--- /dev/null
+From 46f781e0d151844589dc2125c8cce3300546f92a Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <bentiss@kernel.org>
+Date: Wed, 8 Oct 2025 16:06:58 +0200
+Subject: HID: multitouch: fix sticky fingers
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+commit 46f781e0d151844589dc2125c8cce3300546f92a upstream.
+
+The sticky fingers quirk (MT_QUIRK_STICKY_FINGERS) was only considering
+the case when slots were not released during the last report.
+This can be problematic if the firmware forgets to release a finger
+while others are still present.
+
+This was observed on the Synaptics DLL0945 touchpad found on the Dell
+XPS 9310 and the Dell Inspiron 5406.
+
+Fixes: 4f4001bc76fd ("HID: multitouch: fix rare Win 8 cases when the touch up event gets missing")
+Cc: stable@vger.kernel.org
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-multitouch.c | 27 ++++++++++++++-------------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -83,9 +83,8 @@ enum latency_mode {
+ HID_LATENCY_HIGH = 1,
+ };
+
+-#define MT_IO_FLAGS_RUNNING 0
+-#define MT_IO_FLAGS_ACTIVE_SLOTS 1
+-#define MT_IO_FLAGS_PENDING_SLOTS 2
++#define MT_IO_SLOTS_MASK GENMASK(7, 0) /* reserve first 8 bits for slot tracking */
++#define MT_IO_FLAGS_RUNNING 32
+
+ static const bool mtrue = true; /* default for true */
+ static const bool mfalse; /* default for false */
+@@ -160,7 +159,11 @@ struct mt_device {
+ struct mt_class mtclass; /* our mt device class */
+ struct timer_list release_timer; /* to release sticky fingers */
+ struct hid_device *hdev; /* hid_device we're attached to */
+- unsigned long mt_io_flags; /* mt flags (MT_IO_FLAGS_*) */
++ unsigned long mt_io_flags; /* mt flags (MT_IO_FLAGS_RUNNING)
++ * first 8 bits are reserved for keeping the slot
++ * states, this is fine because we only support up
++ * to 250 slots (MT_MAX_MAXCONTACT)
++ */
+ __u8 inputmode_value; /* InputMode HID feature value */
+ __u8 maxcontacts;
+ bool is_buttonpad; /* is this device a button pad? */
+@@ -941,6 +944,7 @@ static void mt_release_pending_palms(str
+
+ for_each_set_bit(slotnum, app->pending_palm_slots, td->maxcontacts) {
+ clear_bit(slotnum, app->pending_palm_slots);
++ clear_bit(slotnum, &td->mt_io_flags);
+
+ input_mt_slot(input, slotnum);
+ input_mt_report_slot_inactive(input);
+@@ -972,12 +976,6 @@ static void mt_sync_frame(struct mt_devi
+
+ app->num_received = 0;
+ app->left_button_state = 0;
+-
+- if (test_bit(MT_IO_FLAGS_ACTIVE_SLOTS, &td->mt_io_flags))
+- set_bit(MT_IO_FLAGS_PENDING_SLOTS, &td->mt_io_flags);
+- else
+- clear_bit(MT_IO_FLAGS_PENDING_SLOTS, &td->mt_io_flags);
+- clear_bit(MT_IO_FLAGS_ACTIVE_SLOTS, &td->mt_io_flags);
+ }
+
+ static int mt_compute_timestamp(struct mt_application *app, __s32 value)
+@@ -1152,7 +1150,9 @@ static int mt_process_slot(struct mt_dev
+ input_event(input, EV_ABS, ABS_MT_TOUCH_MAJOR, major);
+ input_event(input, EV_ABS, ABS_MT_TOUCH_MINOR, minor);
+
+- set_bit(MT_IO_FLAGS_ACTIVE_SLOTS, &td->mt_io_flags);
++ set_bit(slotnum, &td->mt_io_flags);
++ } else {
++ clear_bit(slotnum, &td->mt_io_flags);
+ }
+
+ return 0;
+@@ -1287,7 +1287,7 @@ static void mt_touch_report(struct hid_d
+ * defect.
+ */
+ if (app->quirks & MT_QUIRK_STICKY_FINGERS) {
+- if (test_bit(MT_IO_FLAGS_PENDING_SLOTS, &td->mt_io_flags))
++ if (td->mt_io_flags & MT_IO_SLOTS_MASK)
+ mod_timer(&td->release_timer,
+ jiffies + msecs_to_jiffies(100));
+ else
+@@ -1734,6 +1734,7 @@ static void mt_release_contacts(struct h
+ for (i = 0; i < mt->num_slots; i++) {
+ input_mt_slot(input_dev, i);
+ input_mt_report_slot_inactive(input_dev);
++ clear_bit(i, &td->mt_io_flags);
+ }
+ input_mt_sync_frame(input_dev);
+ input_sync(input_dev);
+@@ -1756,7 +1757,7 @@ static void mt_expired_timeout(struct ti
+ */
+ if (test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags))
+ return;
+- if (test_bit(MT_IO_FLAGS_PENDING_SLOTS, &td->mt_io_flags))
++ if (td->mt_io_flags & MT_IO_SLOTS_MASK)
+ mt_release_contacts(hdev);
+ clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
+ }
--- /dev/null
+From eaffa2f6affba1c4b91d3a75b6e6d9e31adc5a26 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Mon, 13 Oct 2025 12:05:31 -0600
+Subject: Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()"
+
+From: Jens Axboe <axboe@kernel.dk>
+
+Commit 927069c4ac2cd1a37efa468596fb5b8f86db9df0 upstream.
+
+This reverts commit 90bfb28d5fa8127a113a140c9791ea0b40ab156a.
+
+Kevin reports that this commit causes an issue for him with LVM
+snapshots, most likely because of turning off NOWAIT support while a
+snapshot is being created. This makes -EOPNOTSUPP bubble back through
+the completion handler, where io_uring read/write handling should just
+retry it.
+
+Reinstate the previous check removed by the referenced commit.
+
+Cc: stable@vger.kernel.org
+Fixes: 90bfb28d5fa8 ("io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()")
+Reported-by: Salvatore Bonaccorso <carnil@debian.org>
+Reported-by: Kevin Lumik <kevin@xf.ee>
+Link: https://lore.kernel.org/io-uring/cceb723c-051b-4de2-9a4c-4aa82e1619ee@kernel.dk/
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/rw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/io_uring/rw.c
++++ b/io_uring/rw.c
+@@ -477,7 +477,7 @@ static void io_req_io_end(struct io_kioc
+ static bool __io_complete_rw_common(struct io_kiocb *req, long res)
+ {
+ if (unlikely(res != req->cqe.res)) {
+- if (res == -EAGAIN && io_rw_should_reissue(req)) {
++ if ((res == -EOPNOTSUPP || res == -EAGAIN) && io_rw_should_reissue(req)) {
+ /*
+ * Reissue will start accounting again, finish the
+ * current cycle.
projects / thirdparty / kernel / stable-queue.git / commitdiff
