From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f169.google.com (mail-dy1-f169.google.com [74.125.82.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8259C4718CF for ; Tue, 13 Oct 2026 03:42:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791862946; cv=none; b=Gkz7eHJQLO1LeZ1Y/c9yTsr9FTKomS9BMKFkXs4Ay3l0TvT+fqOsgFDKsN5XQBKqQxOcvVmrlb1smLqVfV6sykTqOvRbPzUY0F11Crdc+ROSX84xqVj2WgD9FtVpfNQ1dAhD3YxWHnM9rEwUXqaL1dR6w9hmd/RYgzRd816ANhI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791862946; c=relaxed/simple; bh=r+0rEvl16tl5MFS7IvaIWOTr/Pw7YJ+JGqq+rLFp9v0=; h=From:Subject:Date:Message-Id:MIME-Version:Content-Type:To:Cc; b=P+rXJezffA73grwfYHhyGfeYZ3qFVNqXaGS3uN487UJna6v2Z/W860ZDy26IYLOHvJOZMum/8B6aQDyDEEXFb3FTjWAX7AwX8r7Z9CSGHHgN01E3eogtq4y/ifDJuHwydR6Gnef3WI9JH+wDP2zFkLorXO5k/vmuP0KAWl7X++k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SSTvWEGG; arc=none smtp.client-ip=74.125.82.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SSTvWEGG" Received: by mail-dy1-f169.google.com with SMTP id 5a478bee46e88-35aa0cf7c40so1796290eec.1 for ; Mon, 12 Oct 2026 20:42:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791862943; x=1792467743; darn=vger.kernel.org; h=cc:to:content-transfer-encoding:content-type:mime-version :message-id:date:subject:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=FcWhYyMaObwSepUpV7jMJrwtLJljkaTCoJTBVFoTJKo=; b=SSTvWEGGy+9t+x43ncKuQSN+1W/Mmf6qGJgTVIcQWn3hBDHT6eaWSx/kKyU1HvwGLO GbW0rzpiuIHU+5wG1ohOfQIvFH1paE6VUtcHd8IC+XQjrK0SA/Hf0u2U6waAhP95FiI/ 8nEbfsS4cihUFXupVXEDofG6ZW+9YHxgERFl2z15e23f5EOB72eLKEW0BUXOWsEMBbbb GU8t+mK+jEEpwPDAbnR4CbAq7BlquaYuoFkgDaiok5gHS0feosILKNW7GVGfMuRpLnOP xCd2CU3l4eYrBG5rzRvuAaEDV2B2aqJk+G023onWsVpZXVesNOeSVva3cvBSFt5QU5fa jDhA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791862943; x=1792467743; h=cc:to:content-transfer-encoding:content-type:mime-version :message-id:date:subject:from:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=FcWhYyMaObwSepUpV7jMJrwtLJljkaTCoJTBVFoTJKo=; b=oo8KpPlTHmFSMGzM6LQNzfUwyjp0SWOKzyyDl1L490hkfnNwmXabuBj+tylopmNd1j zKozP6J6VhObTxJ4QAYCggFD398di50urfr9ncl/nMwHVc1yzggbS38GM7ASfFoCb3MS GfrB0z+rhJgPuaVZpnKKCv+B/x21ArIXQxtloawU41h8rTxf11m/+wKzSb5Xm6hEEMhc zkCkZ9zHjDtduBXZb7geA3x2EUJyNL7uRKzxg2C8vHqxO7lO6+reEETv4wKTJxFbLem1 yO2OM7aho8/6Q9m8gouIrTad4++p1Uf5X+FtT87UY3u6LJRd4Cn6LvGi0WEkvWa3Z/ij 00qw== X-Forwarded-Encrypted: i=1; AKwUvBxf9p/IkjTtxRz777UY41e0yJmhCROJ9ciFKmTY1uve1p0R/nt+h6YUo9hqhb4XOChbeA52cX0fRIut2OM=@vger.kernel.org X-Gm-Message-State: AFq9FYIYa+hX2oUirfXNbXEXfb8nuFtuP9TjchZRCTQ9rL9AA7Zrh7Mr vfoyKxmHQBehM69USsdYg0eNHb4NwgnQSM4THik8/WivZNUwT5qSvOml X-Gm-Gg: AYBFou298SP31zHkEuLlhU7Cmk7ze6KcQNWAezZJ+ZMe+7UXt1+EGN/CvSbUka/WobH jamHNA+0aulHdiTN/+oMEnSrrJY7dda1r5aAkfRqgY8tLbOR5uvL9WnagHLIEBQ5S+lntCCCsFP UCKFIn5doRL9kVoYZJqwO8QiHfd35qdhS01IRiFLBYZUZgNFLu2udj+zLEH9nxLWjxfzIFzU+h2 hXEg1MG1LRuL1k8eMubpf4nqb541w/D/FVyhqySSv3dEDeovHYzaVQ2rS1U0YKqdUJY+xYsTxD2 QpdTWwinBBSObFCiKeSDvgbHVVpVGkia2X5DHHVHVzpjT1faoZ6qVlVvb41gLFbrWk+XTGSap4N HUAV930srAzgph0L85b9/xyvBnI7bT2S58yJyulABdh6tBD0Ll3lB9AOML/nMRhU3cJxv/gzBtf IhCijqQxKSGej63uPZRJr/bpALMf4Bz8uBSRdJo3dPBTLXhylMKTNDZEY+8k3SIiIIczEkaYWVs qX8Mp0d3U6m4SDIsT9/xrdmu0FqvXE0/m9ouM+5opRyNXZsoXVYK8fjbXbde50+1qxd5pxscg== X-Received: by 2002:a05:693c:87c8:20b0:358:90dd:78d with SMTP id 5a478bee46e88-35890dd07bemr11938388eec.19.1791862943383; Mon, 12 Oct 2026 20:42:23 -0700 (PDT) Received: from dtor-ws.sjc.corp.google.com ([2a00:79e0:2ebe:8:679a:f35b:7c29:e0f2]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3537cb68e56sm35268677eec.29.2026.10.12.20.42.