* [PATCH 0/2] HID: Intel-thc-hid: Use hid_safe_input_report()
@ 2026-09-22 2:54 Even Xu
2026-09-22 2:54 ` [PATCH 1/2] HID: Intel-thc-hid: Intel-quicki2c: " Even Xu
2026-09-22 2:54 ` [PATCH 2/2] HID: Intel-thc-hid: Intel-quickspi: " Even Xu
0 siblings, 2 replies; 3+ messages in thread
From: Even Xu @ 2026-09-22 2:54 UTC (permalink / raw)
To: bentiss, jikos; +Cc: srinivas.pandruvada, linux-input, linux-kernel, Even Xu
This patch set replace the legacy hid_input_report() with new
hid_safe_input_report() in quicki2c and quickspi drivers.
Even Xu (2):
HID: Intel-thc-hid: Intel-quicki2c: Use hid_safe_input_report()
HID: Intel-thc-hid: Intel-quickspi: Use hid_safe_input_report()
drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 4 +++-
drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h | 2 ++
drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c | 6 ++++--
drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h | 2 +-
drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 2 ++
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h | 2 ++
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c | 6 ++++--
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h | 2 +-
.../hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c | 2 +-
9 files changed, 20 insertions(+), 8 deletions(-)
--
2.43.0
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 1/2] HID: Intel-thc-hid: Intel-quicki2c: Use hid_safe_input_report()
2026-09-22 2:54 [PATCH 0/2] HID: Intel-thc-hid: Use hid_safe_input_report() Even Xu
@ 2026-09-22 2:54 ` Even Xu
2026-09-22 2:54 ` [PATCH 2/2] HID: Intel-thc-hid: Intel-quickspi: " Even Xu
1 sibling, 0 replies; 3+ messages in thread
From: Even Xu @ 2026-09-22 2:54 UTC (permalink / raw)
To: bentiss, jikos; +Cc: srinivas.pandruvada, linux-input, linux-kernel, Even Xu
Replace the deprecated hid_input_report() with
hid_safe_input_report(), which takes the allocated size of the input
report buffer and allows hid-core to validate the reported data length
against the actual buffer size.
Track the allocated size of qcdev->input_buf in the new input_len
field and pass it through quicki2c_hid_send_report() to
hid_safe_input_report() to prevent potential out-of-bounds reads.
Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Signed-off-by: Even Xu <even.xu@intel.com>
---
drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 4 +++-
drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h | 2 ++
drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c | 6 ++++--
drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h | 2 +-
4 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
index 2537288b5026..7a913f717efa 100644
--- a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
+++ b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
@@ -315,7 +315,7 @@ static int handle_input_report(struct quicki2c_device *qcdev)
if (qcdev->state != QUICKI2C_ENABLED)
continue;
- quicki2c_hid_send_report(qcdev, pkt->data,
+ quicki2c_hid_send_report(qcdev, pkt->data, qcdev->input_len,
HIDI2C_DATA_LEN(le16_to_cpu(pkt->len)));
}
@@ -611,6 +611,8 @@ static int quicki2c_alloc_report_buf(struct quicki2c_device *qcdev)
if (!qcdev->input_buf)
return -ENOMEM;
+ qcdev->input_len = max_report_len;
+
if (!le16_to_cpu(qcdev->dev_desc.max_output_len))
qcdev->dev_desc.max_output_len = cpu_to_le16(SZ_4K);
diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h
index 6d25a846153e..e9ff0440fb54 100644
--- a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h
+++ b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h
@@ -181,6 +181,7 @@ struct acpi_device;
* @low_power_ltr_val: THC low power LTR value
* @report_descriptor: Store a copy of device report descriptor
* @input_buf: Store a copy of latest input report data
+ * @input_len: The data size of the input report buffer
* @report_buf: Store a copy of latest input/output report packet from set/get feature
* @report_len: The length of input/output report packet
* @reset_ack_wq: Workqueue for waiting reset response from device
@@ -212,6 +213,7 @@ struct quicki2c_device {
u8 *report_descriptor;
u8 *input_buf;
+ size_t input_len;
u8 *report_buf;
size_t report_len;
diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c
index 8075992e8732..1a220a50d934 100644
--- a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c
+++ b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c
@@ -157,16 +157,18 @@ void quicki2c_hid_remove(struct quicki2c_device *qcdev)
*
* @qcdev: point to quicki2c device
* @data: point to input report data buffer
+ * @buf_size: the allocated size of the input report data buffer
* @data_len: the length of input report data
*
* Return: 0 on success, non zero on error.
