kernel/git/stable/linux-stable.git/drivers/hid, branch linux-6.18.y

HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU

2026-09-14T11:35:56+00:00

[ Upstream commit 69226cd6fad7a07370ec9a009af1c174de7635c5 ] Commit b5e65ae557da ("HID: multitouch: Add quirk for Hantick 5288 touchpad") assigned MT_CLS_NSMU to the HTIX5288 (0911:5288). This was necessary because the device sometimes fails to send touch release signals when transitioning from >=2 fingers to <2 fingers, and MT_QUIRK_NOT_SEEN_MEANS_UP fixes stuck touches by treating missing contacts as released. However, MT_CLS_NSMU only carries MT_QUIRK_NOT_SEEN_MEANS_UP. It lacks MT_QUIRK_CONTACT_CNT_ACCURATE and MT_QUIRK_IGNORE_DUPLICATES. As a result, after a two-finger scroll finger lift, the device still reports stale coordinates from the released contact in subsequent frames, and the driver overwrites the remaining active slot with those frozen coordinates. The remaining finger appears stuck at the lift position until all fingers are lifted. This was confirmed via evtest on Arch Linux 7.1.3: after TRACKING_ID=-1 for the released slot, every subsequent frame contained duplicate position pairs -- the real moving finger's coordinates followed by the lifted finger's frozen position, both attributed to the active slot. Reclassify the device to MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU (0x0018), which preserves the original MT_QUIRK_NOT_SEEN_MEANS_UP fix while adding the necessary Win8 quirks (CONTACT_CNT_ACCURATE, IGNORE_DUPLICATES), preventing stale coordinate contamination. The additional FORCE_MULTI_INPUT flag is harmless here: it separates the mouse and touchpad collections into distinct input devices, which is the standard behavior libinput already expects. Fixes: b5e65ae557da ("HID: multitouch: Add quirk for Hantick 5288 touchpad") Signed-off-by: Xianglin Lin <1021538027@qq.com> Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: haptic: don't write an uninitialized value to unhandled usages

2026-09-14T11:35:56+00:00

[ Upstream commit 3efb7f6491526f5012f9ec94769e9ed832feeef8 ] fill_effect_buf() initializes value only for the four haptic usages handled by its switch, but writes it to field->value[] for every usage. An unhandled usage can therefore receive either an uninitialized value or one left over from the previous usage. hid_output_report() then serializes that value into the effect's report buffer. Skip unhandled usages instead. This also matches switch_mode(), which only updates fields it recognizes. Found with Clang's -Wconditional-uninitialized. Fixes: 344ff3584957 ("HID: haptic: initialize haptic device") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: lg4ff: validate report length before fixed offsets

2026-09-14T11:35:33+00:00

[ Upstream commit be00988cce4ed44db1e61231d0ab71a64bab44cd ] lg4ff_raw_event() rewrites fixed report offsets when combined pedals are enabled. It currently assumes that each product report contains every source and destination byte used by the rewrite. Return without rewriting a short report before each product-specific access. Apply the same bound to the computed offset path. Fixes: c832f86effbc ("HID: hid-logitech: Add combined pedal support Logitech wheels") Signed-off-by: Jiancheng Huang Assisted-by: Codex:gpt-5.6-luna Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure

2026-09-14T11:35:33+00:00

[ Upstream commit 8e2c560faea0220664169f7be4b498915ea1469f ] If enabling VDDIO fails after VDD has been enabled, the power-up path returns without disabling VDD. This leaves the regulator enabled and its enable count unbalanced. Disable VDD before returning the VDDIO error. Fixes: eb16f59e8e58 ("HID: i2c-hid: goodix: Add mainboard-vddio-supply") Signed-off-by: Chao Huang Reviewed-by: Douglas Anderson Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: steam: Reject short reads

