Re: [PATCH 12/15] HID: hid-oxp: support three-page button maps on X2 controllers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Invalid cast of HID parent device to `usb_interface` without verifying the transport layer.
--

commit 435c693ab184a92fb526c35572b01cbea8f10f4a
Author: Andrei Aldea <andrei1998@gmail.com>

HID: hid-oxp: support three-page button maps on X2 controllers

This commit adds support for a three-page button map format on the ONEXPLAYER
3 and X2 Mini Pro using exact DMI matches. It initializes the pages and limits
duplicate LED registration by restricting initialization to configuration
interface 2.

> diff --git a/drivers/hid/hid-oxp.c b/drivers/hid/hid-oxp.c
> index 8c44f576f3956..48fa9169b84c7 100644
> --- a/drivers/hid/hid-oxp.c
> +++ b/drivers/hid/hid-oxp.c

[ ... ]

> @@ -1613,6 +1653,21 @@ static void oxp_quiesce_work(struct oxp_hid_cfg *cfg)
>  	oxp_drain_output(cfg);
>  }
>  
> +static bool oxp_is_cfg_interface(struct hid_device *hdev,
> +				 const struct quirk_entry *quirks)
> +{
> +	struct usb_interface *intf;
> +
> +	if (!quirks || !quirks->cfg_interface_num)
> +		return true;
> +	if (hdev->bus != BUS_USB)
> +		return false;
> +
> +	intf = to_usb_interface(hdev->dev.parent);

[Severity: High]
Can this cast to a usb_interface lead to an out-of-bounds read or kernel
crash?

Checking that hdev->bus equals BUS_USB is not sufficient to guarantee that
the parent device is actually a USB interface. A user with access to
/dev/uhid can inject a virtual HID device with the bus field spoofed to
BUS_USB.

If that happens, the parent device will be a UHID character device, not a
USB interface. Dereferencing intf->cur_altsetting will then access invalid
memory.

Should this code use the hid_is_usb(hdev) helper to safely validate the USB
transport layer before casting the parent device?

> +	return intf->cur_altsetting->desc.bInterfaceNumber ==
> +	       quirks->cfg_interface_num;
> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910032115.28669-1-andrei1998@gmail.com?part=12