[PATCH AUTOSEL 6.18-5.10] HID: i2c-hid: Add i2c-hid-quirk-bad-input-size quirk for 0911:5288 device
From: Sasha Levin
Date: Mon Oct 19 2026 - 12:09:31 EST
From: Youth Cao <cocoh2os08@xxxxxxxxx>
[ Upstream commit 58d97b45f3f43af0afd9c74e8480d22d36fd3f72 ]
I have recently acquired a cheap Apollo Lake-based laptop that uses a
Hynitron CST128-A touchpad controller. While booting from a Debian LiveCD,
the kernel log is flooded with the following error (though the touchpad
works well):
i2c_hid_acpi i2c-ALPS0001:00: i2c_hid_get_input: incomplete report (27/42405)
The CST128-A was identified via ACPI as ALPS0001:00, and the I2C HID
device ID (0911:5288) was shared with the Hantick 5288.
Add the I2C_HID_QUIRK_BAD_INPUT_SIZE quirk option to the existing Hantick
5288 quirk entry to suppress the kernel log flood.
Signed-off-by: Youth Cao <cocoh2os08@xxxxxxxxx>
Signed-off-by: Jiri Kosina <jkosina@xxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---
LLM Generated explanations, may be completely bogus:
Local tree is **6.18.57** (`v6.18.57-155-gcdf239ca885b2`). This is a
one-line HID i2c-hid hardware quirk for device `0911:5288`. The quirk
table, `I2C_HID_QUIRK_BAD_INPUT_SIZE`, and the Hantick 5288 entry are
all already in this tree.
===============================================================
PHASE 1: COMMIT MESSAGE FORENSICS
===============================================================
Step 1.1: PARSE THE SUBJECT LINE
Record: **[HID/i2c-hid] [Add] hardware quirk
`I2C_HID_QUIRK_BAD_INPUT_SIZE` for I2C HID ID 0911:5288 (Hantick 5288 /
Hynitron CST128-A)**
Step 1.2: PARSE ALL COMMIT MESSAGE TAGS
Record:
- **Fixes:** none (expected for this review)
- **Reported-by:** none (author is the reporter: “I have recently
acquired…”)
- **Tested-by:** none
- **Reviewed-by:** none on the commit
- **Acked-by:** none
- **Link:** none on the commit; lore thread recovered via `b4 dig`
- **Cc: stable:** none (expected)
- **Signed-off-by:** Youth Cao (author); Jiri Kosina (HID maintainer,
applied it)
- Ignore pipeline SOBs/Upstream markers as instructed
Notable: HID maintainer SOB. Single reporter, real hardware.
Step 1.3: ANALYZE THE COMMIT BODY TEXT
Record:
- **Bug:** Hynitron CST128-A touchpad (ACPI `ALPS0001:00`, I2C HID ID
`0911:5288`) reports a bogus input length.
- **Symptom:** kernel log flooded with `i2c_hid_get_input: incomplete
report (27/42405)`. Touchpad still works.
- **Root cause:** device writes an invalid HID input length (42405 =
`0xA5A5`) while `wMaxInputLength` is 27.
- **Fix:** OR `I2C_HID_QUIRK_BAD_INPUT_SIZE` onto the existing Hantick
5288 quirk so the driver uses max input length instead of dropping the
report and calling unratelimited `dev_err()`.
- **Version info:** none in the message. Hardware is cheap Apollo Lake
laptops; driver support for this ID dates to 2017.
Step 1.4: DETECT HIDDEN BUG FIXES
Record: Not a disguised cleanup. Explicit hardware quirk. Same class as
USB/PCI/codec quirks that stable already takes.
===============================================================
PHASE 2: DIFF ANALYSIS - LINE BY LINE
===============================================================
Step 2.1: INVENTORY THE CHANGES
Record:
- **File:** `drivers/hid/i2c-hid/i2c-hid-core.c` — 1 insertion, 1
deletion
- **Function / data:** `i2c_hid_quirks[]` table, Hantick 5288 entry
- **Scope:** single-file, one-line surgical quirk
Step 2.2: UNDERSTAND THE CODE FLOW CHANGE
Record:
- **Before:** `0911:5288` only has `I2C_HID_QUIRK_NO_IRQ_AFTER_RESET`.
