Re: [PATCH 6.12.y] HID: uhid: convert to hid_safe_input_report()

[Carlos Llamas <cmllamas@google.com>]

On Fri, Aug 28, 2026 at 11:34:35PM -0400, Sasha Levin wrote:
> > Convert uhid to use hid_safe_input_report() and pass UHID_DATA_MAX as
> > the buffer size. This prevents the reported regressions [1], allowing
> > hid core to zero-pad the shorter reports safely as expected.
> 
> Queued for 6.12, thanks.
> 
> Could one of you send adapted backports of the pair for 6.6, 6.1, 5.15 and
> 5.10?  I would rather have them from people who know the HID core than
> do it myself.
> 
> -- 
> Thanks,
> Sasha

Lucky for us Lee has already backported all the bufsize plumbing into
older stable branches. The only missing piece to backport the remaining
fixes would be adding the __hid_input_report() bits. We could extract
the following sections from mainline making these backports trivial.

Benjamin, Lee, wdyt?

---
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index b924980b5783..154f0ff8021f 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2072,24 +2072,13 @@ int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *
 }
 EXPORT_SYMBOL_GPL(hid_report_raw_event);
 
-/**
- * hid_input_report - report data from lower layer (usb, bt...)
- *
- * @hid: hid device
- * @type: HID report type (HID_*_REPORT)
- * @data: report contents
- * @size: size of data parameter
- * @interrupt: distinguish between interrupt and control transfers
- *
- * This is data entry for lower layers.
- */
-int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data,
-		     u32 size, int interrupt)
+
+static int __hid_input_report(struct hid_device *hid, enum hid_report_type type,
+			      u8 *data, size_t bufsize, u32 size, int interrupt)
 {
 	struct hid_report_enum *report_enum;
 	struct hid_driver *hdrv;
 	struct hid_report *report;
-	size_t bufsize = size;
 	int ret = 0;
 
 	if (!hid)
@@ -2140,6 +2129,23 @@ int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data
 	up(&hid->driver_input_lock);
 	return ret;
 }
+
+/**
+ * hid_input_report - report data from lower layer (usb, bt...)
+ *
+ * @hid: hid device
+ * @type: HID report type (HID_*_REPORT)
+ * @data: report contents
+ * @size: size of data parameter
+ * @interrupt: distinguish between interrupt and control transfers
+ *
+ * This is data entry for lower layers.
+ */
+int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
+		     int interrupt)
+{
+	return __hid_input_report(hid, type, data, size, size, interrupt);
+}
 EXPORT_SYMBOL_GPL(hid_input_report);
 
 bool hid_match_one_id(const struct hid_device *hdev,
--