From 0919db9f358328060af5d2501905311000dfafc1 Mon Sep 17 00:00:00 2001 From: Denis Benato Date: Mon, 16 Feb 2026 18:55:39 +0100 Subject: [PATCH 1/7] HID: asus: always fully initialize devices ASUS has more devices other than laptop keyboards which needs to be initializated: the init sequence is the same as keyboards. ID1 and ID2 are USB report IDs that are correctly enumerated: send init commands to all devices that supports those reports IDs. Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina --- drivers/hid/hid-asus.c | 46 ++++++++++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 8ffcd12038e8..425f54b1b27e 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -101,7 +101,6 @@ MODULE_DESCRIPTION("Asus HID Keyboard and TouchPad"); #define QUIRK_ROG_CLAYMORE_II_KEYBOARD BIT(12) #define QUIRK_ROG_ALLY_XPAD BIT(13) #define QUIRK_HID_FN_LOCK BIT(14) -#define QUIRK_ROG_NKEY_ID1ID2_INIT BIT(15) #define I2C_KEYBOARD_QUIRKS (QUIRK_FIX_NOTEBOOK_REPORT | \ QUIRK_NO_INIT_REPORTS | \ @@ -208,6 +207,12 @@ static const struct asus_touchpad_info medion_e1239t_tp = { .report_size = 32 /* 2 byte header + 5 * 5 + 5 byte footer */, }; +static const u8 asus_report_id_init[] = { + FEATURE_KBD_REPORT_ID, + FEATURE_KBD_LED_REPORT_ID1, + FEATURE_KBD_LED_REPORT_ID2 +}; + static void asus_report_contact_down(struct asus_drvdata *drvdat, int toolType, u8 *data) { @@ -722,6 +727,21 @@ static void validate_mcu_fw_version(struct hid_device *hdev, int idProduct) } } +static bool asus_has_report_id(struct hid_device *hdev, u16 report_id) +{ + int t, f, u, err = 0; + struct hid_report *report; + + for (t = HID_INPUT_REPORT; t <= HID_FEATURE_REPORT; t++) { + list_for_each_entry(report, &hdev->report_enum[t].report_list, list) { + if (report->id == report_id) + return true; + } + } + + return false; +} + static int asus_kbd_register_leds(struct hid_device *hdev) { struct asus_drvdata *drvdata = hid_get_drvdata(hdev); @@ -730,9 +750,9 @@ static int asus_kbd_register_leds(struct hid_device *hdev) unsigned char kbd_func; int ret; - ret = asus_kbd_init(hdev, FEATURE_KBD_REPORT_ID); - if (ret < 0) - return ret; + /* Laptops keyboard backlight is always at 0x5a */ + if (asus_has_report_id(hdev, FEATURE_KBD_REPORT_ID)) + return -ENODEV; /* Get keyboard functions */ ret = asus_kbd_get_functions(hdev, &kbd_func, FEATURE_KBD_REPORT_ID); @@ -743,11 +763,6 @@ static int asus_kbd_register_leds(struct hid_device *hdev) if (!(kbd_func & SUPPORT_KBD_BACKLIGHT)) return -ENODEV; - if (drvdata->quirks & QUIRK_ROG_NKEY_ID1ID2_INIT) { - asus_kbd_init(hdev, FEATURE_KBD_LED_REPORT_ID1); - asus_kbd_init(hdev, FEATURE_KBD_LED_REPORT_ID2); - } - if (dmi_match(DMI_PRODUCT_FAMILY, "ProArt P16")) { ret = asus_kbd_disable_oobe(hdev); if (ret < 0) @@ -1294,6 +1309,15 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id) return ret; } + for (int r = 0; r < ARRAY_SIZE(asus_report_id_init); r++) { + if (asus_has_report_id(hdev, asus_report_id_init[r])) { + ret = asus_kbd_init(hdev, asus_report_id_init[r]); + if (ret < 0) + hid_warn(hdev, "Failed to initialize 0x%x: %d.\n", + asus_report_id_init[r], ret); + } + } + if (is_vendor && (drvdata->quirks & QUIRK_USE_KBD_BACKLIGHT) && asus_kbd_register_leds(hdev)) hid_warn(hdev, "Failed to initialize backlight.\n"); @@ -1477,10 +1501,10 @@ static const struct hid_device_id asus_devices[] = { QUIRK_USE_KBD_BACKLIGHT }, { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD), - QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD | QUIRK_ROG_NKEY_ID1ID2_INIT }, + QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD2), - QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD | QUIRK_HID_FN_LOCK | QUIRK_ROG_NKEY_ID1ID2_INIT }, + QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD | QUIRK_HID_FN_LOCK }, { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR), QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, From 7b2f88cc9dd4c2b9f3d6f5377b45ed9c90fd2fe9 Mon Sep 17 00:00:00 2001 From: Benjamin Tissoires Date: Mon, 2 Mar 2026 15:51:10 +0100 Subject: [PATCH 2/7] HID: asus: drop unused