In `i2c_hid_get_input()`, if `ret_size > size || ret_size <
sizeof(__le16)`, the IRQ path logs `incomplete report` via `dev_err()`
(not ratelimited) and **returns without delivering the HID report**.
- **After:** same ID also has `I2C_HID_QUIRK_BAD_INPUT_SIZE`. On a bad
size, the driver overwrites the length prefix with `size`
(`min(wMaxInputLength, bufsize)`) and continues into
`hid_safe_input_report()`.
- **Path:** IRQ handler (`i2c_hid_irq` → `i2c_hid_get_input`), not
probe/error-init. Only this VID/PID.
Step 2.3: IDENTIFY THE BUG MECHANISM
Record:
- **Category:** hardware workaround (quirk table)
- **Mechanism:** device reports garbage length (`0xA5A5` / 42405).
Without the quirk, every such IRQ logs and drops the report. The quirk
is the existing BAD_INPUT_SIZE path added in 2019 for Lenovo Y720.
Verified BAD_INPUT_SIZE handler in this tree:
```561:570:drivers/hid/i2c-hid/i2c-hid-core.c
if (ret_size > size || ret_size < sizeof(__le16)) {
if (ihid->quirks & I2C_HID_QUIRK_BAD_INPUT_SIZE) {
*(__le16 *)ihid->inbuf = cpu_to_le16(size);
ret_size = size;
} else {
dev_err(&ihid->client->dev,
"%s: incomplete report (%d/%d)\n",
__func__, size, ret_size);
return;
```
`size` is already capped to `ihid->bufsize`, so forcing `ret_size =
size` does not overflow the input buffer.
Step 2.4: ASSESS THE FIX QUALITY
Record:
- Obviously correct: one flag on an existing table entry; handler
already used by Lenovo Y720 (`USB_VENDOR_ID_ITE` / Legion Y720) in
this tree.
- Minimal, no API/refactor.
- **Regression risk:** low. Quirk only runs when the length is already
invalid. Well-formed reports for other 0911:5288 boards (Cube Thinker,
EZBook 3 Pro, T-bao, etc. from Hans de Goede’s 2017 commit) are
unchanged. Worst case on a truly truncated packet is processing a
padded report instead of dropping it — same as Y720 since 2019.
===============================================================
PHASE 3: GIT HISTORY INVESTIGATION
===============================================================
Step 3.1: BLAME THE CHANGED LINES
Record:
- Hantick 5288 table entry introduced by **402946a8ef71e** (Hans de
Goede, 2017-11-07): `HID: i2c-hid: Add no-irq-after-reset quirk for
0911:5288 device`. Present in **v6.18.57**.
- `I2C_HID_QUIRK_BAD_INPUT_SIZE` introduced by **fd09137687016** (Pavel
Balan, 2019-11-27) for Lenovo Y720 incomplete-report flood. Present in
**v6.18.57**.
- Buggy combination (Hantick ID without BAD_INPUT_SIZE) has been in-tree
for years.
Step 3.2: FOLLOW THE FIXES: TAG
Record: No `Fixes:` tag. Not applicable. The “broken” state is hardware,
not a recent kernel regression.
Step 3.3: CHECK FILE HISTORY FOR RELATED CHANGES
Record:
- Same-file relatives: `fd09137687016` (Y720 BAD_INPUT_SIZE),
`402946a8ef71e` (Hantick NO_IRQ_AFTER_RESET), `fb6acf76c3fdd` (Raydium
incomplete-report flood).
- Not a numbered series. Standalone v1.
- Prerequisite code (quirk bit + table entry + handler) is in this tree.
No missing helpers.
Step 3.4: CHECK THE AUTHOR'S OTHER COMMITS
Record: Youth Cao has only this commit under `drivers/hid/i2c-hid/`
here. Not the maintainer. Applied by Jiri Kosina, HID maintainer.
