From 48c72318ef1e9017b6c34cf73eed453d0dc9c2d4 Mon Sep 17 00:00:00 2001 From: Even Xu Date: Tue, 22 Sep 2026 10:54:36 +0800 Subject: [PATCH 1/2] HID: Intel-thc-hid: Intel-quicki2c: Use hid_safe_input_report() Replace the deprecated hid_input_report() with hid_safe_input_report(), which takes the allocated size of the input report buffer and allows hid-core to validate the reported data length against the actual buffer size. Track the allocated size of qcdev->input_buf in the new input_len field and pass it through quicki2c_hid_send_report() to hid_safe_input_report() to prevent potential out-of-bounds reads. Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()") Signed-off-by: Even Xu Signed-off-by: Jiri Kosina --- drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 4 +++- drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h | 2 ++ drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c | 6 ++++-- drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h | 2 +- 4 files changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c index 0d2ad7bc3648..6cf19dac8e18 100644 --- a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c +++ b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c @@ -315,7 +315,7 @@ static int handle_input_report(struct quicki2c_device *qcdev) if (qcdev->state != QUICKI2C_ENABLED) continue; - quicki2c_hid_send_report(qcdev, pkt->data, + quicki2c_hid_send_report(qcdev, pkt->data, qcdev->input_len, HIDI2C_DATA_LEN(le16_to_cpu(pkt->len))); } @@ -610,6 +610,8 @@ static int quicki2c_alloc_report_buf(struct quicki2c_device *qcdev) if (!qcdev->input_buf) return -ENOMEM; + qcdev->input_len = max_report_len; + if (!le16_to_cpu(qcdev->dev_desc.max_output_len)) qcdev->dev_desc.max_output_len = cpu_to_le16(SZ_4K); diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h index 6d25a846153e..e9ff0440fb54 100644 --- a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h +++ b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h @@ -181,6 +181,7 @@ struct acpi_device; * @low_power_ltr_val: THC low power LTR value * @report_descriptor: Store a copy of device report descriptor * @input_buf: Store a copy of latest input report data + * @input_len: The data size of the input report buffer * @report_buf: Store a copy of latest input/output report packet from set/get feature * @report_len: The length of input/output report packet * @reset_ack_wq: Workqueue for waiting reset response from device @@ -212,6 +213,7 @@ struct quicki2c_device { u8 *report_descriptor; u8 *input_buf; + size_t input_len; u8 *report_buf; size_t report_len; diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c index 8075992e8732..1a220a50d934 100644 --- a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c +++ b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c @@ -157,16 +157,18 @@ void quicki2c_hid_remove(struct quicki2c_device *qcdev) * * @qcdev: point to quicki2c device * @data: point to input report data buffer + * @buf_size: the allocated size of the input report data buffer * @data_len: the length of input report data * * Return: 0 on success, non zero on error. */ int quicki2c_hid_send_report(struct quicki2c_device *qcdev, - void *data, size_t data_len) + void *data, size_t buf_size, size_t data_len) { int ret; - ret = hid_input_report(qcdev->hid_dev, HID_INPUT_REPORT, data, data_len, 1); + ret = hid_safe_input_report(qcdev->hid_dev, HID_INPUT_REPORT, data, + buf_size, data_len, 1); if (ret) dev_err(qcdev->dev, "Failed to send HID input report, ret = %d.\n", ret); diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h index e80df5f339fe..4c6757eca18e 100644 --- a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h +++ b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h @@ -7,7 +7,7 @@ struct quicki2c_device; int quicki2c_hid_send_report(struct quicki2c_device *qcdev, - void *data, size_t data_size); + void *data, size_t buf_size, size_t data_size); int quicki2c_hid_probe(struct quicki2c_device *qcdev); void quicki2c_hid_remove(struct quicki2c_device *qcdev); From 291f4f310cc18ff8f5addbc3c9fbe33877283ec7 Mon Sep 17 00:00:00 2001 From: Even Xu Date: Tue, 22 Sep 2026 10:54:37 +0800 Subject: [PATCH 2/2] HID: Intel-thc-hid: Intel-quickspi: Use hid_safe_input_report() Replace the deprecated hid_input_report() with hid_safe_input_report(), which takes the allocated size of the input report buffer and allows hid-core to validate the reported data length against the actual buffer size. Track the allocated size of qsdev->input_buf in the new input_len field and pass it through quickspi_hid_send_report() to hid_safe_input_report() to prevent potential out-of-bounds reads. Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()") Signed-off-by: Even Xu Signed-off-by: Jiri Kosina --- drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 2 ++ drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h | 2 ++ drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c | 6 ++++-- drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h | 2 +- .../hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c | 2 +- 5 files changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c index 89226f5ce45e..5c5e300c6418 100644 --- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c +++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c @@ -556,6 +556,8 @@ static int quickspi_alloc_report_buf(struct quickspi_device *qsdev) if (!qsdev->input_buf) return -ENOMEM; + qsdev->input_len = max_input_len; + max_report_len = max(le16_to_cpu(qsdev->dev_desc.max_output_len), le16_to_cpu(qsdev->dev_desc.max_input_len)); diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h index dc67a39ad546..fe51ff51d8c0 100644 --- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h +++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h @@ -113,6 +113,7 @@ struct acpi_device; * @low_power_ltr_val: THC low power LTR value * @report_descriptor: store a copy of device report descriptor * @input_buf: store a copy of latest input report data + * @input_len: the data size of the input report buffer * @report_buf: store a copy of latest input/output report packet from set/get feature * @report_len: the length of input/output report packet * @reset_ack_wq: workqueue for waiting reset response from device @@ -159,6 +160,7 @@ struct quickspi_device { u8 *report_descriptor; u8 *input_buf; + u32 input_len; u8 *report_buf; u32 report_buf_size; u32 report_len; diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c index a60a0a7f16aa..ed1c40b8c4fa 100644 --- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c +++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c @@ -148,16 +148,18 @@ void quickspi_hid_remove(struct quickspi_device *qsdev) * * @qsdev: point to quickspi device * @data: point to input report data buffer + * @buf_size: the allocated size of the input report data buffer * @data_len: the length of input report data * * Return: 0 on success, non zero on error. */ int quickspi_hid_send_report(struct quickspi_device *qsdev, - void *data, size_t data_len) + void *data, size_t buf_size, size_t data_len) { int ret; - ret = hid_input_report(qsdev->hid_dev, HID_INPUT_REPORT, data, data_len, 1); + ret = hid_safe_input_report(qsdev->hid_dev, HID_INPUT_REPORT, data, + buf_size, data_len, 1); if (ret) dev_err(qsdev->dev, "Failed to send HID input report, ret = %d.\n", ret); diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h index f640fa876a40..61b7c6be6c51 100644 --- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h +++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h @@ -7,7 +7,7 @@ struct quickspi_device; int quickspi_hid_send_report(struct quickspi_device *qsdev, - void *data, size_t data_size); + void *data, size_t buf_size, size_t data_size); int quickspi_hid_probe(struct quickspi_device *qsdev); void quickspi_hid_remove(struct quickspi_device *qsdev); diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c index 847c5ec55569..0df33c44fbff 100644 --- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c +++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c @@ -240,7 +240,7 @@ void quickspi_handle_input_data(struct quickspi_device *qsdev, u32 buf_len) input_len = sizeof(body_hdr->content_id) + input_len; input_report = input_body->content - sizeof(body_hdr->content_id); - ret = quickspi_hid_send_report(qsdev, input_report, input_len); + ret = quickspi_hid_send_report(qsdev, input_report, qsdev->input_len, input_len); if (ret) dev_err_once(qsdev->dev, "Failed to send HID input report: %d\n", ret);