variables Looks like those variables are leftovers from debugging. Reported-by: Mark Brown Closes: https://lore.kernel.org/linux-next/aaWXFVxygHFpKNxv@sirena.org.uk/ Signed-off-by: Benjamin Tissoires --- drivers/hid/hid-asus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 425f54b1b27e..e5dee5b6d856 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -729,8 +729,8 @@ static void validate_mcu_fw_version(struct hid_device *hdev, int idProduct) static bool asus_has_report_id(struct hid_device *hdev, u16 report_id) { - int t, f, u, err = 0; struct hid_report *report; + int t; for (t = HID_INPUT_REPORT; t <= HID_FEATURE_REPORT; t++) { list_for_each_entry(report, &hdev->report_enum[t].report_list, list) { From a593671545475dd78c7ba939155efb6c272b161e Mon Sep 17 00:00:00 2001 From: Denis Benato Date: Sat, 28 Feb 2026 20:10:04 +0100 Subject: [PATCH 3/7] HID: asus: fix code style of comments and brackets In asus_raw_event there is code that would violate checkpatch script such as unaligned closing comments and superfluous graph parenthesis: fix these stylistic issues. Also remove an empty comment spanning two lines. This commit does not change runtime behavior. Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina --- drivers/hid/hid-asus.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index e5dee5b6d856..ba00726b48bb 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -20,9 +20,6 @@ * Copyright (c) 2016 Frederik Wenigwieser */ -/* - */ - #include #include #include @@ -359,7 +356,7 @@ static int asus_event(struct hid_device *hdev, struct hid_field *field, struct hid_usage *usage, __s32 value) { struct asus_drvdata *drvdata = hid_get_drvdata(hdev); - + if ((usage->hid & HID_USAGE_PAGE) == HID_UP_ASUSVENDOR && (usage->hid & HID_USAGE) != 0x00 && (usage->hid & HID_USAGE) != 0xff && !usage->type) { @@ -448,21 +445,18 @@ static int asus_raw_event(struct hid_device *hdev, /* * G713 and G733 send these codes on some keypresses, depending on * the key pressed it can trigger a shutdown event if not caught. - */ - if (data[0] == 0x02 && data[1] == 0x30) { + */ + if (data[0] == 0x02 && data[1] == 0x30) return -1; - } } if (drvdata->quirks & QUIRK_ROG_CLAYMORE_II_KEYBOARD) { /* * CLAYMORE II keyboard sends this packet when it goes to sleep * this causes the whole system to go into suspend. - */ - - if(size == 2 && data[0] == 0x02 && data[1] == 0x00) { + */ + if (size == 2 && data[0] == 0x02 && data[1] == 0x00) return -1; - } } return 0; From 51d33b42b8ae23da92819d28439fdd5636c45186 Mon Sep 17 00:00:00 2001 From: Denis Benato Date: Sat, 28 Feb 2026 20:10:07 +0100 Subject: [PATCH 4/7] HID: asus: make asus_resume adhere to linux kernel coding standards Linux kernel coding standars requires functions opening brackets to be in a newline: move the opening bracket of asus_resume in its own line. Fixes: 546edbd26cff ("HID: hid-asus: reset the backlight brightness level on resume") Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina --- drivers/hid/hid-asus.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index ba00726b48bb..7513a0b3e155 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -1172,7 +1172,8 @@ static int asus_start_multitouch(struct hid_device *hdev) return 0; } -static int __maybe_unused asus_resume(struct hid_device *hdev) { +static int __maybe_unused asus_resume(struct hid_device *hdev) +{ struct asus_drvdata *drvdata = hid_get_drvdata(hdev); int ret = 0; From 43b3d1a95a587d32f3d441033d0aa108515a8c27 Mon Sep 17 00:00:00 2001 From: Denis Benato Date: Sat, 28 Feb 2026 20:10:08 +0100 Subject: [PATCH 5/7] HID: asus: simplify and improve asus_kbd_set_report() Make the function shorter and easier to read using __free, and also fix a misaligned comment closing tag. The __free macro from cleanup.h is already used in the driver, but its include is missing: add it. Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina --- drivers/hid/hid-asus.