2026-09-14T11:35:33+00:00

[ Upstream commit 33ff7b49c38b39b1f3d27db508ac0720fb25c08a ] Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential issue with short reads. Instead, we should actually verify the length of the read. Fixes: c164d6abf384 ("HID: add driver for Valve Steam Controller") Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=75f3f9bff8c510602d36 Signed-off-by: Vicki Pfau Link: https://syzkaller.appspot.com/bug?extid=75f3f9bff8c510602d36 Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin

HID: steam: Improve logging and other cleanup

2026-09-14T11:35:33+00:00

[ Upstream commit de435b770cd9492b803346b84df69fe345b845f2 ] Adds more logging as appropriate, reindents an enum to match surrounding style, as well as cleaning up some places where we can use guard() instead of doing locking and unlocking manually. Signed-off-by: Vicki Pfau Signed-off-by: Jiri Kosina Stable-dep-of: 33ff7b49c38b ("HID: steam: Reject short reads") Signed-off-by: Sasha Levin

HID: steam: Add support for sensor events on the Steam Controller (2015)

2026-09-14T11:35:33+00:00

[ Upstream commit 2eb7cf02b52156ebd19c7c14a7f5228c6adfcf97 ] Sensor support was added for the Steam Deck previously, but Steam Controller sensor events were never added. This adds that missing support, bringing Steam Controller support much closer to feature parity with things like SDL and Steam itself. Signed-off-by: Vicki Pfau Signed-off-by: Jiri Kosina Stable-dep-of: 33ff7b49c38b ("HID: steam: Reject short reads") Signed-off-by: Sasha Levin

HID: steam: Rename some constants that got renamed upstream

2026-09-14T11:35:32+00:00

[ Upstream commit 6afec3c8fff2af0050ca802c9b731303ce0e2b8e ] SETTING_MOUSE_POINTER_ENABLED was renamed to SETTING_LIZARD_MODE upstream. SETTING_GYRO_MODE was renamed to SETTING_IMU_MODE in an older commit, but the associated enum was overlooked. Signed-off-by: Vicki Pfau Signed-off-by: Jiri Kosina Stable-dep-of: 33ff7b49c38b ("HID: steam: Reject short reads") Signed-off-by: Sasha Levin

HID: steam: Refactor and clean up report parsing

2026-09-14T11:35:32+00:00

[ Upstream commit 3d3c6ab5b07e16ed73070076e4b7f5130da2404f ] This switches from a parsing style where each button or axis is parsed individually out of a report using !!(byte & BIT(x)) style. This commit switches it to a mostly unified approach of defining a list of individual mappings in an array and passing it to a function that handles all of the extraction. Theoretically this is more lines, but in practice it results in (subjectively) cleaner code. Some exceptions still need to be made for things like handling the lizard mode toggle key, but in general there's a lot less manual code. Signed-off-by: Vicki Pfau Signed-off-by: Jiri Kosina Stable-dep-of: 33ff7b49c38b ("HID: steam: Reject short reads") Signed-off-by: Sasha Levin

HID: i2c-hid: Fix "(null)" output when reading report descriptor fails

2026-09-14T11:35:32+00:00

[ Upstream commit 8da0f0951deec9f0728ed2d9c54ded1c344b7542 ] When i2c-hid fails to read the HID report descriptor during device initialization, the error message prints as: hid (null): reading report descriptor failed The HID device name is set in hid_add_device() after calling hdev->ll_driver->parse(), so when i2c_hid_parse() fails and calls hid_err(), the device name has not been set yet, resulting in "(null)" output. Use dev_err(&client->dev, ...) instead of hid_err(hid, ...) because the I2C client device is fully initialized with a proper name, providing meaningful error messages for debugging. Before: hid (null): reading report descriptor failed After: i2c_hid i2c-TPD0001:00: reading report descriptor failed Fixes: 4a200c3b9a40 ("HID: i2c-hid: introduce HID over i2c specification implementation") Signed-off-by: Ai Chao Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin