kernel/git/next/linux-next.git/drivers/input, branch master

Merge branch 'headers' of git://git.infradead.org/users/willy/pagecache.git

2026-09-07T13:49:19+00:00

# Conflicts: # net/ceph/osd_client.c

Merge branch 'next' of https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git

2026-09-07T13:27:18+00:00

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux.git

2026-09-07T12:25:18+00:00

Merge branch 'for-linus' of https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git

2026-09-07T11:56:13+00:00

treewide: refresh kmalloc_obj() conversions

2026-09-05T04:37:00+00:00

This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook

Input: samsung-keypad - remove support for platform data

2026-09-04T14:06:43+00:00

Because there are no more users of samsung_keypad_platdata left in the kernel remove support for it from the driver. The driver supports generic device properties so all configuration should be done using them instead of a custom platform data. Acked-by: Bartosz Golaszewski Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/20260711-samsung-kp-v3-5-b2fcaba77aff@gmail.com Signed-off-by: Krzysztof Kozlowski

Input: samsung-keypad - handle compact binding

2026-09-04T14:06:01+00:00

Add support for standard matrix keymap binding (in addition to the existing verbose binding with a sub-node for each key). This will allow easier conversions from platform data to device properties when using static device properties. Acked-by: Bartosz Golaszewski Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/20260711-samsung-kp-v3-2-b2fcaba77aff@gmail.com Signed-off-by: Krzysztof Kozlowski

Input: cyttsp5 - clamp the HID report size before memcpy

2026-09-01T14:40:51+00:00

The size field comes from the device and is used as the memcpy() length into response_buf, which is CY_MAX_INPUT bytes. Fixes: 5b0c03e24a06 ("Input: Add driver for Cypress Generation 5 touchscreen") Signed-off-by: Linkai Gong Link: https://patch.msgid.link/20260901122649.1173066-1-gonglinkai@kylinos.cn Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov

Input: zero ff_effect before compat copy in input_ff_effect_from_user

2026-09-01T14:38:07+00:00

In the compat path input_ff_effect_from_user() aliases the caller's native struct ff_effect with the smaller struct ff_effect_compat and copies only the compat sized prefix: compat_effect = (struct ff_effect_compat *)effect; if (copy_from_user(compat_effect, buffer, sizeof(struct ff_effect_compat))) The tail of the native structure is never written. Callers pass an uninitialized on-stack object, for example evdev_do_ioctl() for EVIOCSFF, so those bytes keep their previous stack contents. input_ff_upload() then stores the full native structure in ff->effects[id], from where a uinput based force feedback daemon can read it back via UI_BEGIN_FF_UPLOAD, disclosing kernel stack memory to userspace. Zero the effect before the compat copy. Fixes: 2d56f3a32c0e ("Input: refactor evdev 32bit compat to be shareable with uinput") Cc: stable@vger.kernel.org Signed-off-by: Iván Ezequiel Rodriguez Link: https://patch.msgid.link/20260901130629.24078-3-ivanrwcm25@gmail.com Signed-off-by: Dmitry Torokhov

Input: evdev - zero absinfo before partial copy in EVIOCSABS

2026-09-01T14:38:07+00:00

The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct input_absinfo: if (copy_from_user(&abs, p, min_t(size_t, size, sizeof(struct input_absinfo)))) The size comes from _IOC_SIZE() of the ioctl command and is therefore fully controlled by userspace. A short size leaves the trailing part of the structure holding whatever was on the kernel stack, and the whole structure is then stored into the device: dev->absinfo[t] = abs; EVIOCGABS hands that back to userspace, disclosing the stale stack bytes. Only the resolution field is currently cleared, which covers the legacy struct layout but not an arbitrarily short size. Zero the structure before the copy so any part not supplied by the caller reads back as zero. The existing resolution fixup is kept, since it also handles a size that partially overlaps that field. Fixes: 448cd1664a57 ("Input: evdev - rearrange ioctl handling") Cc: stable@vger.kernel.org Signed-off-by: Iván Ezequiel Rodriguez Link: https://patch.msgid.link/20260901130629.24078-2-ivanrwcm25@gmail.com Signed-off-by: Dmitry Torokhov