[PATCH] HID: core: add short report quirk and use it for GPD Win (2f24:0137)

[Zhouwang Huang <honjow311@gmail.com>]

Commit 9e2a17d2e808 ("HID: gpd: fix report descriptor on GPD Win
handheld (2f24:0137)") used report_fixup to shrink Report Count from
63 to 11 so that short reports from firmware <= 1.09 would not be
rejected by hid_report_raw_event().

However, firmware 1.10 fixed the report length and now sends the full
63 bytes.  Because report_fixup already shrank the descriptor,
usbhid allocates a 12-byte URB buffer — far too small for the 64-byte
transfer — causing continuous -EOVERFLOW on every interrupt-in URB.
The HID report descriptor and bcdDevice are identical across firmware
versions, so report_fixup cannot conditionally apply.

Replace the report_fixup driver with a new per-device quirk
HID_QUIRK_ALLOW_SHORT_REPORTS.  When set, hid_report_raw_event()
zero-pads short reports instead of rejecting them — the same behaviour
the core had before commit 0a3fe972a7cb ("HID: core: Mitigate
potential OOB by removing bogus memset()").  The descriptor is left
unmodified so the URB buffer matches the declared report size and works
with any firmware version.

Remove hid-gpd.c, its Kconfig entry and Makefile line; the device is
now handled by hid-generic with the quirk applied from hid-quirks.c.

Fixes: 9e2a17d2e808 ("HID: gpd: fix report descriptor on GPD Win handheld (2f24:0137)")
Signed-off-by: Zhouwang Huang <honjow311@gmail.com>
---
 drivers/hid/Kconfig      | 10 --------
 drivers/hid/Makefile     |  1 -
 drivers/hid/hid-core.c   | 11 +++++----
 drivers/hid/hid-gpd.c    | 52 ----------------------------------------
 drivers/hid/hid-quirks.c |  2 ++
 include/linux/hid.h      |  2 ++
 6 files changed, 11 insertions(+), 67 deletions(-)
 delete mode 100644 drivers/hid/hid-gpd.c

diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 2159d0fb7020..c1d9f7c6a5f2 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -419,16 +419,6 @@ config HID_GLORIOUS
 	  Support for Glorious PC Gaming Race mice such as
 	  the Glorious Model O, O- and D.
 
-config HID_GPD
-	tristate "GPD Win handheld OEM HID support"
-	depends on USB_HID
-	help
-	  Report descriptor fix for the OEM USB HID interface (GameSir
-	  2f24:0137) found on GPD Win handhelds. The firmware declares 63-byte
-	  reports but only sends 11 bytes, which the HID core rejects.
-
-	  Say Y or M here if you use a GPD Win handheld with this interface.
-
 config HID_HOLTEK
 	tristate "Holtek HID devices"
 	depends on USB_HID
diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
index f69cd6015465..e01838239ae6 100644
--- a/drivers/hid/Makefile
+++ b/drivers/hid/Makefile
@@ -53,7 +53,6 @@ obj-$(CONFIG_HID_ELO)		+= hid-elo.o
 obj-$(CONFIG_HID_EVISION)	+= hid-evision.o
 obj-$(CONFIG_HID_EZKEY)		+= hid-ezkey.o
 obj-$(CONFIG_HID_FT260)		+= hid-ft260.o
-obj-$(CONFIG_HID_GPD)		+= hid-gpd.o
 obj-$(CONFIG_HID_GEMBIRD)	+= hid-gembird.o
 obj-$(CONFIG_HID_GFRM)		+= hid-gfrm.o
 obj-$(CONFIG_HID_GLORIOUS)  += hid-glorious.o
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f5587b786f87..52e86f927a38 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2057,10 +2057,13 @@ int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *
 		rsize = max_buffer_size;
 
 	if (csize < rsize) {
-		hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %d)\n",
-				     report->id, rsize, csize);
-		ret = -EINVAL;
-		goto out;
+		if (!(hid->quirks & HID_QUIRK_ALLOW_SHORT_REPORTS)) {
+			hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %d)\n",
+					     report->id, rsize, csize);
+			ret = -EINVAL;
+			goto out;
+		}
+		memset(cdata + csize, 0, rsize - csize);
 	}
 
