8a21a ("Input: apple_z2 - add a driver for Apple Z2 touchscreens") Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com> Link: https://patch.msgid.link/20251218-z2-init-fix-v1-1-48e3aa239caf@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Under certain conditions (more prevalent after a suspend/resume cycle),
the touchscreen controller can send the "boot complete" interrupt before
it actually finished booting. In those cases, attempting to read touch
data resuls in a stream of "not ready" messages being read and
interpreted as a touch report. Check that the response is in fact a
touch report and discard it otherwise.

Reported-by: pitust <piotr@stelmaszek.com>
Closes: https://oftc.catirclogs.org/asahi/2025-12-17#34878715;
Fixes: 471a92f8a21a ("Input: apple_z2 - add a driver for Apple Z2 touchscreens")
Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com>
Link: https://patch.msgid.link/20251218-z2-init-fix-v1-1-48e3aa239caf@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: alps - fix use-after-free bugs caused by dev3_register_work 2025-12-17T18:08:44+00:00 Duoming Zhou duoming@zju.edu.cn 2025-12-17T03:00:17+00:00 bf40644ef8c8a288742fa45580897ed0e0289474 The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare PS/2 packet from an external PS/2 device connected to the ALPS touchpad. During device detachment, the original implementation calls flush_workqueue() in psmouse_disconnect() to ensure completion of dev3_register_work. However, the flush_workqueue() in psmouse_disconnect() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after flush_workqueue() has finished executing, the dev3_register_work could still be scheduled. Although the psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(), the scheduling of dev3_register_work remains unaffected. The race condition can occur as follows: CPU 0 (cleanup path) | CPU 1 (delayed work) psmouse_disconnect() | psmouse_set_state() | flush_workqueue() | alps_report_bare_ps2_packet() alps_disconnect() | psmouse_queue_work() kfree(priv); // FREE | alps_register_bare_ps2_mouse() | priv = container_of(work...); // USE | priv->dev3 // USE Add disable_delayed_work_sync() in alps_disconnect() to ensure that dev3_register_work is properly canceled and prevented from executing after the alps_data structure has been deallocated. This bug is identified by static analysis. Fixes: 04aae283ba6a ("Input: ALPS - do not mix trackstick and external PS/2 mouse data") Cc: stable@kernel.org Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Link: https://patch.msgid.link/b57b0a9ccca51a3f06be141bfc02b9ffe69d1845.1765939397.git.duoming@zju.edu.cn Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
The dev3_register_work delayed work item is initialized within
alps_reconnect() and scheduled upon receipt of the first bare
PS/2 packet from an external PS/2 device connected to the ALPS
touchpad. During device detachment, the original implementation
calls flush_workqueue() in psmouse_disconnect() to ensure
completion of dev3_register_work. However, the flush_workqueue()
in psmouse_disconnect() only blocks and waits for work items that
were already queued to the workqueue prior to its invocation. Any
work items submitted after flush_workqueue() is called are not
included in the set of tasks that the flush operation awaits.
This means that after flush_workqueue() has finished executing,
the dev3_register_work could still be scheduled. Although the
psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(),
the scheduling of dev3_register_work remains unaffected.

The race condition can occur as follows:

CPU 0 (cleanup path)     | CPU 1 (delayed work)
psmouse_disconnect()     |
  psmouse_set_state()    |
  flush_workqueue()      | alps_report_bare_ps2_packet()
  alps_disconnect()      |   psmouse_queue_work()
    kfree(priv); // FREE | alps_register_bare_ps2_mouse()
                         |   priv = container_of(work...); // USE
                         |   priv->dev3 // USE

Add disable_delayed_work_sync() in alps_disconnect() to ensure
that dev3_register_work is properly canceled and prevented from
executing after the alps_data structure has been deallocated.

This bug is identified by static analysis.

Fixes: 04aae283ba6a ("Input: ALPS - do not mix trackstick and external PS/2 mouse data")
Cc: stable@kernel.org
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://patch.msgid.link/b57b0a9ccca51a3f06be141bfc02b9ffe69d1845.1765939397.git.duoming@zju.edu.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table 2025-12-15T18:14:36+00:00 Christoffer Sandberg cs@tuxedo.de 2025-11-24T20:31:34+00:00 aed3716db7fff74919cc5775ca3a80c8bb246489 The device occasionally wakes up from suspend with missing input on the internal keyboard and the following suspend attempt results in an instant wake-up. The quirks fix both issues for this device. Signed-off-by: Christoffer Sandberg <cs@tuxedo.de> Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251124203336.64072-1-wse@tuxedocomputers.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
The device occasionally wakes up from suspend with missing input on the
internal keyboard and the following suspend attempt results in an instant
wake-up. The quirks fix both issues for this device.

Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251124203336.64072-1-wse@tuxedocomputers.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard 2025-12-15T18:12:54+00:00 Cryolitia PukNgae cryolitia.pukngae@linux.dev 2025-10-23T19:42:25+00:00 2aaf33c6e1e82561d7dce2345298a985a2483266 After commit 9cf6e24c9fbf17e52de9fff07f12be7565ea6d61 ("Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID"), HONOR FMB-P, aka HONOR MagicBook Pro 14 2025's internal keyboard stops working. Adding the atkbd_deactivate_fixup quirk fixes it. DMI: HONOR FMB-P/FMB-P-PCB, BIOS 1.13 05/08/2025 Fixes: 9cf6e24c9fbf17e52de9fff07f12be7565ea6d61 ("Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID") Reported-by: Mikura Kyouka <mikurakyouka@aosc.io> Reported-by: foad.elkhattabi <foad.elkhattabi@gmail.com> Signed-off-by: Cryolitia PukNgae <cryolitia.pukngae@linux.dev> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://patch.msgid.link/20251022-honor-v1-1-ff894ed271a9@linux.dev Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
After commit 9cf6e24c9fbf17e52de9fff07f12be7565ea6d61 ("Input: atkbd -
do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID"), HONOR
FMB-P, aka HONOR MagicBook Pro 14 2025's internal keyboard stops
working. Adding the atkbd_deactivate_fixup quirk fixes it.

