Re: [PATCH] HID: asus: fix touchpad multitouch initialization regression

[Denis Benato]

On 8/18/26 10:56, Panz Dev wrote:
> In Linux 7.1, commit 7253091766de ("HID: asus: do not abort probe when not necessary")
> and commit 0919db9f3583 ("HID: asus: always fully initialize devices")
> introduced regressions in the probe sequence for ASUS I2C/HID touchpads
> (such as on the ASUS E200HA):
>
> 1. asus_start_multitouch() was placed inside the claimed input check block:
>      if (drvdata->input && (hdev->claimed & HID_CLAIMED_INPUT))
>    On ASUS touchpads, (hdev->claimed & HID_CLAIMED_INPUT) evaluates to
>    false during asus_probe(), skipping asus_start_multitouch().
>
> 2. The asus_report_id_init loop in asus_probe() was executed unconditionally
>    for all devices, which sends keyboard initialization feature requests
>    (asus_kbd_init) to touchpad endpoints, corrupting touchpad probe state.
>
> This patch fixes both issues by:
> - Skipping keyboard report initialization for touchpad devices (!drvdata->tp).
> - Moving asus_start_multitouch() outside the claimed input check block so
>   multitouch initialization is always executed for touchpads.
>
> Tested on ASUS E200HA (where touchpad functionality is fully restored)
> and ASUS VivoBook Flip 14 TP401MA (confirming zero regressions).
Hi,

thanks for this! I forgot to exclude touchpads from that init sequence.
> Fixes: 7253091766de ("HID: asus: do not abort probe when not necessary")
> Fixes: 0919db9f3583 ("HID: asus: always fully initialize devices")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Panz Dev <panz.development@xxxxxxxxx>
> ---
>  drivers/hid/hid-asus.c | 22 ++++++++++++----------
>  1 file changed, 12 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
> index 3f5e96900b67..7f19ca1e5a1b 100644
> --- a/drivers/hid/hid-asus.c
> +++ b/drivers/hid/hid-asus.c
> @@ -1294,12 +1294,14 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id)
>  		return ret;
>  	}
>
> -	for (int r = 0; r < ARRAY_SIZE(asus_report_id_init); r++) {
> -		if (asus_has_report_id(hdev, asus_report_id_init[r])) {
> -			ret = asus_kbd_init(hdev, asus_report_id_init[r]);
> -			if (ret < 0)
> -				hid_warn(hdev, "Failed to initialize 0x%x: %d.\n",
> -					 asus_report_id_init[r], ret);
> +	if (!drvdata->tp) {
> +		for (int r = 0; r < ARRAY_SIZE(asus_report_id_init); r++) {
> +			if (asus_has_report_id(hdev, asus_report_id_init[r])) {
> +				ret = asus_kbd_init(hdev, asus_report_id_init[r]);
> +				if (ret < 0)
> +					hid_warn(hdev, "Failed to initialize 0x%x: %d.\n",
> +						 asus_report_id_init[r], ret);
> +			}
>  		}
>  	}
>
> @@ -1327,12 +1329,12 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id)
>  			drvdata->input->name = "Asus TouchPad";
>  		else
>  			drvdata->input->name = "Asus Keyboard";
> +	}
>
> -		if (drvdata->tp) {
> -			ret = asus_start_multitouch(hdev);
> -			if (ret)
> -				goto err_stop_hw;
> -		}
> +	if (drvdata->tp) {
> +		ret = asus_start_multitouch(hdev);
> +		if (ret)
> +			goto err_stop_hw;
>  	}
I think this will re-introduce the security vulnerability fixed in the commit that led to me
creating the "HID: asus: do not abort probe when unnecessary"...

Furthermore if that drvdata->input && (hdev->claumed & HID_CLAIMED_INPUT) doesn't
evaluate to true it would be useful to know what part is false and that code that prevents
null/invalid dereference is wrong, and since I tried touching it the least possible it means
there is also the need to change the && back into ||, but that would undo the "keep the
proper name of the device" for keyboards...

With these in mind would you want to try fixing them all at once?
>  	return 0;