 	if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)
diff --git a/drivers/hid/hid-gpd.c b/drivers/hid/hid-gpd.c
deleted file mode 100644
index 5b4d203e2499..000000000000
--- a/drivers/hid/hid-gpd.c
+++ /dev/null
@@ -1,52 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-/*
- *  HID report descriptor fixup for GPD Win handhelds.
- *
- *  The OEM HID interface (VID 2f24 / GameSir, PID 0137) declares Report ID 1
- *  with Report Count 63 (8-bit fields) for both Input and Feature, but the
- *  firmware only sends 11 bytes of payload after the report ID.
- */
-
-#include <linux/hid.h>
-#include <linux/module.h>
-
-#include "hid-ids.h"
-
-#define RDESC_LEN		38
-#define RPT_COUNT_INPUT_OFF	21
-#define RPT_COUNT_FEATURE_OFF	34
-
-static const __u8 *gpd_report_fixup(struct hid_device *hdev, __u8 *rdesc,
-				    unsigned int *rsize)
-{
-	if (*rsize != RDESC_LEN)
-		return rdesc;
-
-	if (rdesc[RPT_COUNT_INPUT_OFF - 1] == 0x95 &&
-	    rdesc[RPT_COUNT_INPUT_OFF] == 0x3f &&
-	    rdesc[RPT_COUNT_FEATURE_OFF - 1] == 0x95 &&
-	    rdesc[RPT_COUNT_FEATURE_OFF] == 0x3f) {
-		hid_info(hdev, "fixing report counts (63 -> 11 bytes)\n");
-		rdesc[RPT_COUNT_INPUT_OFF] = 11;
-		rdesc[RPT_COUNT_FEATURE_OFF] = 11;
-	}
-
-	return rdesc;
-}
-
-static const struct hid_device_id gpd_devices[] = {
-	{ HID_USB_DEVICE(USB_VENDOR_ID_GAMESIR, USB_DEVICE_ID_GAMESIR_0137) },
-	{ }
-};
-MODULE_DEVICE_TABLE(hid, gpd_devices);
-
-static struct hid_driver gpd_driver = {
-	.name = "gpd",
-	.id_table = gpd_devices,
-	.report_fixup = gpd_report_fixup,
-};
-
-module_hid_driver(gpd_driver);
-
-MODULE_DESCRIPTION("HID report descriptor fix for GPD Win handheld (GameSir 2f24:0137)");
-MODULE_LICENSE("GPL");
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index f6be3ffee023..b9ae1442eba9 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -97,6 +97,8 @@ static const struct hid_device_id hid_quirks[] = {
 		HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_GAMEVICE, USB_DEVICE_ID_GAMEVICE_KISHI),
 		HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_GAMESIR, USB_DEVICE_ID_GAMESIR_0137),
+		HID_QUIRK_ALLOW_SHORT_REPORTS },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 31324609af4d..212dd13bfcfa 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -381,6 +381,7 @@ struct hid_item {
  * | @HID_QUIRK_X_INVERT:
  * | @HID_QUIRK_Y_INVERT:
  * | @HID_QUIRK_IGNORE_MOUSE:
+ * | @HID_QUIRK_ALLOW_SHORT_REPORTS: accept shorter-than-expected reports, zero-pad
  * | @HID_QUIRK_SKIP_OUTPUT_REPORTS:
  * | @HID_QUIRK_SKIP_OUTPUT_REPORT_ID:
  * | @HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP:
@@ -408,6 +409,7 @@ struct hid_item {
 #define HID_QUIRK_X_INVERT			BIT(12)
 #define HID_QUIRK_Y_INVERT			BIT(13)
 #define HID_QUIRK_IGNORE_MOUSE			BIT(14)
+#define HID_QUIRK_ALLOW_SHORT_REPORTS		BIT(15)
 #define HID_QUIRK_SKIP_OUTPUT_REPORTS		BIT(16)
 #define HID_QUIRK_SKIP_OUTPUT_REPORT_ID		BIT(17)
 #define HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP	BIT(18)
-- 
2.53.0