[PATCH] HID: huawei/rapoo: reject non-USB transports before to_usb_interface()

[Jiale Yao <yaojiale02@163.com>]

hid-huawei's huawei_report_fixup() unconditionally calls
to_usb_interface(hdev->dev.parent) without first verifying the
device is actually a USB HID device.  When uhid spoofs bus = BUS_USB
with matching VID/PID, hdev->dev.parent points to a uhid_device,
not a usb_interface.  to_usb_interface() returns a garbage pointer,
triggering:

  BUG: KASAN: slab-out-of-bounds in huawei_report_fixup
  Read of size 8 at 1176 bytes beyond an 800-byte kmalloc-1k region
  BUG: KASAN: null-ptr-deref in huawei_report_fixup

  Call Trace:
   huawei_report_fixup
   hid_open_report
   hid_device_probe
   really_probe
   uhid_device_add_worker

hid-rapoo's rapoo_probe() guards the to_usb_interface() call with
hdev->bus == BUS_USB, but uhid can forge hdev->bus, trivially
bypassing this check and causing the same type confusion.

Fix both drivers by adding the proper hid_is_usb() guard -- a helper
that inspects the actual parent device type rather than trusting the
forgeable bus field -- before any to_usb_interface() dereference.

Fixes: e93faaca84b7 ("HID: huawei: fix CD30 keyboard report descriptor issue")
Fixes: b3b1c68fb726 ("HID: rapoo: Add support for side buttons on RAPOO 0x2015 mouse")
Assisted-by: Claude:deepseek-v4-pro
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/hid/hid-huawei.c | 7 ++++++-
 drivers/hid/hid-rapoo.c  | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-huawei.c b/drivers/hid/hid-huawei.c
index 6a616bf21b38..d2f9f15871a2 100644
--- a/drivers/hid/hid-huawei.c
+++ b/drivers/hid/hid-huawei.c
@@ -44,7 +44,12 @@ static const __u8 huawei_cd30_kbd_rdesc_fixed[] = {
 static const __u8 *huawei_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 				  unsigned int *rsize)
 {
-	struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+	struct usb_interface *intf;
+
+	if (!hid_is_usb(hdev))
+		return rdesc;
+
+	intf = to_usb_interface(hdev->dev.parent);
 
 	switch (hdev->product) {
 	case USB_DEVICE_ID_HUAWEI_CD30KBD:
diff --git a/drivers/hid/hid-rapoo.c b/drivers/hid/hid-rapoo.c
index 4c81f3086de4..5c9c396fabf7 100644
--- a/drivers/hid/hid-rapoo.c
+++ b/drivers/hid/hid-rapoo.c
@@ -36,7 +36,7 @@ static int rapoo_probe(struct hid_device *hdev, const struct hid_device_id *id)
 		return ret;
 	}
 
-	if (hdev->bus == BUS_USB) {
+	if (hid_is_usb(hdev)) {
 		struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
 
 		if (intf->cur_altsetting->desc.bInterfaceNumber != 1)
-- 
2.34.1