Step 3.5: CHECK FOR DEPENDENT/PREREQUISITE COMMITS
Record: None beyond 2017/2019 infrastructure already in 6.18.57.
Standalone one-liner.
===============================================================
PHASE 4: MAILING LIST AND EXTERNAL RESEARCH
===============================================================
Step 4.1: FIND THE ORIGINAL PATCH DISCUSSION
Record:
- `b4 dig -c 58d97b45f3f43af0afd9c74e8480d22d36fd3f72` →
https://patch.msgid.link/20260903161444.786-1-cocoh2os08@xxxxxxxxx
- `b4 dig -a`: **v1 only** (2026-09-04). Applied as submitted.
- Thread: author submission; sashiko-bot flag of an **unrelated pre-
existing DMA** issue in `i2c_hid_fetch_hid_descriptor()`; Jiri Kosina
“Applied, thanks.” (2026-09-11).
- No NAK, no request for v2, no stable nomination in review.
Step 4.2: CHECK WHO REVIEWED THE PATCH
Record (`b4 dig -w`): To/Cc included Jiri Kosina, Benjamin Tissoires,
linux-input, linux-kernel. Maintainer applied it. No extra Reviewed-by.
Step 4.3: SEARCH FOR THE BUG REPORT
Record: The patch *is* the bug report. One user, Debian LiveCD, Apollo
Lake + CST128-A. Concrete log line. Author says the touchpad “works
well” aside from the flood.
Step 4.4: CHECK FOR RELATED PATCHES AND SERIES
Record: Standalone. Not 2/N. No sibling patches required.
Step 4.5: CHECK STABLE MAILING LIST HISTORY
Record: Web search of lore.kernel.org/stable for this subject/ID found
no prior stable discussion (lore HTTP 403 from this environment;
openwall/lkml used instead). **UNVERIFIED** that nobody requested it on
stable@, but nothing found arguing against it.
===============================================================
PHASE 5: CODE SEMANTIC ANALYSIS
===============================================================
Step 5.1: IDENTIFY KEY FUNCTIONS IN THE DIFF
Record: No function body changed. Data only: `i2c_hid_quirks[]`. Runtime
effect is in `i2c_hid_lookup_quirk()` and `i2c_hid_get_input()`.
Step 5.2: TRACE CALLERS
Record:
- `i2c_hid_lookup_quirk()` called from `__i2c_hid_core_probe()`
(`ihid->quirks = ...`) — device probe, once per device.
- `i2c_hid_get_input()` called from `i2c_hid_irq()` — interrupt context,
every input IRQ.
- Impact surface: only VID/PID 0911:5288.
Step 5.3: TRACE CALLEES
Record: After the quirk, path continues to `hid_safe_input_report()`
(present in v6.18.57). Input buffer already sized; length forced to
`size ≤ bufsize`.
Step 5.4: FOLLOW THE CALL CHAIN
Record: ACPI I2C HID enumeration (`i2c-hid-acpi`) → probe → IRQ on
touchpad activity. Reachable on real laptops without special syscalls.
`CONFIG_I2C_HID` is `default y`; `I2C_HID_ACPI` is the usual x86 laptop
path.
Step 5.5: SEARCH FOR SIMILAR PATTERNS
Record: Same quirk already used for Lenovo Legion Y720. Same “incomplete
report” flood class previously fixed (Y720, Raydium). Pattern is
established, not experimental.
===============================================================
PHASE 6: CROSS-REFERENCING AGAINST THE LOCAL TREE
===============================================================
Step 6.1: DOES THE BUGGY CODE EXIST IN THIS TREE?
Record: **Yes.** At v6.18.57:
```
{ I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
```
IDs in `drivers/hid/hid-ids.h`: `I2C_VENDOR_ID_HANTICK 0x0911`,
`I2C_PRODUCT_ID_HANTICK_5288 0x5288`. BAD_INPUT_SIZE bit and handler
exist. Bug introduced with this hardware + the 2017 ID match, not after
6.18 branched.
