From c2deafcb4c8227771f768d77ed3c0a489250e9b2 Mon Sep 17 00:00:00 2001 From: Jiale Yao Date: Thu, 24 Sep 2026 22:44:08 +0800 Subject: [PATCH] HID: logitech-dj: validate unnumbered keyboard reports The HID core invokes raw_event callbacks before validating the report length. For an unnumbered keyboard report, logi_dj_raw_event() uses the second byte as temporary storage while prepending a report ID. A one-byte report therefore makes both the initial write and the later restoration access data beyond the received report. Reject unnumbered keyboard reports that do not provide the temporary byte. Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") added the same kind of raw_event length validation to hid-asus. Fixes: 74808f9115ce ("HID: logitech-dj: add support for non unifying receivers") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao Signed-off-by: Jiri Kosina --- drivers/hid/hid-logitech-dj.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c index 390d106d5dc1..6e8db01d27ec 100644 --- a/drivers/hid/hid-logitech-dj.c +++ b/drivers/hid/hid-logitech-dj.c @@ -1790,6 +1790,9 @@ static int logi_dj_raw_event(struct hid_device *hdev, if (!hdev->report_enum[HID_INPUT_REPORT].numbered) { if (djrcv_dev->unnumbered_application == HID_GD_KEYBOARD) { + if (size < 2) + return false; + /* * For the keyboard, we can reuse the same report by * using the second byte which is constant in the USB