From 0deb22da5a8c6663c3e071f55fd7d7e3189f5517 Mon Sep 17 00:00:00 2001 From: Jiale Yao Date: Thu, 24 Sep 2026 22:44:12 +0800 Subject: [PATCH] HID: pxrc: reject short input reports The HID core invokes raw_event callbacks before validating the report length. pxrc_raw_event() reads byte seven and writes bytes one and seven without checking that the report contains those bytes. A one-byte input report reproduced the first invalid access under KASAN: BUG: KASAN: slab-out-of-bounds in pxrc_raw_event+0x161/0x260 Read of size 1 by task hidtrigger/90 Call Trace: pxrc_raw_event+0x161/0x260 kasan_report+0x139/0x170 Require all eight bytes before reading or rewriting the report. Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") added the same kind of raw_event length validation to hid-asus. Fixes: acc3e34613da ("HID: Add driver for PhoenixRC Flight Controller") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao Signed-off-by: Jiri Kosina --- drivers/hid/hid-pxrc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hid/hid-pxrc.c b/drivers/hid/hid-pxrc.c index 71fe0c06ddcd..e3755d8b85c2 100644 --- a/drivers/hid/hid-pxrc.c +++ b/drivers/hid/hid-pxrc.c @@ -55,6 +55,9 @@ static int pxrc_raw_event(struct hid_device *hdev, struct hid_report *report, { struct pxrc_priv *priv = hid_get_drvdata(hdev); + if (size < 8) + return 0; + if (priv->alternate) priv->slider = data[7]; else