Re: [PATCH 1/1] HID: core: Fix OOB read in hid_get_report for numbered reports

[Lee Jones <lee@kernel.org>]

On Tue, 16 Jun 2026, Greg Kroah-Hartman wrote:

> On Tue, Jun 16, 2026 at 11:26:56AM +0000, Lee Jones wrote:
> > When a caller passes a size of 0 to hid_report_raw_event() for a
> > numbered report, the function originally called hid_get_report() before
> > performing any size validation.
> > 
> > Inside hid_get_report(), if the report is numbered (report_enum->numbered
> > is true), it unconditionally dereferences data[0] to extract the report ID.
> > With a size of 0, this results in an out-of-bounds read or kernel panic.
> > 
> > Fix this by moving the numbered report size validation check before the
> > call to hid_get_report(), ensuring that size is at least 1 before
> > dereferencing the data pointer.
> > 
> > Fixes: 2c85c61d1332 ("HID: pass the buffer size to hid_report_raw_event")
> > Signed-off-by: Lee Jones <lee@kernel.org>
> > ---
> >  drivers/hid/hid-core.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> 
> Hi,
> 
> This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
> a patch that has triggered this response.  He used to manually respond
> to these common problems, but in order to save his sanity (he kept
> writing the same thing over and over, yet to different people), I was
> created.  Hopefully you will not take offence and will fix the problem
> in your patch and resubmit it so that it can be accepted into the Linux
> kernel tree.
> 
> You are receiving this message because of the following common error(s)
> as indicated below:
> 
> - You have marked a patch with a "Fixes:" tag for a commit that is in an
>   older released kernel, yet you do not have a cc: stable line in the
>   signed-off-by area at all, which means that the patch will not be
>   applied to any older kernel releases.  To properly fix this, please
>   follow the documented rules in the
>   Documentation/process/stable-kernel-rules.rst file for how to resolve
>   this.
> 
> If you wish to discuss this problem further, or you have questions about
> how to resolve this issue, please feel free to respond to this email and
> Greg will reply once he has dug out from the pending patches received
> from other developers.

Sure, why not! :)

Cc: stable@vger.kernel.org

-- 
Lee Jones