github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

HID: Intel-thc-hid: Intel-quickspi: Use hid_safe_input_report()

Browse Source 
Replace the deprecated hid_input_report() with
hid_safe_input_report(), which takes the allocated size of the input
report buffer and allows hid-core to validate the reported data length
against the actual buffer size.

Track the allocated size of qsdev->input_buf in the new input_len
field and pass it through quickspi_hid_send_report() to
hid_safe_input_report() to prevent potential out-of-bounds reads.

Fixes: 0a3fe972a7 ("HID: core: Mitigate potential OOB by removing bogus memset()")

Signed-off-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
This commit is contained in:
Even Xu 2026-09-22 10:54:37 +08:00 committed by Jiri Kosina
parent 48c72318ef
commit 291f4f310c
5 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
View File

@ -556,6 +556,8 @@ static int quickspi_alloc_report_buf(struct quickspi_device *qsdev)
if (!qsdev->input_buf)
return -ENOMEM;
qsdev->input_len = max_input_len;
max_report_len = max(le16_to_cpu(qsdev->dev_desc.max_output_len),
le16_to_cpu(qsdev->dev_desc.max_input_len));

2
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h
View File

@ -113,6 +113,7 @@ struct acpi_device;
* @low_power_ltr_val: THC low power LTR value
* @report_descriptor: store a copy of device report descriptor
* @input_buf: store a copy of latest input report data
* @input_len: the data size of the input report buffer
* @report_buf: store a copy of latest input/output report packet from set/get feature
* @report_len: the length of input/output report packet
* @reset_ack_wq: workqueue for waiting reset response from device
@ -159,6 +160,7 @@ struct quickspi_device {
u8 *report_descriptor;
u8 *input_buf;
u32 input_len;
u8 *report_buf;
u32 report_buf_size;
u32 report_len;

6
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
View File

@ -148,16 +148,18 @@ void quickspi_hid_remove(struct quickspi_device *qsdev)
*
* @qsdev: point to quickspi device
* @data: point to input report data buffer
* @buf_size: the allocated size of the input report data buffer
* @data_len: the length of input report data
*
* Return: 0 on success, non zero on error.
*/
int quickspi_hid_send_report(struct quickspi_device *qsdev,
void *data, size_t data_len)
void *data, size_t buf_size, size_t data_len)
{
int ret;
ret = hid_input_report(qsdev->hid_dev, HID_INPUT_REPORT, data, data_len, 1);
ret = hid_safe_input_report(qsdev->hid_dev, HID_INPUT_REPORT, data,
buf_size, data_len, 1);
if (ret)
dev_err(qsdev->dev, "Failed to send HID input report, ret = %d.\n", ret);

2
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h
View File

@ -7,7 +7,7 @@
struct quickspi_device;
int quickspi_hid_send_report(struct quickspi_device *qsdev,
void *data, size_t data_size);
void *data, size_t buf_size, size_t data_size);
int quickspi_hid_probe(struct quickspi_device *qsdev);
void quickspi_hid_remove(struct quickspi_device *qsdev);

2
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
View File

@ -240,7 +240,7 @@ void quickspi_handle_input_data(struct quickspi_device *qsdev, u32 buf_len)
input_len = sizeof(body_hdr->content_id) + input_len;
input_report = input_body->content - sizeof(body_hdr->content_id);
ret = quickspi_hid_send_report(qsdev, input_report, input_len);
ret = quickspi_hid_send_report(qsdev, input_report, qsdev->input_len, input_len);
if (ret)
dev_err_once(qsdev->dev, "Failed to send HID input report: %d\n", ret);