Step 6.2: CHECK FOR BACKPORT COMPLICATIONS
Record: **Minor context only.** `git apply --check` of the stored hunk
onto v6.18.57 fails because context includes the later Yoga Slim 7x
keyboard quirk line
(`I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD`), which is **not**
in v6.18.57. The Hantick line itself matches. A 1-line context tweak
applies cleanly. Not a semantic rework.
Step 6.3: CHECK IF RELATED FIXES ARE ALREADY HERE
Record: Y720 BAD_INPUT_SIZE is present. Nothing else already adds
BAD_INPUT_SIZE for 0911:5288 at v6.18.57. No alternate fix.
===============================================================
PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT
===============================================================
Step 7.1: IDENTIFY THE SUBSYSTEM AND ITS CRITICALITY
Record: **HID / i2c-hid** (`drivers/hid/i2c-hid/`). **IMPORTANT** for
laptop input (touchpads/touchscreens), not core mm/fs. Peripheral in the
sense of one cheap-laptop ID, but i2c-hid itself is common.
Step 7.2: ASSESS SUBSYSTEM ACTIVITY
Record: Actively maintained (Dell S4, Elan panel, QTEC, Goodix, buffer
overflow fixes in recent 6.18 history). Quirk table is a mature, long-
lived mechanism.
===============================================================
PHASE 8: IMPACT AND RISK ASSESSMENT
===============================================================
Step 8.1: DETERMINE WHO IS AFFECTED
Record: Driver/hardware-specific. Users of I2C HID `0911:5288` (Hantick
5288 clones, Hynitron CST128-A on cheap Apollo Lake laptops).
`CONFIG_I2C_HID` / `I2C_HID_ACPI`.
Step 8.2: DETERMINE THE TRIGGER CONDITIONS
Record: Touchpad IRQs that carry a bogus length. Author saw it at boot
on a Debian LiveCD, so it is not rare-on-error-only for this hardware.
Unprivileged users generate IRQs by using the pad; they cannot change
the VID/PID. Not a security trigger.
Step 8.3: DETERMINE THE FAILURE MODE SEVERITY
Record:
- **Failure mode:** unratelimited `dev_err()` from IRQ context →
dmesg/journal flood; those reports are dropped.
- **Severity:** **MEDIUM** as a log flood; can still hurt (console spam,
log wrap, hiding other messages). Not oops/deadlock/corruption. Author
says the pad still works, so some reports are valid.
- Hardware-quirk exception still applies.
Step 8.4: CALCULATE RISK-BENEFIT RATIO
Record:
- **Benefit:** medium for affected hardware (stops flood; may deliver
reports that were dropped). Low for everyone else (no code path
change).
- **Risk:** very low (1 line, existing quirk, ID-matched).
- **Ratio:** favorable. Classic stable quirk.
===============================================================
PHASE 9: FINAL SYNTHESIS
===============================================================
Step 9.1: COMPILE THE EVIDENCE
**FOR:**
- Real hardware, real user log, concrete `incomplete report (27/42405)`.
- Existing quirk infrastructure in 6.18.57; same pattern as Y720 (2019).
- One line, ID-scoped, no new API.
- HID maintainer applied v1 with no objections.
- Unratelimited `dev_err` in IRQ is a real nuisance on these machines.
- Stable exception: hardware quirk on an existing driver.
**AGAINST:**
- Not a crash, UAF, or data-corruption fix; author says the touchpad
already works.
- Applies to every 0911:5288, not only CST128-A/ALPS0001 (mitigated:
quirk inert on valid lengths).
- Naive apply onto bare v6.18.57 needs a tiny context tweak (Yoga Slim
line).
**UNRESOLVED:**
- Could not fetch lore.kernel.org (HTTP 403); used `b4 dig` mbox +
Openwall/LKML.
- No stable@ thread found; absence not treated as a negative.
Step 9.2: APPLY THE STABLE RULES CHECKLIST
1. Obviously correct and tested? **PASS** — one flag; author tested on
the laptop; maintainer applied.
2. Fixes a real bug that affects users? **PASS** — log flood + dropped
bad-size reports on real hardware.
