[PATCH 0/2] HID: Intel-thc-hid: Fix potential buffer overflow

[PATCH 0/2] HID: Intel-thc-hid: Fix potential buffer overflow

[Even Xu]

This patch set allocate enough space for both the payload and the
packet header for quicki2c and quickspi input and output buffers to 
prevent a buffer overflow when the payload reaches its maximum size,
as their sizes are currently calculated from the payload length only.

Even Xu (2):
  HID: Intel-thc-hid: Intel-quicki2c: Fix buffer overflow
  HID: Intel-thc-hid: Intel-quickspi: Fix buffer overflow

 drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 6 ++++--
 drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 3 ++-
 2 files changed, 6 insertions(+), 3 deletions(-)

-- 
2.43.0

[PATCH 1/2] HID: Intel-thc-hid: Intel-quicki2c: Fix buffer overflow

[Even Xu]

The input and output buffers are used to store complete HID-over-I2C
packets, including their protocol headers. However, their sizes are
currently calculated from the payload length only.

Allocate enough space for both the payload and the packet header to
prevent a buffer overflow when the payload reaches its maximum size.

Signed-off-by: Even Xu <even.xu@intel.com>
---
 drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
index 0d2ad7bc3648..2537288b5026 100644
--- a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
+++ b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
@@ -606,7 +606,8 @@ static int quicki2c_alloc_report_buf(struct quicki2c_device *qcdev)
 	 */
 	max_report_len = max(le16_to_cpu(qcdev->dev_desc.max_input_len), SZ_4K);
 
-	qcdev->input_buf = devm_kzalloc(qcdev->dev, max_report_len, GFP_KERNEL);
+	qcdev->input_buf = devm_kzalloc(qcdev->dev,
+					HIDI2C_PACKET_LEN(max_report_len), GFP_KERNEL);
 	if (!qcdev->input_buf)
 		return -ENOMEM;
 
@@ -616,7 +617,8 @@ static int quicki2c_alloc_report_buf(struct quicki2c_device *qcdev)
 	max_report_len = max(le16_to_cpu(qcdev->dev_desc.max_output_len),
 			     max_report_len);
 
-	qcdev->report_buf = devm_kzalloc(qcdev->dev, max_report_len, GFP_KERNEL);
+	qcdev->report_buf = devm_kzalloc(qcdev->dev,
+					 HIDI2C_PACKET_LEN(max_report_len), GFP_KERNEL);
 	if (!qcdev->report_buf)
 		return -ENOMEM;
 
-- 
2.43.0

Re: [PATCH 1/2] HID: Intel-thc-hid: Intel-quicki2c: Fix buffer overflow

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] hid: intel-quicki2c: incomplete buffer fix and stale report_len causes -EINVAL for large payloads
--

commit 3ae5fe57bf2559497c69a1a1f4feb9ea45f51690
Author: Even Xu <even.xu@intel.com>

HID: Intel-thc-hid: Intel-quicki2c: Fix buffer overflow

The patch modifies buffer allocations in the intel-quicki2c driver to
account for packet headers in addition to the payload length. This is
intended to prevent buffer overflows when the payload reaches its maximum
size.

> diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
> index 0d2ad7bc3648a..2537288b50261 100644
> --- a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
> +++ b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
> @@ -606,7 +606,8 @@ static int quicki2c_alloc_report_buf(struct quicki2c_device *qcdev)
>  	 */
>  	max_report_len = max(le16_to_cpu(qcdev->dev_desc.max_input_len), SZ_4K);
>  
> -	qcdev->input_buf = devm_kzalloc(qcdev->dev, max_report_len, GFP_KERNEL);
> +	qcdev->input_buf = devm_kzalloc(qcdev->dev,
> +					HIDI2C_PACKET_LEN(max_report_len), GFP_KERNEL);
>  	if (!qcdev->input_buf)
>  		return -ENOMEM;
>  
> @@ -616,7 +617,8 @@ static int quicki2c_alloc_report_buf(struct quicki2c_device *qcdev)
>  	max_report_len = max(le16_to_cpu(qcdev->dev_desc.max_output_len),
>  			     max_report_len);
>  
> -	qcdev->report_buf = devm_kzalloc(qcdev->dev, max_report_len, GFP_KERNEL);
> +	qcdev->report_buf = devm_kzalloc(qcdev->dev,
> +					 HIDI2C_PACKET_LEN(max_report_len), GFP_KERNEL);

[Severity: Medium]
Does HIDI2C_PACKET_LEN() add enough space for the headers? It appears to only
add 2 bytes, but output operations and SET_REPORT might require up to 9 bytes
of command headers (e.g., cmd_reg, cmd, data_reg, length).

Also, qcdev->report_len is not updated to match the new size, remaining as
max_report_len just below this allocation.

Will this cause maximum-sized payloads to be incorrectly rejected with -EINVAL?
In quicki2c_init_write_buf(), there is a bounds check:

    if (buf_len > write_buf_len)
        return -EINVAL;

This evaluates the total packet length (including headers) against the
unadjusted report_len (passed as write_buf_len), causing valid maximum-sized
payloads to be rejected.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922024638.932865-1-even.xu@intel.com?part=1

[PATCH 2/2] HID: Intel-thc-hid: Intel-quickspi: Fix buffer overflow

[Even Xu]

The input buffers are used to store complete HID-over-SPI packets,
including their protocol headers. However, their sizes are
currently calculated from the payload length only.

Allocate enough space for both the payload and the packet header to
prevent a buffer overflow when the payload reaches its maximum size.

Signed-off-by: Even Xu <even.xu@intel.com>
---
 drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
index 89226f5ce45e..ad676fde211b 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
@@ -552,7 +552,8 @@ static int quickspi_alloc_report_buf(struct quickspi_device *qsdev)
 	max_input_len = max(le16_to_cpu(qsdev->dev_desc.rep_desc_len),
 			    le16_to_cpu(qsdev->dev_desc.max_input_len));
 
-	qsdev->input_buf = devm_kzalloc(qsdev->dev, max_input_len, GFP_KERNEL);
+	qsdev->input_buf = devm_kzalloc(qsdev->dev,
+					HIDSPI_INPUT_BODY_SIZE(max_input_len), GFP_KERNEL);
 	if (!qsdev->input_buf)
 		return -ENOMEM;
 
-- 
2.43.0

Re: [PATCH 0/2] HID: Intel-thc-hid: Fix potential buffer overflow

[Jiri Kosina]

On Tue, 22 Sep 2026, Even Xu wrote:

> This patch set allocate enough space for both the payload and the
> packet header for quicki2c and quickspi input and output buffers to 
> prevent a buffer overflow when the payload reaches its maximum size,
> as their sizes are currently calculated from the payload length only.
> 
> Even Xu (2):
>   HID: Intel-thc-hid: Intel-quicki2c: Fix buffer overflow
>   HID: Intel-thc-hid: Intel-quickspi: Fix buffer overflow

Applied to hid.git#for-7.3/upstream-fixes, thanks.

-- 
Jiri Kosina
SUSE Labs