Re: [PATCH v3 03/12] HID: asus: add gamepad configuration

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Invalid cast of parent device to usb_interface or usb_device without checking hid_is_usb().
--

--- Patch [3]: [PATCH v3 03/12] HID: asus: add gamepad configuration ---
commit f281ed94708b0871557c0870cec3173a2e3fa823
Author: Denis Benato <denis.benato@linux.dev>

HID: asus: add gamepad configuration

Add the base configuration structures for the gamepad configuration,
detect capabilities and initialize the device in a known state.

> diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
> index 048bc902323ab..04f41294edf67 100644
> --- a/drivers/hid/hid-asus.c
> +++ b/drivers/hid/hid-asus.c

[ ... ]

> @@ -964,6 +1254,7 @@ static struct ally_handheld *hid_asus_ally_probe(struct hid_device *hdev)
>  	unsigned long flags;
>  	int ret, ep = ally_get_endpoint_address(hdev);
>  	struct usb_device *udev;
> +	struct ally_config *ally_cfg;
>  	struct hid_input *hidinput;
>  
>  	if (ep < 0)

[Severity: High]
This is a pre-existing issue, but in hid_asus_ally_probe() in
drivers/hid/hid-asus.c, there is an unsafe cast of the parent device to a
usb_interface and usb_device without first verifying the transport.

If a userspace process creates a virtual device via /dev/uhid with the Asus
ROG Ally vendor and product IDs, the HID core binds this driver, assigns the
QUIRK_ROG_ALLY_XPAD quirk, and calls hid_asus_ally_probe() in asus_probe():

    if (drvdata->quirks & QUIRK_ROG_ALLY_XPAD) {
        ally = hid_asus_ally_probe(hdev);

Since the transport is not verified with hid_is_usb(hdev), the driver
blindly casts the uhid parent device to struct usb_interface:

    udev = interface_to_usbdev(to_usb_interface(hdev->dev.parent));

This results in garbage pointers being passed to usb_get_dev(udev), which
can immediately panic the kernel or lead to a use-after-free or out-of-bounds
access. This is reachable by any unprivileged userspace process that has
access to /dev/uhid, allowing for a local denial of service.

Should this code check hid_is_usb(hdev) before making USB-specific casts?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260823185849.2478673-1-denis.benato@linux.dev?part=3