Linux bluetooth development
 help / color / mirror / Atom feed
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
To: Marcel Holtmann <marcel@holtmann.org>,
	 Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
	 David Rheinsberg <david@readahead.eu>,
	 Frank Praznik <frank.praznik@oh.rr.com>,
	Jiri Kosina <jikos@kernel.org>,
	 Benjamin Tissoires <bentiss@kernel.org>,
	Even Xu <even.xu@intel.com>,  Xinpeng Sun <xinpeng.sun@intel.com>,
	 Roderick Colenbrander <roderick.colenbrander@sony.com>
Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org,
	 linux-input@vger.kernel.org,
	Shashikirana H K <shashikiranah@chromium.org>
Subject: [PATCH 3/9] HID: core: Reject mixing numbered and unnumbered reports
Date: Mon, 12 Oct 2026 20:42:19 -0700	[thread overview]
Message-ID: <20261012-hid-core-report-validation-v1-3-e0dd5cb60b2e@gmail.com> (raw)
In-Reply-To: <20261012-hid-core-report-validation-v1-0-e0dd5cb60b2e@gmail.com>

According to the Device Class Definition for HID, if any report of a
given type includes a Report ID tag, all reports of that type must
include a Report ID tag. Mixing numbered and unnumbered reports within
the same report enumeration is invalid and causes confusion when sizing
and parsing incoming and outgoing transfers.

Reject descriptors that attempt to mix numbered and unnumbered reports
within the same report enumeration by warning and aborting report
registration.

Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hid/hid-core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index a33e864a25f9..3a9bd56dbf85 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -96,6 +96,12 @@ struct hid_report *hid_register_report(struct hid_device *device,
 	if (report_enum->report_id_hash[id])
 		return report_enum->report_id_hash[id];
 
+	if ((id == 0 && report_enum->numbered) ||
+	    (id != 0 && report_enum->report_id_hash[0])) {
+		hid_warn(device, "not allowed to mix numbered and unnumbered reports\n");
+		return NULL;
+	}
+
 	report = kzalloc_obj(struct hid_report);
 	if (!report)
 		return NULL;

-- 
2.56.0.385.gd3acb90ef8-goog


  parent reply	other threads:[~2026-10-13  3:42 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-13  3:42 [PATCH 0/9] HID: Hardening report validation and unnumbered report handling Dmitry Torokhov
2026-10-13  3:42 ` [PATCH 1/9] Bluetooth: HIDP: Fix GET_REPORT and SET_REPORT for unnumbered reports Dmitry Torokhov
2026-10-13  3:56   ` HID: Hardening report validation and unnumbered report handling bluez.test.bot
2026-10-13  3:42 ` [PATCH 2/9] HID: core: Fix GET_REPORT input processing for unnumbered reports Dmitry Torokhov
2026-10-13  3:42 ` Dmitry Torokhov [this message]
2026-10-13  3:42 ` [PATCH 4/9] HID: core: Validate GET_REPORT report ID centrally Dmitry Torokhov
2026-10-13  3:42 ` [PATCH 5/9] HID: i2c-hid: Drop redundant report ID validation Dmitry Torokhov
2026-10-13  3:42 ` [PATCH 6/9] HID: goodix-spi: " Dmitry Torokhov
2026-10-13  3:42 ` [PATCH 7/9] HID: intel-thc-hid: Drop redundant report ID validation in quicki2c Dmitry Torokhov
2026-10-13  3:42 ` [PATCH 8/9] HID: multitouch: Drop redundant report ID validation in mt_get_feature Dmitry Torokhov
2026-10-13  3:42 ` [PATCH 9/9] HID: playstation: Drop redundant report ID validation in ps_get_report Dmitry Torokhov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261012-hid-core-report-validation-v1-3-e0dd5cb60b2e@gmail.com \
    --to=dmitry.torokhov@gmail.com \
    --cc=bentiss@kernel.org \
    --cc=david@readahead.eu \
    --cc=even.xu@intel.com \
    --cc=frank.praznik@oh.rr.com \
    --cc=jikos@kernel.org \
    --cc=linux-bluetooth@vger.kernel.org \
    --cc=linux-input@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luiz.dentz@gmail.com \
    --cc=marcel@holtmann.org \
    --cc=roderick.colenbrander@sony.com \
    --cc=shashikiranah@chromium.org \
    --cc=xinpeng.sun@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox