Trung NguyenandBenjamin Tissoires b6eb022890 selftests/hid: multitouch: test a large ContactCountMaximum ...

Add a regression test for the out-of-bounds bit operations on
struct mt_device.mt_io_flags.

A HID multitouch device can advertise a ContactCountMaximum far larger
than the number of contacts a single report describes, up to 255. The
driver used to keep the per-slot active state in the bits of a single
unsigned long and index set_bit()/clear_bit() by the slot number, so such
a device drove those operations out of bounds. The sticky-fingers release
timer made it fatal: mt_release_contacts() cleared one bit per slot and
overwrote the adjacent members of struct mt_device.

The new device advertises a ContactCountMaximum of 250 while exposing only
a few finger collections (a large contact count cannot be expressed with
one finger collection per contact within the HID descriptor size limit).
The test sends a single contact and lets the 100ms sticky-fingers timer
release it. A kernel without the fix panics in mt_release_contacts(); a
fixed kernel reports the release cleanly.

Signed-off-by: Trung Nguyen <trungnh@cystack.net>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

2026-07-01 20:36:12 +02:00

..

__init__.py

…

base_device.py

…

base_gamepad.py

…

base.py

…

conftest.py

…

descriptors_wacom.py

…

test_apple_keyboard.py

…

test_gamepad.py

…

test_hid_core.py

…

test_ite_keyboard.py

…

test_keyboard.py

…

test_mouse.py

…

test_multitouch.py

…

test_sony.py

…

test_tablet.py

…

test_usb_crash.py

…

test_wacom_generic.py

…