Re: [PATCH RESEND] HID: corsair-void: Fix firmware event packet description

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] Missing report size validation in `corsair_void_raw_event` allows out-of-bounds read of the `data` array, leading to processing of uninitialized or stale data.
--

--- Patch [1]: [PATCH RESEND] HID: corsair-void: Fix firmware event packet description ---
commit 80e19492934a593a71b8da5c14d031065a2f1255
Author: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>

HID: corsair-void: Fix firmware event packet description

This commit updates the firmware event packet description in the corsair-void
driver. It corrects the size to 5 bytes to account for the report ID and
updates the byte indices for the firmware version fields.

> diff --git a/drivers/hid/hid-corsair-void.c b/drivers/hid/hid-corsair-void.c
> index 5e9a5b8f7f167..ce92e3a9c0580 100644
> --- a/drivers/hid/hid-corsair-void.c
> +++ b/drivers/hid/hid-corsair-void.c

[ ... ]

> - * 3: Headset firmware minor version
> + * 4: Headset firmware minor version
>   *  Minor version of the headset's firmware
>   */
>  /* -------------------------------------------------------------------------- */

[Severity: Medium]
This is a pre-existing issue, but since the documentation correctly notes the
receiver responds with 5 bytes, does the driver need to validate this size
before parsing the packet?

In drivers/hid/hid-corsair-void.c:corsair_void_raw_event(), the data array is
accessed up to index 4 without first validating the report size:

	} else if (hid_report->id == CORSAIR_VOID_FIRMWARE_REPORT_ID) {
		drvdata->fw_receiver_major = data[1];
		drvdata->fw_receiver_minor = data[2];
		drvdata->fw_headset_major = data[3];
		drvdata->fw_headset_minor = data[4];
	}

If an untrusted or misbehaving USB device sends a short report where the size
is less than 5, could this lead to an out-of-bounds read and cause the driver
to process uninitialized or stale data from the HID core's input buffer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260818130053.45064-2-stuart.a.hayhurst@gmail.com?part=1