| 9cdc7e6d | 03-Aug-2026 |
Shen Yongchao <grayhat@foxmail.com> |
HID: bpf: serialize device reference release in struct_ops destroy path
__hid_bpf_ops_destroy_device() and hid_bpf_unreg() can race on the
same registration reference, double-putting struct hid_devi
HID: bpf: serialize device reference release in struct_ops destroy path
__hid_bpf_ops_destroy_device() and hid_bpf_unreg() can race on the
same registration reference, double-putting struct hid_device and
freeing it while hid_destroy_device() still uses it. Serialize the
remove/NULL decision under hdev->bpf.prog_list_lock so exactly one
path releases each registration reference: unreg re-checks ops->hdev
under the lock and returns without putting when the destroy path
already cleared it; all put_device() calls happen after the lock is
dropped, which is safe because a concurrent unreg then observes
ops->hdev == NULL under the lock.
Background: each successful attach (hid_bpf_ops_reg) acquires one
device reference (hid_get_device()). Two paths can release it:
- device destruction: hid_destroy_device() -> hid_bpf_destroy_device()
-> __hid_bpf_ops_destroy_device(), which walks hdev->bpf.prog_list
under rcu_read_lock() and drops one reference per attached program;
- BPF link release: bpf map delete (no BPF_F_LINK) synchronously calls
st_ops->unreg() -> hid_bpf_unreg(), which drops the reference for
its own registration.
The coordination handshake (e->hdev = NULL on the destroy side vs
"if (!hdev) return" on the unreg side) is a TOCTOU check: the two
paths run under different lock domains (rcu_read_lock vs
prog_list_lock), so a concurrent unreg can read ops->hdev as
non-NULL, block on prog_list_lock, and then proceed while the
destroy traversal executes - both paths then drop the same
reference. The refcount reaches zero legitimately (each decrement
is individually valid), so no refcount_t saturation fires: the
device is simply freed while the transport is still inside
hid_destroy_device(), and subsequent teardown touches freed memory.
The fix serializes the remove/NULL decision under prog_list_lock on
both sides and moves the destroy-side puts outside the lock. With
the lock held, plain reads/writes of ops->hdev are sufficient; no
READ_ONCE/WRITE_ONCE are added, keeping the patch minimal.
Unlocked-read safety: the unlocked read of ops->hdev at the top of
hid_bpf_unreg() cannot touch a freed device, because the unreg path
itself still holds this registration's reference (released only by
its own hid_put_device() after the lock is dropped), and a destroy
traversal that already cleared ops->hdev makes the lock-internal
re-check return early without any put. At most one of the two
paths releases each registration reference.
Fixes: ebc0d8093e8c ("HID: bpf: implement HID-BPF through bpf_struct_ops")
Cc: stable@vger.kernel.org
Signed-off-by: Shen Yongchao <grayhat@foxmail.com>
Assisted-by: Hermes:kimi-k3
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
show more ...
|
| 30fb45cc | 03-Apr-2026 |
muhammed Rishal <muhammedrishal7777777@gmail.com> |
bpf: Add fix for Trust Philips SPK6327 (145f:024b) modifier keys
The Trust Philips SPK6327 keyboard (USB ID 145f:024b) has a broken HID
descriptor on interface 1. Byte 101 is 0x00 (Input Array) but
bpf: Add fix for Trust Philips SPK6327 (145f:024b) modifier keys
The Trust Philips SPK6327 keyboard (USB ID 145f:024b) has a broken HID
descriptor on interface 1. Byte 101 is 0x00 (Input Array) but should be
0x02 (Input Variable), causing LCtrl, LAlt, Super, RAlt, RCtrl and
RShift to all report as LShift on Linux.
This BPF fix patches byte 101 at runtime fixing all affected modifier
keys.
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/234
Signed-off-by: muhammed Rishal <muhammedrishal7777777@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| cc3993d3 | 03-Apr-2026 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: Add support for the Huion KeyDial K20 over bluetooth
When connected over bluetooth this device is just different enough that
forcing it into the same source file as the USB connection does
HID: bpf: Add support for the Huion KeyDial K20 over bluetooth
When connected over bluetooth this device is just different enough that
forcing it into the same source file as the USB connection doesn't gain
us much benefit. So let's duplicate this.
Code and tests originally produced by Claude code.
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/work_items/69
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/201
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| af79443b | 03-Apr-2026 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: add a BPF to get the touchpad type
Currently the kernel is scheduled to do this call by itself, but it
requires a kernel v6.18 at least to have the INPUT_PROP set. For older
kernels, we ca
HID: bpf: add a BPF to get the touchpad type
Currently the kernel is scheduled to do this call by itself, but it
requires a kernel v6.18 at least to have the INPUT_PROP set. For older
kernels, we can try to query the property from a HID-BPF probe, and set
a udev property based on that. This way we can provide the information
to old kernels without modifying them.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/220
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| bb8be68d | 03-Apr-2026 |
Benjamin Tissoires <bentiss@kernel.org> |
hid: bpf: hid_bpf_helpers: add helper for having read/write udev properties
We want udev-hid-bpf to be able to set udev properties by printing them
out after the BPF object has been loaded. This all
hid: bpf: hid_bpf_helpers: add helper for having read/write udev properties
We want udev-hid-bpf to be able to set udev properties by printing them
out after the BPF object has been loaded. This allows to make a query to
the device, and set a udev prop based on the answer.
Because the way udev works, the properties are cleared on bind/unbind,
and we need a way to store them. After several attempts to keep the
property alive without re-running the udev-hid-bpf tool to communicate
with the device, it came out that HID-BPF maps are pinned in the bpffs
and we can then query them.
So the following would export a UDEV property in the bpffs:
EXPORT_UDEV_PROP(HID_FOO, 32);
SEC("syscall")
int probe(struct hid_bpf_probe_args *ctx)
{
const char *foo = "foo";
UDEV_PROP_SPRINTF(HID_FOO, "%s", foo);
return 0;
}
Then, we can debug it with a simple cat:
sudo cat /sys/fs/bpf/hid/.../UDEV_PROP_HID_FOO
0: {['f','o','o',],}
This way, the property is always accessible without talking to the
device
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/220
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| fc778f21 | 03-Apr-2026 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: handle injected report descriptor in HID-BPF
udev-hid-bpf is now capable of injecting the parsed report descriptor in
the program. Provide the macros required for it.
Sync up from udev-hi
HID: bpf: handle injected report descriptor in HID-BPF
udev-hid-bpf is now capable of injecting the parsed report descriptor in
the program. Provide the macros required for it.
Sync up from udev-hid-bpf commits:
bpf: inject the parsed report descriptor in HID_REPORT_DESCRIPTOR
hid_bpf_helpers: provide iterator macros for walking the HID report descriptor
hid_bpf_helpers: Add extract_bits function
bpf: add hid_usages.h
bpf: move the report descriptor structs into their own header
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/221
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/228
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| 462240ac | 03-Apr-2026 |
Peter Hutterer <peter.hutterer@who-t.net> |
HID: bpf: add helper macros for LE/BE conversion
BPF has bpf_htons and friends but those only work with data in Big
Endian format. HID is little endian so we need our own macros.
Link: https://gitl
HID: bpf: add helper macros for LE/BE conversion
BPF has bpf_htons and friends but those only work with data in Big
Endian format. HID is little endian so we need our own macros.
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/221
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| ed1d6d21 | 03-Apr-2026 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: hid_bpf_helpers: provide a cleanup functions
Combination of 2 udev-hid-bpf commits:
bpf: hid_bpf_helpers: provide a cleanup function for hid_bpf_release_context
bpf: helpers: add guard(bpf
HID: bpf: hid_bpf_helpers: provide a cleanup functions
Combination of 2 udev-hid-bpf commits:
bpf: hid_bpf_helpers: provide a cleanup function for hid_bpf_release_context
bpf: helpers: add guard(bpf_spin) macro
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/221
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| e43d74d6 | 03-Apr-2026 |
Peter Hutterer <peter.hutterer@who-t.net> |
HID: bpf: fix some signed vs unsigned compiler warnings
On udev-hid-bpf, we are now getting warnings here, shut them off.
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests
HID: bpf: fix some signed vs unsigned compiler warnings
On udev-hid-bpf, we are now getting warnings here, shut them off.
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/227
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| 3b86c87f | 18-Nov-2025 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: fix typo in HID usage table
We could go to the USB consortium, but it's probably
easier that way.
And update HID usage table json generated file from
https://usb.org/sites/default/files/h
HID: bpf: fix typo in HID usage table
We could go to the USB consortium, but it's probably
easier that way.
And update HID usage table json generated file from
https://usb.org/sites/default/files/hut1_6.pdf updated: 01/30/2025
Reported-by: Colin Ian King <colin.i.king@gmail.com>
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/191
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| 71570e8f | 18-Nov-2025 |
Benjamin Tissoires <bentiss@kernel.org> |
HID: bpf: add the Huion Kamvas 27 Pro
Same issues with a secondary tip switch instead of secondary barrel
switch as the Kamvas 19.
Copy the stable Kamvas 19 support back into testing and add the vi
HID: bpf: add the Huion Kamvas 27 Pro
Same issues with a secondary tip switch instead of secondary barrel
switch as the Kamvas 19.
Copy the stable Kamvas 19 support back into testing and add the vid/pid
for the Kamvas 27.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/189
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|