Quirky fix to Magic Mouse 2 driver not loading when reconnecting - #1
Quirky fix to Magic Mouse 2 driver not loading when reconnecting#1RicardoEPRodrigues wants to merge 40 commits into
Conversation
This fix is based on the work of [0xABAD](https://github.com/0xABAD/magic-mouse-2), but I changed his method of detecting the mouse by searching for the Product ID and not depend on the unit codes.
README now has information on the new script and on how the fixes work.
When an USB with that product ID is detected then a input driver is loaded. I think this is the correct interpretation.
Previously the rule used the USB ID of the computer and not the mouse.
|
hello @RicardoEPRodrigues and thx for your effort to solve this problem. I have applied your changes and the mouse has stopped working. I tried removing the files and reinstalling but still not moving in when I run install.sh Running in ubuntu 18.04 with kernel 5.3.0-28-generic any suggestions? thx |
|
Hey @n0ni0, can you check if the logs have anything relating to If the mouse stopped working then part of the script is running. We have to find out if any error came up and what that error is. Can you check if the To revert the changes you can simply delete the |
|
I found a log file when connect device in local/share/xorg/Xorg.0.log: The file /opt/magic-mouse-fix/hid-magicmouse.ko exist After restart the problem persist. |
|
I currently don't have the time to look into what the issue is. If you can please do some testing. First off delete the After that you can try running the script yourself with Explore a bit of what the script does. These are its contents: As you can see it removes any magic mouse driver ( I'll try to help more when I have time. |
I will try to investigate more, thx again. |
Also added a smaller install script that does not install dkms and does not install the bluetooth fix.
|
@n0ni0 I updated my branch, can you test it out? Apparently the UDEV rule will always try to run at least 3 times (loading and unloading the driver each time). I tried to limit the number of repetitions, but could only lower it to 3. To solve this I modified the script to check if others were running. So now I believe it will always run only one time! You can use a new smaller script |
Added a delay after removing the previous driver and before adding the new one
|
Hello @RicardoEPRodrigues, using install-fix.sh works like a charm. Thanks |
|
This is working for me to allow scrolling each time my mouse connects (thanks!), but the middle-click seems to have stopped working. It had been working fine with the @rohitpid version. Any idea what might be going on or how to fix this? |
|
@jaybeaton Great to know it is working! On theory, the middle-click is on by default and should work. You can tweak the settings in the Unfortunately, I haven't tested it myself. |
|
So it looks like I have a similar issue. On any reboot I have to I have to reapply the Troubleshooting fix to get my MM2 to scroll. In the aforementioned posts you talk about some install-fix.sh script. But where is it? Or is there another solution? |
|
@cavaughankirov this is a pull request with some changes. If you wanna try them out you have to download the changes in my repo: https://github.com/RicardoEPRodrigues/Linux-Magic-Trackpad-2-Driver Just run |
|
well, there's something wrong with the script and I wish I new coding better to try and figure it out. I moved the script to the scripts dir. But when running it it seems to reproduce the scripts dir. Here's the output:
|
|
@cavaughankirov you don't need to move the script anywhere. Just use my repo without modification and in the base directory run |
for newer systems bluetooth restart now is done with systemctl. It also adds a small check to detect root. If not it asks to run it as sudo.
This adds a 1/5 of a second delay from the registration of a drag event to actually starting to scroll. The result is a slight decrease in sensitivity when dragging a finger on the Magic Mouse to start a scroll. The actual scrolling is the same as before, there is a just a small delay at the beginning of the stroke which helps to eliminate accidental scrolls when just resting the finger lightly on the mouse surface.
This update simplifies the code. Please run `remove.sh` before updating the driver to ensure a smooth transition. Removed unnecessary files from repo. Changes were made to install, the main loading script to make use of modprobe more accurately. The parameters for hid-magicmouse were moved to /etc/modprobe.d/hid-magicmouse.conf . This allows the unloading and loading of the module with predefined parameters. A `remove.sh` script was added to uninstall the driver. NOTE: It does not remove the bluetooth fix. Changed DKMS version to reflect the driver name.
