[PATCH v2] HID: asus: do not send keyboard init reports to touchpads

[PATCH v2] HID: asus: do not send keyboard init reports to touchpads

[Panz Dev]

Commit 0919db9f3583 ("HID: asus: always fully initialize devices") added a
loop during asus_probe() to send keyboard feature report initializations
(asus_kbd_init) to all ASUS HID devices.

On ASUS laptops with I2C/HID touchpads (such as the ASUS E200HA), sending
keyboard feature reports (FEATURE_KBD_REPORT_ID) to touchpad endpoints
sends invalid feature requests to touchpad hardware, corrupting probe
state and causing the touchpad to become unresponsive.

Wrap the asus_report_id_init loop in an `if (!drvdata->tp)` check so
keyboard feature initialization only runs for actual keyboards.

Tested on ASUS E200HA (where touchpad functionality is fully restored)
and ASUS VivoBook Flip 14 TP401MA (confirming zero regressions).

Fixes: 0919db9f3583 ("HID: asus: always fully initialize devices")
Cc: stable@vger.kernel.org
Signed-off-by: Panz Dev <panz.development@gmail.com>
---
v2:
 - Keep asus_start_multitouch() inside the HID_CLAIMED_INPUT check to avoid
   any UAF risk if input registration fails (as pointed out by Denis Benato
   and automated review).
 - Focus the fix on skipping keyboard report initialization for touchpads.
---
 drivers/hid/hid-asus.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 3f5e96900b67..7f19ca1e5a1b 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -1294,12 +1294,14 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id)
 		return ret;
 	}

-	for (int r = 0; r < ARRAY_SIZE(asus_report_id_init); r++) {
-		if (asus_has_report_id(hdev, asus_report_id_init[r])) {
-			ret = asus_kbd_init(hdev, asus_report_id_init[r]);
-			if (ret < 0)
-				hid_warn(hdev, "Failed to initialize 0x%x: %d.\n",
-					 asus_report_id_init[r], ret);
+	if (!drvdata->tp) {
+		for (int r = 0; r < ARRAY_SIZE(asus_report_id_init); r++) {
+			if (asus_has_report_id(hdev, asus_report_id_init[r])) {
+				ret = asus_kbd_init(hdev, asus_report_id_init[r]);
+				if (ret < 0)
+					hid_warn(hdev, "Failed to initialize 0x%x: %d.\n",
+						 asus_report_id_init[r], ret);
+			}
 		}
 	}

-- 
2.47.0

Re: [PATCH v2] HID: asus: do not send keyboard init reports to touchpads

[Denis Benato]

On 8/18/26 17:14, Panz Dev wrote:
> Commit 0919db9f3583 ("HID: asus: always fully initialize devices") added a
> loop during asus_probe() to send keyboard feature report initializations
> (asus_kbd_init) to all ASUS HID devices.
>
> On ASUS laptops with I2C/HID touchpads (such as the ASUS E200HA), sending
> keyboard feature reports (FEATURE_KBD_REPORT_ID) to touchpad endpoints
> sends invalid feature requests to touchpad hardware, corrupting probe
> state and causing the touchpad to become unresponsive.
>
> Wrap the asus_report_id_init loop in an `if (!drvdata->tp)` check so
> keyboard feature initialization only runs for actual keyboards.
>
> Tested on ASUS E200HA (where touchpad functionality is fully restored)
> and ASUS VivoBook Flip 14 TP401MA (confirming zero regressions).
>
> Fixes: 0919db9f3583 ("HID: asus: always fully initialize devices")
> Cc: stable@vger.kernel.org

Reviewed-by: Denis Benato <denis.benato@linux.dev>
> Signed-off-by: Panz Dev <panz.development@gmail.com>
> ---
> v2:
>  - Keep asus_start_multitouch() inside the HID_CLAIMED_INPUT check to avoid
>    any UAF risk if input registration fails (as pointed out by Denis Benato
>    and automated review).
>  - Focus the fix on skipping keyboard report initialization for touchpads.
> ---
>  drivers/hid/hid-asus.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
> index 3f5e96900b67..7f19ca1e5a1b 100644
> --- a/drivers/hid/hid-asus.c
> +++ b/drivers/hid/hid-asus.c
> @@ -1294,12 +1294,14 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id)
>  		return ret;
>  	}
>
> -	for (int r = 0; r < ARRAY_SIZE(asus_report_id_init); r++) {
> -		if (asus_has_report_id(hdev, asus_report_id_init[r])) {
> -			ret = asus_kbd_init(hdev, asus_report_id_init[r]);
> -			if (ret < 0)
> -				hid_warn(hdev, "Failed to initialize 0x%x: %d.\n",
> -					 asus_report_id_init[r], ret);
> +	if (!drvdata->tp) {
> +		for (int r = 0; r < ARRAY_SIZE(asus_report_id_init); r++) {
> +			if (asus_has_report_id(hdev, asus_report_id_init[r])) {
> +				ret = asus_kbd_init(hdev, asus_report_id_init[r]);
> +				if (ret < 0)
> +					hid_warn(hdev, "Failed to initialize 0x%x: %d.\n",
> +						 asus_report_id_init[r], ret);
> +			}
>  		}
>  	}
>