Re: [PATCH 0/7] HID: roccat: validate raw report lengths

[Benjamin Tissoires]

On Thu, 24 Sep 2026 22:29:10 +0800, Jiale Yao wrote:
> Roccat raw event callbacks receive the report before HID core validates
> and pads its length.  Seven callbacks inspect fixed-format reports without
> first ensuring that the complete report was received.
> 
> Add per-driver length checks before parsing or forwarding these reports.
> The first five patches protect helpers which read fixed fields, while the
> konepure and ryos patches additionally prevent a fixed-size copy of a
> truncated report into the Roccat character-device event stream.
> 
> [...]

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git (for-7.4/roccat), thanks!

[1/7] HID: roccat: isku: reject short button reports
      https://git.kernel.org/hid/hid/c/93e5f7f6189a
[2/7] HID: roccat: koneplus: reject short button reports
      https://git.kernel.org/hid/hid/c/d879e17a8b4c
[3/7] HID: roccat: konepure: reject short button reports
      https://git.kernel.org/hid/hid/c/1590b7c9bea0
[4/7] HID: roccat: kovaplus: reject short button reports
      https://git.kernel.org/hid/hid/c/e95917a606f4
[5/7] HID: roccat: pyra: reject short button reports
      https://git.kernel.org/hid/hid/c/493268f459bb
[6/7] HID: roccat: ryos: reject short special reports
      https://git.kernel.org/hid/hid/c/02f3607d0beb
[7/7] HID: roccat: savu: reject short special reports
      https://git.kernel.org/hid/hid/c/76c51fdc825a

Cheers,
-- 
Benjamin Tissoires <bentiss@xxxxxxxxxx>