Also add parameter definition to conf file.
You can now generate a debian file for the project by running `./build-deb.sh`.
This commit adds two new variables for delaying scroll until fingers move further away. Remove time delay.
|
This fix works great for my magic mouse 2 on Linux Mint (Ubuntu 20.04) kernel 5.4.0-67-generic. I was having trouble with getting the The install went smooth as butter and the scroll is now working perfectly - thank you 👍 😄 |
This fix removes the need for external files to load the driver. It turns out the driver already loaded itself, but without a delay it would fail. This is now fixed. Based on the work seen here johnchen902/linux@cb700d0
This update brings a feature that allows you to stop scrolling if the mouse is moving. It is still very rough, but it works.
Add reload driver instructions to README file
…RT_ID
Backports upstream commit d93ba918a185 ("HID: magicmouse: Prevent
out-of-bounds (OOB) read during DOUBLE_REPORT_ID") by Lee Jones.
When a 0xf7 DOUBLE_REPORT_ID packet is received, the driver recursively
calls magicmouse_raw_event with `data + 2` and `data[1]` as the new size.
Without validation, two issues arise:
- If size < 2, reading data[1] is out-of-bounds.
- If data[1] > size - 2, the first recursive call thinks it has more
bytes than were actually received, and the recursive parse reads
past the actual report buffer.
This mirrors a class of bug seen on other HID parsers (cf.
CVE-2026-43140 on the same driver) where a fake/malicious USB or
Bluetooth device controls report length independently of declared size.
The fix is the same one already in mainline since v6.16-rc1: add an
early size>=1 guard at function entry, and validate size>=2 and
data[1]+2<=size before recursing.
Reference:
https://git.kernel.org/linus/d93ba918a185aca2594da63e92fdc5495b559c0f
Reported-by: Aleksandr Kovalko <gistrec@gmail.com>
The current size check for MOUSE2_REPORT_ID is inverted: it only
returns when `size > 14 && (size - 14) % 8 != 0`, which lets any
`size <= 14` fall through.
For reports of size 1..5, this fallthrough then executes:
x = (int)((data[3] << 24) | (data[2] << 16)) >> 16;
y = (int)((data[5] << 24) | (data[4] << 16)) >> 16;
...
clicks = data[1];
These read past the end of the actually-received HID buffer. The
resulting x and y get emitted to userspace as REL_X / REL_Y mouse
motion events, so a malicious or buggy USB/Bluetooth HID device
pretending to be Apple Magic Mouse 2 can leak a small number of
bytes of adjacent kernel memory to userspace mouse listeners.
A userspace ASan repro of the parser path confirms the OOB read:
AddressSanitizer: heap-buffer-overflow ...
READ of size 1 at 0x6020000000b3 ... 2 bytes after 1-byte region
#0 magicmouse_raw_event ... (in `x = ((data[3] << 24) | ...`)
Mainline drivers/hid/hid-magicmouse.c has the correct check since
the Magic Mouse 2 support patch landed there in 2021 (commit
2b0c086cd6f4, "HID: magicmouse: add Apple Magic Mouse 2 support"):
if (size != 8 && (size < 14 || (size - 14) % 8 != 0))
return 0;
This accepts the documented MM2 sizes (8 for the no-touch report,
or 14 + 8*N for N-finger reports) and rejects everything else.
Bring this fork in line with mainline.
Reported-by: Aleksandr Kovalko <gistrec@gmail.com>
hid-magicmouse: backport upstream OOB read fix for DOUBLE_REPORT_ID
hid-magicmouse: fix MOUSE2_REPORT_ID size check (inverted condition)
8 participants
This fix is based on the work of 0xABAD, but I changed his method of detecting the mouse by searching for the Product ID and not depend on the unit codes.