[PATCH] HID: oxp: reject short input reports

[PATCH] HID: oxp: reject short input reports

[Jiale Yao]

oxp_hid_raw_event() logs a full OXP packet and then dispatches it to one
of two parsers. Both parsers access fixed offsets and cast the input to
fixed-size report structures without checking the received length. A short
report can therefore be read beyond its valid data.

Reject reports shorter than the fixed OXP packet size before logging or
dispatching them.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/hid/hid-oxp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-oxp.c b/drivers/hid/hid-oxp.c
index 1e691ebc1199..e1e1b99e9878 100644
--- a/drivers/hid/hid-oxp.c
+++ b/drivers/hid/hid-oxp.c
@@ -435,6 +435,9 @@ static int oxp_hid_raw_event(struct hid_device *hdev, struct hid_report *report,
 {
 	u16 up = get_usage_page(hdev);
 
+	if (size < OXP_PACKET_SIZE)
+		return 0;
+
 	dev_dbg(&hdev->dev, "raw event data: [%*ph]\n", OXP_PACKET_SIZE, data);
 
 	switch (up) {
-- 
2.34.1

Re:[PATCH] HID: oxp: reject short input reports

[jiale yao]

At 2026-10-17 14:23:47, "Jiale Yao" <yaojiale02@163.com> wrote:
>oxp_hid_raw_event() logs a full OXP packet and then dispatches it to one
>of two parsers. Both parsers access fixed offsets and cast the input to
>fixed-size report structures without checking the received length. A short
>report can therefore be read beyond its valid data.
>
>Reject reports shorter than the fixed OXP packet size before logging or
>dispatching them.
>

Fixes: 84910c459d65 ("HID: hid-oxp: Add OneXPlayer configuration driver")
Fixes: 252c4bf1d931 ("HID: hid-oxp: Add Second Generation RGB Control")

>Signed-off-by: Jiale Yao <yaojiale02@163.com>
>---
> drivers/hid/hid-oxp.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/drivers/hid/hid-oxp.c b/drivers/hid/hid-oxp.c
>index 1e691ebc1199..e1e1b99e9878 100644
>--- a/drivers/hid/hid-oxp.c
>+++ b/drivers/hid/hid-oxp.c
>@@ -435,6 +435,9 @@ static int oxp_hid_raw_event(struct hid_device *hdev, struct hid_report *report,
> {
> 	u16 up = get_usage_page(hdev);
> 
>+	if (size < OXP_PACKET_SIZE)
>+		return 0;
>+
> 	dev_dbg(&hdev->dev, "raw event data: [%*ph]\n", OXP_PACKET_SIZE, data);
> 
> 	switch (up) {
>-- 
>2.34.1