[PATCH] HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report

[PATCH] HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report

[Benjamin Tissoires]

commit b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT
related user initiated OOB write") assumed that all HID devices attached
to the logitech-dj driver was having an output report of DJ_SHORT.

However, on the receiver itself, we have 2 other HID device we attach
here: the mouse emulation and the keyboard emulation. For those devices
the value of rep is NULL and we are triggered a segfault here.

This is doubly required because logitech-dj also handles non DJ devices
that might not have the DJ collection.

Fixes: b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write")
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
 drivers/hid/hid-logitech-dj.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 838c6de9a921..695d3031009e 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -1907,7 +1907,8 @@ static int logi_dj_probe(struct hid_device *hdev,
 	output_report_enum = &hdev->report_enum[HID_OUTPUT_REPORT];
 	rep = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT];
 
-	if (rep->maxfield < 1 || rep->field[0]->report_count != DJREPORT_SHORT_LENGTH - 1) {
+	if (rep && (rep->maxfield < 1 ||
+		    rep->field[0]->report_count != DJREPORT_SHORT_LENGTH - 1)) {
 		hid_err(hdev, "Expected size of DJ short report is %d, but got %d",
 			DJREPORT_SHORT_LENGTH - 1, rep->field[0]->report_count);
 		return -EINVAL;

---
base-commit: e2aaf2d3ad92ac4a8afa6b69ad4c38e7747d3d6e
change-id: 20260410-fix-logitech-dj-e9060b0b48bd

Best regards,
-- 
Benjamin Tissoires <bentiss@kernel.org>

Re: [PATCH] HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report

[Jiri Kosina]

On Fri, 10 Apr 2026, Benjamin Tissoires wrote:

> commit b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT
> related user initiated OOB write") assumed that all HID devices attached
> to the logitech-dj driver was having an output report of DJ_SHORT.
> 
> However, on the receiver itself, we have 2 other HID device we attach
> here: the mouse emulation and the keyboard emulation. For those devices
> the value of rep is NULL and we are triggered a segfault here.
> 
> This is doubly required because logitech-dj also handles non DJ devices
> that might not have the DJ collection.
> 
> Fixes: b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write")
> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

Thanks a lot Benjamin, your CI be praised!

Applied.

-- 
Jiri Kosina
SUSE Labs