From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793824131; b=3ZGLZV09i8KHDqJGqCgMPnVC2T4YG8WjFKg3o0q8/C+7aUPdxL5GMilyiUwwS77rSe0c ICYfSmy7/2Q/1fm0qA8xdw/o0bXWcSiDB9Mk6VCH/G06sY54Js5pFpcJrBovfXhWtgQzC 0Ll9waal2w0L228jKzYbC0WEDMKpLukkE0q0RfrZC7wwIHkx1j8TXds8YT4r3LUgkYCMK ubL1z57m7ohyvlkkWJlQxmEPbi/05RBz+7bOo9SVNVWiSTLp2FlXkub+f+lGVFd20bQ0e N8zJs2OtQTB1EvXMHi+Kb6IdkwjrBGS3ZnJBZKxpohhBLVsmoH9d1kRGi4uqcCKFFiw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793824131; h=Received:DKIM-Signature:Subject:To:Cc:From:Date:Message-ID: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=AFveXvHpg9Bf/XlxlS+5wxEBbDCG3hyN0lX0L8ZDDAo=; b=cMedLJCsDCwpjhLtnsvwOu5F5sez8qqGLEH8Hy0NLqpA+3gEhaBZw94rgTMH5qTVU9YP 1Yin2U9fYrXyaM0tjFasKOw+wcjrhJRJzfGrcepBfMmIneIJkbe0xVm5CVeYcpzxDDG+v 3xA0jxv+P1UUCkA1u/+Uv0QO0bi3DPPqnEFLSoCfjMcwKpnKTdJxIxMcvd7zi5up4LAk7 4GE4FMmNaD8ipij5keJq6kev8lT/ODPYg9KVxBLTTaS3ExRBQQHvR2Z8bZtW+bzM5a8lG VkuPrQP7z5qTBYyjX9LAp3uK3WcV16Q2JaH6LAIfSby7aiAZTjC04Mbk0LubUn0BBYw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=n1Wpnufe; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F19796070AAA for ; Wed, 4 Nov 2026 20:28:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=n1Wpnufe Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3FB291F000C1; Wed, 4 Nov 2026 20:28:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793824130; bh=AFveXvHpg9Bf/XlxlS+5wxEBbDCG3hyN0lX0L8ZDDAo=; h=Subject:To:Cc:From:Date; b=n1Wpnufe8+3YE0tXhTEk3+QuluKAt/4VGZduLbojT+XHDeM+d1aXXU4vY3ERaBJPL 3teX0pPTLt+9o2ouWnCYCsSaZ09G9n31V2DkjLkbxN4NG52bvnO0mug/h8Ley13Sh9 Wji2MbAW3I9obFzxvF0mkzSlrNdR7FDF4NR1I7js= Subject: FAILED: patch "[PATCH] HID: prodikeys: validate fixed-format MIDI reports" failed to apply to 5.15-stable tree To: yaojiale02@163.com,jkosina@suse.com Cc: From: Date: Wed, 04 Nov 2026 15:28:48 -0500 Message-ID: <2026110448-anime-deduct-1f8b@gregkh> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 0ff37294c41bd925258893310398bc2b45fcd4a7 # git commit -s git send-email --to '' --in-reply-to '2026110448-anime-deduct-1f8b@gregkh' --subject-prefix 'PATCH 5.15.y' 'HEAD^..' Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 0ff37294c41bd925258893310398bc2b45fcd4a7 Mon Sep 17 00:00:00 2001 From: Jiale Yao Date: Thu, 24 Sep 2026 22:44:11 +0800 Subject: [PATCH] HID: prodikeys: validate fixed-format MIDI reports The HID core invokes raw_event callbacks before validating the report length. Prodikeys reports 0x01 and 0x04 are passed to handlers that always read bytes one through three, regardless of the supplied size. A truncated report can therefore cause an out-of-bounds read. Require four bytes for the two fixed-format reports. Keep report 0x03 on its existing variable-length path, which derives the number of note pairs from size and only accesses complete pairs. Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") added the same kind of raw_event length validation to hid-asus. Fixes: 3a370ca1dcf8 ("HID: Prodikeys PC-MIDI HID Driver") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao Signed-off-by: Jiri Kosina diff --git a/drivers/hid/hid-prodikeys.c b/drivers/hid/hid-prodikeys.c index fba01e4fcab1..bf5add40d3e1 100644 --- a/drivers/hid/hid-prodikeys.c +++ b/drivers/hid/hid-prodikeys.c @@ -772,8 +772,13 @@ static int pk_raw_event(struct hid_device *hdev, struct hid_report *report, if (report->id == data[0]) switch (report->id) { case 0x01: /* midi keys (qwerty)*/ - case 0x03: /* midi keyboard (musical)*/ case 0x04: /* extra/midi keys (qwerty)*/ + if (size < 4) + break; + ret = pcmidi_handle_report(pm, report->id, + data, size); + break; + case 0x03: /* midi keyboard (musical)*/ ret = pcmidi_handle_report(pm, report->id, data, size); break;