Re: [PATCH v3 02/12] HID: asus: add support for ROG Ally handhelds

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing endpoint count validation leads to an Out-Of-Bounds read on malformed USB devices.
--

--- Patch [2]: [PATCH v3 02/12] HID: asus: add support for ROG Ally handhelds ---
commit 361cb3e0d7ac3fa396f12b80e08c07137d346210
Author: Denis Benato <denis.benato@linux.dev>

HID: asus: add support for ROG Ally handhelds

This commit adds support for ASUS ROG Ally handhelds. It extends the 
hid-asus driver to initialize the device to a ready state, implements 
Ally X input mapping, and manages specific handheld features.

> diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
> index 9ce21fcc7d2e0..048bc902323ab 100644
> --- a/drivers/hid/hid-asus.c
> +++ b/drivers/hid/hid-asus.c

[ ... ]

> +static int ally_get_endpoint_address(struct hid_device *hdev)
> +{
> +	struct usb_host_endpoint *ep;
> +	struct usb_interface *intf;
> +
> +	if (!hid_is_usb(hdev))
> +		return -ENODEV;
> +
> +	intf = to_usb_interface(hdev->dev.parent);
> +	if (!intf || !intf->cur_altsetting)
> +		return -ENODEV;
> +
> +	ep = intf->cur_altsetting->endpoint;
> +	if (!ep)
> +		return -ENODEV;
> +
> +	return ep->desc.bEndpointAddress;

[Severity: High]
Does this code miss a check for the number of endpoints?

If a malformed USB device provides an interface with 0 endpoints
(where bNumEndpoints == 0), the endpoint array could be empty. Accessing
ep->desc.bEndpointAddress (which is essentially endpoint[0].desc) could
then result in an out-of-bounds read or a kernel panic when syzkaller or a
malicious peripheral interacts with the system.

Should this function verify that intf->cur_altsetting->desc.bNumEndpoints > 0
before attempting to access the endpoint structure?

> +}

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260823185849.2478673-1-denis.benato@linux.dev?part=2