[GIT PULL] HID fixes
From: Jiri Kosina
Date: Wed Jul 08 2026 - 08:06:45 EST
Linus,
please pull from
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git tags/hid-for-linus-2026070801
to receive HID subsystem fixes queue, namely:
=====
- OOB, UAF, NULL-deref fixes in core and picolcd, logitech, letsketch,
appleir and multitouch drivers (Georgiy Osokin, HyeongJun An, Lee Jones,
Manish Khadka, Maoyi Xie and Trung Nguyen)
- fix for integer wraparound (and corresponding regression selftest) in
hid-bpf (Yiyang Chen)
=====
Thanks!
----------------------------------------------------------------
Georgiy Osokin (1):
HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
HyeongJun An (1):
HID: logitech-dj: Fix maxfield check in DJ short report validation
Lee Jones (1):
HID: core: Fix OOB read in hid_get_report for numbered reports
Manish Khadka (2):
HID: letsketch: fix UAF on inrange_timer at driver unbind
HID: appleir: fix UAF on pending key_up_timer in remove()
Maoyi Xie (1):
HID: lg-g15: cancel pending work on remove to fix a use-after-free
Trung Nguyen (2):
HID: multitouch: fix out-of-bounds bit access on mt_io_flags
selftests/hid: multitouch: test a large ContactCountMaximum
Yiyang Chen (3):
HID: bpf: Fix hid_bpf_get_data() range check
selftests/hid: Load only requested struct_ops maps
selftests/hid: Cover hid_bpf_get_data() size overflow
drivers/hid/bpf/hid_bpf_dispatch.c | 5 +-
drivers/hid/hid-appleir.c | 45 ++++++--
drivers/hid/hid-core.c | 7 ++
drivers/hid/hid-letsketch.c | 36 ++++++-
drivers/hid/hid-lg-g15.c | 16 +++
drivers/hid/hid-logitech-dj.c | 9 +-
drivers/hid/hid-multitouch.c | 32 +++---
drivers/hid/hid-picolcd_core.c | 3 +-
tools/testing/selftests/hid/Makefile | 2 +-
tools/testing/selftests/hid/hid_bpf.c | 36 +++++--
tools/testing/selftests/hid/progs/hid.c | 15 +++
.../testing/selftests/hid/tests/test_multitouch.py | 114 +++++++++++++++++++++
12 files changed, 283 insertions(+), 37 deletions(-)
--
Jiri Kosina
SUSE Labs