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 7513a0b3e155..fa9a24f279f4 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -21,6 +21,7 @@ */ #include +#include #include #include #include @@ -464,23 +465,16 @@ static int asus_raw_event(struct hid_device *hdev, static int asus_kbd_set_report(struct hid_device *hdev, const u8 *buf, size_t buf_size) { - unsigned char *dmabuf; - int ret; - - dmabuf = kmemdup(buf, buf_size, GFP_KERNEL); + u8 *dmabuf __free(kfree) = kmemdup(buf, buf_size, GFP_KERNEL); if (!dmabuf) return -ENOMEM; /* * The report ID should be set from the incoming buffer due to LED and key * interfaces having different pages - */ - ret = hid_hw_raw_request(hdev, buf[0], dmabuf, - buf_size, HID_FEATURE_REPORT, - HID_REQ_SET_REPORT); - kfree(dmabuf); - - return ret; + */ + return hid_hw_raw_request(hdev, buf[0], dmabuf, buf_size, HID_FEATURE_REPORT, + HID_REQ_SET_REPORT); } static int asus_kbd_init(struct hid_device *hdev, u8 report_id) From 7253091766ded0fd81fe8d8be9b8b835495b06e8 Mon Sep 17 00:00:00 2001 From: Denis Benato Date: Sat, 28 Feb 2026 20:10:09 +0100 Subject: [PATCH 6/7] HID: asus: do not abort probe when not necessary In order to avoid dereferencing a NULL pointer asus_probe is aborted early and control of some asus devices is transferred over hid-generic after erroring out even when such NULL dereference cannot happen: only early abort when the NULL dereference can happen. Also make the code shorter and more adherent to coding standards removing square brackets enclosing single-line if-else statements. Fixes: d3af6ca9a8c3 ("HID: asus: fix UAF via HID_CLAIMED_INPUT validation") Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina --- drivers/hid/hid-asus.c | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index fa9a24f279f4..26047ccc8e7d 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -1324,22 +1324,17 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id) * were freed during registration due to no usages being mapped, * leaving drvdata->input pointing to freed memory. */ - if (!drvdata->input || !(hdev->claimed & HID_CLAIMED_INPUT)) { - hid_err(hdev, "Asus input not registered\n"); - ret = -ENOMEM; - goto err_stop_hw; - } + if (drvdata->input && (hdev->claimed & HID_CLAIMED_INPUT)) { + if (drvdata->tp) + drvdata->input->name = "Asus TouchPad"; + else + drvdata->input->name = "Asus Keyboard"; - if (drvdata->tp) { - drvdata->input->name = "Asus TouchPad"; - } else { - drvdata->input->name = "Asus Keyboard"; - } - - if (drvdata->tp) { - ret = asus_start_multitouch(hdev); - if (ret) - goto err_stop_hw; + if (drvdata->tp) { + ret = asus_start_multitouch(hdev); + if (ret) + goto err_stop_hw; + } } return 0; From c89046d57d534348b41ca28f5c1c5443743dbe04 Mon Sep 17 00:00:00 2001 From: Denis Benato Date: Sat, 28 Feb 2026 20:10:10 +0100 Subject: [PATCH 7/7] HID: asus: do not try to initialize the backlight if the enpoint doesn't support it Avoid possibly printing a warning about the inability to initialize the backlight if the hid endpoint doesn't support it. Also fix and move an incorrect check in asus_kbd_register_leds(): that same check is now used as a precondition to call that function. Fixes: 0919db9f3583 ("HID: asus: always fully initialize devices") Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina --- drivers/hid/hid-asus.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 26047ccc8e7d..9fccfbe187cd 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -738,10 +738,6 @@ static int asus_kbd_register_leds(struct hid_device *hdev) unsigned char kbd_func; int ret; - /* Laptops keyboard backlight is always at 0x5a */ - if (asus_has_report_id(hdev, FEATURE_KBD_REPORT_ID)) - return -ENODEV; - /* Get keyboard functions */ ret = asus_kbd_get_functions(hdev, &kbd_func, FEATURE_KBD_REPORT_ID); if (ret < 0) @@ -1307,8 +1303,10 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id) } } + /* Laptops keyboard backlight is always at 0x5a */ if (is_vendor && (drvdata->quirks & QUIRK_USE_KBD_BACKLIGHT) && - asus_kbd_register_leds(hdev)) + (asus_has_report_id(hdev, FEATURE_KBD_REPORT_ID)) && + (asus_kbd_register_leds(hdev))) hid_warn(hdev, "Failed to initialize backlight.\n"); /*