Re: [PATCH v7 08/12] Input: xbox_gip - Add arcade stick support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Delegating to the base report handler before validating the report length causes unsynchronized partial events to be injected into the input core.
--

commit 40e27212434b70f4e87708396c3c1b8a00c35e55
Author: Vicki Pfau <vi@endrift.com>

Input: xbox_gip - Add arcade stick support

This commit adds support for the arcade stick device type to the Xbox GIP
driver.

> diff --git a/drivers/input/joystick/gip/gip-arcade-stick.c b/drivers/input/joystick/gip/gip-arcade-stick.c
> new file mode 100644
> index 0000000000000..11ededfab8555
> --- /dev/null
> +++ b/drivers/input/joystick/gip/gip-arcade-stick.c
[ ... ]
> +static int gip_handle_arcade_stick_report(struct gip_attachment *attachment,
> +	struct input_dev *input, const uint8_t *bytes, int num_bytes)
> +{
> +	struct gip_arcade_stick_info *info = attachment->driver_data;
> +	int rc;
> +
> +	if (!info)
> +		return -ENODEV;
> +
> +	rc = gip_driver_navigation.handle_input_report(attachment, input, bytes, num_bytes);
> +	if (rc < 0)
> +		return rc;
> +
> +	if (num_bytes < 6) {
> +		gip_dbg(attachment, "Discarding too-short input report\n");
> +		return -EINVAL;
> +	}

[Severity: High]
Can this sequence leave the userspace input state out of sync?

If a device sends a short input report (between 2 and 5 bytes inclusive),
gip_driver_navigation.handle_input_report() will process the events since
it only requires num_bytes >= 2. However, this function then checks for
num_bytes < 6 and returns -EINVAL.

When the caller sees this error, it will return immediately without calling
input_sync(). This allows unsynchronized partial events to be injected into
the input core, which could lead to inconsistent input state in userspace.

Should the num_bytes < 6 check be performed before delegating to the base
report handler?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260912030426.2997003-1-vi@endrift.com?part=8