DMI: HONOR FMB-P/FMB-P-PCB, BIOS 1.13 05/08/2025

Fixes: 9cf6e24c9fbf17e52de9fff07f12be7565ea6d61 ("Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID")
Reported-by: Mikura Kyouka <mikurakyouka@aosc.io>
Reported-by: foad.elkhattabi <foad.elkhattabi@gmail.com>
Signed-off-by: Cryolitia PukNgae <cryolitia.pukngae@linux.dev>
Reviewed-by: Hans de Goede <hansg@kernel.org>
Link: https://patch.msgid.link/20251022-honor-v1-1-ff894ed271a9@linux.dev
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: lkkbd - disable pending work before freeing device 2025-12-12T08:45:23+00:00 Minseong Kim ii4gsp@gmail.com 2025-12-12T08:29:23+00:00 e58c88f0cb2d8ed89de78f6f17409d29cfab6c5c lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work handler lkkbd_reinit() dereferences the lkkbd structure and its serio/input_dev fields. lkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd structure without preventing the reinit work from being queued again until serio_close() returns. This can allow the work handler to run after the structure has been freed, leading to a potential use-after-free. Use disable_work_sync() instead of cancel_work_sync() to ensure the reinit work cannot be re-queued, and call it both in lkkbd_disconnect() and in lkkbd_connect() error paths after serio_open(). Signed-off-by: Minseong Kim <ii4gsp@gmail.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251212052314.16139-1-ii4gsp@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work
handler lkkbd_reinit() dereferences the lkkbd structure and its
serio/input_dev fields.

lkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd
structure without preventing the reinit work from being queued again
until serio_close() returns. This can allow the work handler to run
after the structure has been freed, leading to a potential use-after-free.

Use disable_work_sync() instead of cancel_work_sync() to ensure the
reinit work cannot be re-queued, and call it both in lkkbd_disconnect()
and in lkkbd_connect() error paths after serio_open().

Signed-off-by: Minseong Kim <ii4gsp@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251212052314.16139-1-ii4gsp@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Merge tag 'input-for-v6.19-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2025-12-10T07:44:18+00:00 Linus Torvalds torvalds@linux-foundation.org 2025-12-10T07:44:18+00:00 db28b8ae363b9d05ab3779127514d2e81fe03ab1 Pull input updates from Dmitry Torokhov: - DT bindings for Melfas MIP4 touchscreen controller and TWL4030 keypad have been converted to the DT schema - simple touch controller bindings have been consolidated to trivial-touch.yaml DT schema - memory allocation failure noise was removed from qnap-mcu-input and zforce_ts dirvers - ti_am335x_tsc driver was hardened to handle invalid (too large) number of coordinates specified in device tree - a cleanup in Cypress cyttsp5 driver to use %pe to print error code * tag 'input-for-v6.19-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: ti_am335x_tsc - clamp coordinate_readouts to DT maximum (6) dt-bindings: touchscreen: consolidate simple touch controller to trivial-touch.yaml dt-bindings: touchscreen: trivial-touch: add reset-gpios and wakeup-source dt-bindings: input: ti,twl4030-keypad: convert to DT schema Input: zforce_ts - omit error message when memory allocation fails Input: qnap-mcu-input - omit error message when memory allocation fails dt-bindings: input: Convert MELFAS MIP4 Touchscreen to DT schema dt-bindings: touchscreen: move ar1021.txt to trivial-touch.yaml dt-bindings: touchscreen: rename maxim,max11801.yaml to trivial-touch.yaml Input: cyttsp5 - use %pe format specifier 
Pull input updates from Dmitry Torokhov:

 - DT bindings for Melfas MIP4 touchscreen controller and TWL4030 keypad
   have been converted to the DT schema

 - simple touch controller bindings have been consolidated to
   trivial-touch.yaml DT schema

 - memory allocation failure noise was removed from qnap-mcu-input and
   zforce_ts dirvers

 - ti_am335x_tsc driver was hardened to handle invalid (too large)
   number of coordinates specified in device tree

 - a cleanup in Cypress cyttsp5 driver to use %pe to print error code

* tag 'input-for-v6.19-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: ti_am335x_tsc - clamp coordinate_readouts to DT maximum (6)
  dt-bindings: touchscreen: consolidate simple touch controller to trivial-touch.yaml
  dt-bindings: touchscreen: trivial-touch: add reset-gpios and wakeup-source
  dt-bindings: input: ti,twl4030-keypad: convert to DT schema
  Input: zforce_ts - omit error message when memory allocation fails
  Input: qnap-mcu-input - omit error message when memory allocation fails
  dt-bindings: input: Convert MELFAS MIP4 Touchscreen to DT schema
  dt-bindings: touchscreen: move ar1021.txt to trivial-touch.yaml
  dt-bindings: touchscreen: rename maxim,max11801.yaml to trivial-touch.yaml
  Input: cyttsp5 - use %pe format specifier
Merge branch 'next' into for-linus 2025-12-09T01:52:57+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2025-12-09T01:52:57+00:00 429c4727011ead99129b14dc9ff4c87a747a50ab Prepare input updates for 6.19 merge window. 
Prepare input updates for 6.19 merge window.