3. Important issue? **PASS** under the hardware-quirk exception;
severity MEDIUM, not CRITICAL.
4. Small and contained? **PASS** — 1 line, one table entry.
5. No new features or APIs? **PASS** — reuses
`I2C_HID_QUIRK_BAD_INPUT_SIZE`.
6. Can apply to the local tree? **PASS** — code exists in 6.18.57; at
most a context-line adjustment.
Step 9.3: CHECK FOR EXCEPTION CATEGORIES
Record: **Hardware quirk/workaround** on an existing i2c-hid quirk
table. Explicitly in-scope for stable.
Step 9.4: MAKE YOUR DECISION
This should be backported to this 6.18.y tree. The buggy Hantick entry
and BAD_INPUT_SIZE handler are already here. The change is the standard
way this driver papers over broken input-length hardware.
What it solves for stable users: cheap Apollo Lake machines with
0911:5288 (Hynitron CST128-A / Hantick clones) stop flooding the log on
every bad-sized HID IRQ, matching the Y720 precedent.
Risk vs benefit: very low risk, localized benefit, no prerequisites
missing.
Concerns: trivial hunk-context conflict with the Yoga Slim quirk line if
applying the mainline diff onto unmodified v6.18.57; the Hantick line
itself does not need rework.
Verification:
- [Phase 1] Parsed subject/tags/body from `git show 245d6017beff2` /
upstream `58d97b45f3f4`; no Fixes/Reported-by/Cc:stable; SOB Youth Cao
+ Jiri Kosina
- [Phase 2] Diff is 1 line in `i2c_hid_quirks[]`; handler at
`i2c_hid_get_input()` lines 561–570 verified; `size` capped to
`bufsize` at 532–533
- [Phase 2] 42405 == 0xA5A5 verified arithmetically
- [Phase 3] `git merge-base --is-ancestor 402946a8ef71e v6.18.57` YES;
`fd09137687016` YES; this commit NOT in v6.18.57
- [Phase 3] `git blame -L 120,145 v6.18.57 --
drivers/hid/i2c-hid/i2c-hid-core.c`: Hantick entry from 402946a8ef71e
/ 67b18dfb8cfc6d
- [Phase 3] Author `git log --author='Youth Cao'` only this i2c-hid
commit
- [Phase 4] `b4 dig -c 58d97b45f3f4` → msgid 20260903161444.786-1; `-a`
v1 only; `-w` Kosina + Tissoires + linux-input; `-m` 3-message mbox
- [Phase 4] Openwall: Jiri Kosina “Applied, thanks.”; sashiko-bot pre-
existing DMA note unrelated
- [Phase 4] lore.kernel.org WebFetch 403; stable@ search found no
discussion of this ID
- [Phase 5] `git grep` callers: lookup at probe 1073; get_input from
`i2c_hid_irq` 592
- [Phase 5] `hid_safe_input_report` ancestor of v6.18.57: YES
- [Phase 6] `make kernelversion` / Makefile: 6.18.57; Hantick IDs in
v6.18.57 `hid-ids.h` 646–647
- [Phase 6] `git apply --check` of the stored hunk onto v6.18.57 fails
on Yoga Slim context line; Hantick source line identical
- [Phase 7] Kconfig: `I2C_HID` default y; `I2C_HID_ACPI` for this ACPI
path
- [Phase 8] Failure mode: IRQ `dev_err` flood + dropped reports; not
oops
- UNVERIFIED: full lore.kernel.org HTML thread (403); whether any
0911:5288 unit is harmed by processing bad-size frames (no reports
found)
**YES**
drivers/hid/i2c-hid/i2c-hid-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 29c4f624f3c5c..e5a4c7deba502 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -123,7 +123,7 @@ static const struct i2c_hid_quirks {
__u32 quirks;
} i2c_hid_quirks[] = {
{ I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
- I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
+ I2C_HID_QUIRK_NO_IRQ_AFTER_RESET | I2C_HID_QUIRK_BAD_INPUT_SIZE },
{ I2C_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_VOYO_WINPAD_A15,
I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
{ I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118,
--
2.53.0