mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Benjamin Tissoires <bentiss@kernel.org>
To: Jiri Kosina <jikos@kernel.org>, Shuah Khan <shuah@kernel.org>
Cc: linux-input@vger.kernel.org, linux-kselftest@vger.kernel.org,
	 linux-kernel@vger.kernel.org,
	Benjamin Tissoires <bentiss@kernel.org>
Subject: [PATCH 3/4] HID: fix LEDs when report is unnumbered
Date: Fri, 13 Mar 2026 08:40:26 +0100	[thread overview]
Message-ID: <20260313-wip-bpf-fixes-v1-3-74b860315060@kernel.org> (raw)
In-Reply-To: <20260313-wip-bpf-fixes-v1-0-74b860315060@kernel.org>

Both usbhid and i2c-hid are expecting the first byte of the incoming
data to be the report ID. It should be set to 0 when the report ID is
not used. Currently, we are not enforcing this, which means that if we
enforce HID-BPF for LEDs, we will not be able to send them.

Note that the allocated buffer takes into account that extra byte, so
this is safe to shift the data buffer by one.

Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
 drivers/hid/hid-input.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index d5308adb2894..eb84f63c51b8 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -1830,9 +1830,9 @@ static void hidinput_led_worker(struct work_struct *work)
 					      led_work);
 	struct hid_field *field;
 	struct hid_report *report;
+	__u8 *buf, *data;
 	int ret;
 	u32 len;
-	__u8 *buf;
 
 	field = hidinput_get_led_field(hid);
 	if (!field)
@@ -1863,7 +1863,14 @@ static void hidinput_led_worker(struct work_struct *work)
 	if (!buf)
 		return;
 
-	hid_output_report(report, buf);
+	data = buf;
+	if (!report->id) {
+		data = &buf[1];
+		len++;
+	}
+
+	hid_output_report(report, data);
+
 	/* synchronous output report */
 	ret = hid_hw_output_report(hid, buf, len);
 	if (ret == -ENOSYS)

-- 
2.52.0


  parent reply	other threads:[~2026-03-13  7:40 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-03-13  7:40 [PATCH 0/4] HID: bpf fixes for 7.0/7.1 Benjamin Tissoires
2026-03-13  7:40 ` [PATCH 1/4] selftests/hid: fix compilation when bpf_wq and hid_device are not exported Benjamin Tissoires
2026-03-13  9:02   ` Thomas Weißschuh
2026-03-13 13:28     ` Benjamin Tissoires
2026-03-13 15:58   ` Jiri Kosina
2026-03-13  7:40 ` [PATCH 2/4] HID: bpf: prevent buffer overflow in hid_hw_request Benjamin Tissoires
2026-03-13 15:58   ` Jiri Kosina
2026-03-13  7:40 ` Benjamin Tissoires [this message]
2026-03-13  7:40 ` [PATCH 4/4] HID: do not bypass HID-BPF when setting LEDs Benjamin Tissoires
2026-03-16 15:59 ` (subset) [PATCH 0/4] HID: bpf fixes for 7.0/7.1 Benjamin Tissoires

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260313-wip-bpf-fixes-v1-3-74b860315060@kernel.org \
    --to=bentiss@kernel.org \
    --cc=jikos@kernel.org \
    --cc=linux-input@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=shuah@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®