Re: [PATCH 00/10] HID: validate short reports in raw_event callbacks

[Jiri Kosina]

On Thu, 24 Sep 2026, Jiale Yao wrote:

> __hid_input_report() calls a driver's raw_event callback before
> hid_report_raw_event() validates the received length against the report
> descriptor.  A raw_event callback must therefore validate size before
> accessing fixed offsets or casting data to a protocol structure.
> 
> Ten HID drivers currently access fields beyond the received length when a
> device supplies a truncated report.  Add protocol-specific checks before
> those accesses.  The patches are independent and each changes one driver.
> 
> The mcp2200, pxrc, and zydacron cases were reproduced with a fake HID
> transport under KASAN.  Their individual commit messages include the
> relevant reports.  The remaining paths were verified by following their
> fixed-offset accesses from raw_event.
> 
> This follows the local raw_event size check added to hid-asus by commit
> 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence").

Applied to hid.git#for-7.3/upstream-fixes, thanks.

-- 
Jiri Kosina
SUSE Labs