Re: [PATCH 6/6] HID: roccat-ryos: reject short special reports

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The `roccat_report_event()` function acquires sleepable mutexes while running in an atomic context (USB URB completion handler), which leads to a "scheduling while atomic" BUG.
--

commit de88f5cf3ef84f642bf5e1815c5ed0d7ee05a061
Author: Yousef Alhouseen <alhouseenyousef@gmail.com>

HID: roccat-ryos: reject short special reports

This commit fixes an out-of-bounds read in ryos_raw_event() by ensuring
that only complete special reports are forwarded to the character-device
layer. It drops reports that are shorter than the expected report size.

> diff --git a/drivers/hid/hid-roccat-ryos.c b/drivers/hid/hid-roccat-ryos.c
> index db83f42457da5..5087defc7c373 100644
> --- a/drivers/hid/hid-roccat-ryos.c
> +++ b/drivers/hid/hid-roccat-ryos.c
> @@ -189,7 +189,8 @@ static int ryos_raw_event(struct hid_device *hdev,
>  			!= RYOS_USB_INTERFACE_PROTOCOL)
>  		return 0;
>  
> -	if (data[0] != RYOS_REPORT_NUMBER_SPECIAL)
> +	if (data[0] != RYOS_REPORT_NUMBER_SPECIAL ||
> +	    size < sizeof(struct ryos_report_special))
>  		return 0;
>  
>  	if (ryos != NULL && ryos->roccat_claimed)
>  		roccat_report_event(ryos->chrdev_minor, data);

[Severity: High]
This is a pre-existing issue, but is it safe to call roccat_report_event()
from this context?

The ryos_raw_event() callback executes in an atomic context (softirq)
during the USB URB completion handler:

hid_irq_in()
  hid_safe_input_report()
    __hid_input_report()
      hdrv->raw_event() -> ryos_raw_event()

However, looking at drivers/hid/hid-roccat.c, roccat_report_event() acquires
sleepable mutexes:

roccat_report_event()
{
        ...
        mutex_lock(&device->readers_lock);
        mutex_lock(&device->cbuf_lock);
        ...
}

Will this sequence trigger a scheduling while atomic bug when a valid
special report is received and forwarded?

>  
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260628164611.17467-1-alhouseenyousef@gmail.com?part=6