* [PATCH] HID: core: do not allow parsing 0-sized reports
@ 2026-04-01 6:04 Dmitry Torokhov
2026-04-09 16:00 ` Jiri Kosina
0 siblings, 1 reply; 2+ messages in thread
From: Dmitry Torokhov @ 2026-04-01 6:04 UTC (permalink / raw)
To: Jiri Kosina
Cc: Benjamin Tissoires, Peter Hutterer, Kees Cook, Alan Stern,
Charles Keepax, linux-input, linux-kernel
Commit d7db259bd6df ("HID: core: factor out hid_parse_collections()")
reworked collection parsing code and inadvertently allowed returning
"success" when parsing 0-sized reports where old code returned -EINVAL.
Restore the original behavior by doing an explicit check.
Note that the error message now differs from the generic "item fetching
failed at offset %u/%u" that is now used only for non-empty descriptors.
Fixes: d7db259bd6df ("HID: core: factor out hid_parse_collections()")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/hid/hid-core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index b40953e0f52e..be9d2b3356c3 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1272,6 +1272,11 @@ static int hid_parse_collections(struct hid_device *device)
device->collection[i].parent_idx = -1;
ret = -EINVAL;
+ if (start == end) {
+ hid_err(device, "rejecting 0-sized report descriptor\n");
+ goto out;
+ }
+
while ((next = fetch_item(start, end, &item)) != NULL) {
start = next;
--
2.53.0.1185.g05d4b7b318-goog
--
Dmitry
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] HID: core: do not allow parsing 0-sized reports
2026-04-01 6:04 [PATCH] HID: core: do not allow parsing 0-sized reports Dmitry Torokhov
@ 2026-04-09 16:00 ` Jiri Kosina
0 siblings, 0 replies; 2+ messages in thread
From: Jiri Kosina @ 2026-04-09 16:00 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Benjamin Tissoires, Peter Hutterer, Kees Cook, Alan Stern,
Charles Keepax, linux-input, linux-kernel
On Tue, 31 Mar 2026, Dmitry Torokhov wrote:
> Commit d7db259bd6df ("HID: core: factor out hid_parse_collections()")
> reworked collection parsing code and inadvertently allowed returning
> "success" when parsing 0-sized reports where old code returned -EINVAL.
Ah, good catch, I've missed that.
Applied on top, thanks.
--
Jiri Kosina
SUSE Labs
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-04-09 16:00 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-01 6:04 [PATCH] HID: core: do not allow parsing 0-sized reports Dmitry Torokhov
2026-04-09 16:00 ` Jiri Kosina
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.