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 20:42:22 -0700 (PDT) From: Dmitry Torokhov Subject: [PATCH 0/9] HID: Hardening report validation and unnumbered report handling Date: Mon, 12 Oct 2026 20:42:16 -0700 Message-Id: <20261012-hid-core-report-validation-v1-0-e0dd5cb60b2e@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-B4-Tracking: v=1; b=H4sIAJiozWoC/yXMwQrCMAyA4VcZORtYK3PFVxEPMY1bxlhHWocw9 u5WPX6H/98hi6lkuDY7mGyaNS0V7tQAj7QMghqrwbf+4lrncdSInEzQZE1WcKNZI5WaYWAKXTy HjqmHOlhNnvr+zW/3v/PrMQmX7xGO4wMYWcr+fgAAAA== X-Change-ID: 20261012-hid-core-report-validation-8ca85d385ca7 To: Marcel Holtmann , Luiz Augusto von Dentz , David Rheinsberg , Frank Praznik , Jiri Kosina , Benjamin Tissoires , Even Xu , Xinpeng Sun , Roderick Colenbrander Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, linux-input@vger.kernel.org, Shashikirana H K X-Mailer: b4 0.17-dev-e56a4 This series improves validation and consistency across HID core, transport drivers, and individual device drivers for numbered and unnumbered reports. Bluetooth HIDP and HID core report retrieval handling are updated to properly respect the kernel convention where raw report request buffers reserve the first byte for the report ID, using 0 for unnumbered reports. Report descriptors mixing numbered and unnumbered reports within the same report enumeration are rejected in accordance with the HID specification. Report ID verification for successful report retrieval transfers is centralized in the HID core, with a new device quirk to accommodate buggy firmware (such as the ASUS ROG Flow Z13 touchpad). Redundant report ID checks are removed across the I2C-HID, Goodix SPI, Intel QuickI2C, multitouch, and PlayStation drivers. Signed-off-by: Dmitry Torokhov --- Dmitry Torokhov (9): Bluetooth: HIDP: Fix GET_REPORT and SET_REPORT for unnumbered reports HID: core: Fix GET_REPORT input processing for unnumbered reports HID: core: Reject mixing numbered and unnumbered reports HID: core: Validate GET_REPORT report ID centrally HID: i2c-hid: Drop redundant report ID validation HID: goodix-spi: Drop redundant report ID validation HID: intel-thc-hid: Drop redundant report ID validation in quicki2c HID: multitouch: Drop redundant report ID validation in mt_get_feature HID: playstation: Drop redundant report ID validation in ps_get_report drivers/hid/hid-core.c | 26 ++++++++++++++++-- drivers/hid/hid-goodix-spi.c | 5 ---- drivers/hid/hid-multitouch.c | 32 ---------------------- drivers/hid/hid-playstation.c | 5 ---- drivers/hid/hid-quirks.c | 2 ++ drivers/hid/i2c-hid/i2c-hid-core.c | 7 ----- .../intel-quicki2c/quicki2c-protocol.c | 6 ++-- include/linux/hid.h | 2 ++ net/bluetooth/hidp/core.c | 29 ++++++++++++++++---- 9 files changed, 53 insertions(+), 61 deletions(-) --- base-commit: b018686719706a781c45a874ed51374a2dc4b767 change-id: 20261012-hid-core-report-validation-8ca85d385ca7 Thanks. -- Dmitry