*/
int quicki2c_hid_send_report(struct quicki2c_device *qcdev,
- void *data, size_t data_len)
+ void *data, size_t buf_size, size_t data_len)
{
int ret;
- ret = hid_input_report(qcdev->hid_dev, HID_INPUT_REPORT, data, data_len, 1);
+ ret = hid_safe_input_report(qcdev->hid_dev, HID_INPUT_REPORT, data,
+ buf_size, data_len, 1);
if (ret)
dev_err(qcdev->dev, "Failed to send HID input report, ret = %d.\n", ret);
diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h
index e80df5f339fe..4c6757eca18e 100644
--- a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h
+++ b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h
@@ -7,7 +7,7 @@
struct quicki2c_device;
int quicki2c_hid_send_report(struct quicki2c_device *qcdev,
- void *data, size_t data_size);
+ void *data, size_t buf_size, size_t data_size);
int quicki2c_hid_probe(struct quicki2c_device *qcdev);
void quicki2c_hid_remove(struct quicki2c_device *qcdev);
--
2.43.0
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 2/2] HID: Intel-thc-hid: Intel-quickspi: Use hid_safe_input_report()
2026-09-22 2:54 [PATCH 0/2] HID: Intel-thc-hid: Use hid_safe_input_report() Even Xu
2026-09-22 2:54 ` [PATCH 1/2] HID: Intel-thc-hid: Intel-quicki2c: " Even Xu
@ 2026-09-22 2:54 ` Even Xu
1 sibling, 0 replies; 3+ messages in thread
From: Even Xu @ 2026-09-22 2:54 UTC (permalink / raw)
To: bentiss, jikos; +Cc: srinivas.pandruvada, linux-input, linux-kernel, Even Xu
Replace the deprecated hid_input_report() with
hid_safe_input_report(), which takes the allocated size of the input
report buffer and allows hid-core to validate the reported data length
against the actual buffer size.
Track the allocated size of qsdev->input_buf in the new input_len
field and pass it through quickspi_hid_send_report() to
hid_safe_input_report() to prevent potential out-of-bounds reads.
Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Signed-off-by: Even Xu <even.xu@intel.com>
---
drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 2 ++
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h | 2 ++
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c | 6 ++++--
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h | 2 +-
.../hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c | 2 +-
5 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
index ad676fde211b..53023e30cf8d 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
@@ -557,6 +557,8 @@ static int quickspi_alloc_report_buf(struct quickspi_device *qsdev)
if (!qsdev->input_buf)
return -ENOMEM;
+ qsdev->input_len = max_input_len;
+
max_report_len = max(le16_to_cpu(qsdev->dev_desc.max_output_len),
le16_to_cpu(qsdev->dev_desc.max_input_len));
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h
index dc67a39ad546..fe51ff51d8c0 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h
@@ -113,6 +113,7 @@ struct acpi_device;
* @low_power_ltr_val: THC low power LTR value
* @report_descriptor: store a copy of device report descriptor
* @input_buf: store a copy of latest input report data
+ * @input_len: the data size of the input report buffer
* @report_buf: store a copy of latest input/output report packet from set/get feature
* @report_len: the length of input/output report packet
* @reset_ack_wq: workqueue for waiting reset response from device
@@ -159,6 +160,7 @@ struct quickspi_device {
u8 *report_descriptor;
u8 *input_buf;
+ u32 input_len;
u8 *report_buf;
u32 report_buf_size;
u32 report_len;
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
index a60a0a7f16aa..ed1c40b8c4fa 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
@@ -148,16 +148,18 @@ void quickspi_hid_remove(struct quickspi_device *qsdev)
*
* @qsdev: point to quickspi device
* @data: point to input report data buffer
+ * @buf_size: the allocated size of the input report data buffer
* @data_len: the length of input report data
*
* Return: 0 on success, non zero on error.
*/
int quickspi_hid_send_report(struct quickspi_device *qsdev,
- void *data, size_t data_len)
+ void *data, size_t buf_size, size_t data_len)
{
int ret;
- ret = hid_input_report(qsdev->hid_dev, HID_INPUT_REPORT, data, data_len, 1);
+ ret = hid_safe_input_report(qsdev->hid_dev, HID_INPUT_REPORT, data,
+ buf_size, data_len, 1);
if (ret)
dev_err(qsdev->dev, "Failed to send HID input report, ret = %d.\n", ret);
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h
index f640fa876a40..61b7c6be6c51 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h
@@ -7,7 +7,7 @@
struct quickspi_device;
int quickspi_hid_send_report(struct quickspi_device *qsdev,
- void *data, size_t data_size);
+ void *data, size_t buf_size, size_t data_size);
int quickspi_hid_probe(struct quickspi_device *qsdev);
void quickspi_hid_remove(struct quickspi_device *qsdev);
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
index 847c5ec55569..0df33c44fbff 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
@@ -240,7 +240,7 @@ void quickspi_handle_input_data(struct quickspi_device *qsdev, u32 buf_len)
input_len = sizeof(body_hdr->content_id) + input_len;
input_report = input_body->content - sizeof(body_hdr->content_id);
- ret = quickspi_hid_send_report(qsdev, input_report, input_len);
+ ret = quickspi_hid_send_report(qsdev, input_report, qsdev->input_len, input_len);
if (ret)
dev_err_once(qsdev->dev, "Failed to send HID input report: %d\n", ret);
--
2.43.0
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-22 2:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-22 2:54 [PATCH 0/2] HID: Intel-thc-hid: Use hid_safe_input_report() Even Xu
2026-09-22 2:54 ` [PATCH 1/2] HID: Intel-thc-hid: Intel-quicki2c: " Even Xu
2026-09-22 2:54 ` [PATCH 2/2] HID: Intel-thc-hid: Intel-quickspi: " Even Xu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®