[PATCH 0/2] HID: Intel-thc-hid: Use hid_safe_input_report()

[PATCH 0/2] HID: Intel-thc-hid: Use hid_safe_input_report()

[Even Xu]

This patch set replace the legacy hid_input_report() with new
hid_safe_input_report() in quicki2c and quickspi drivers.

Even Xu (2):
  HID: Intel-thc-hid: Intel-quicki2c: Use hid_safe_input_report()
  HID: Intel-thc-hid: Intel-quickspi: Use hid_safe_input_report()

 drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c     | 4 +++-
 drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h     | 2 ++
 drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c     | 6 ++++--
 drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h     | 2 +-
 drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c     | 2 ++
 drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h     | 2 ++
 drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c     | 6 ++++--
 drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h     | 2 +-
 .../hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c    | 2 +-
 9 files changed, 20 insertions(+), 8 deletions(-)

-- 
2.43.0

[PATCH 1/2] HID: Intel-thc-hid: Intel-quicki2c: Use hid_safe_input_report()

[Even Xu]

Replace the deprecated hid_input_report() with
hid_safe_input_report(), which takes the allocated size of the input
report buffer and allows hid-core to validate the reported data length
against the actual buffer size.

Track the allocated size of qcdev->input_buf in the new input_len
field and pass it through quicki2c_hid_send_report() to
hid_safe_input_report() to prevent potential out-of-bounds reads.

Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")

Signed-off-by: Even Xu <even.xu@intel.com>
---
 drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 4 +++-
 drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h | 2 ++
 drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c | 6 ++++--
 drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h | 2 +-
 4 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
index 2537288b5026..7a913f717efa 100644
--- a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
+++ b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
@@ -315,7 +315,7 @@ static int handle_input_report(struct quicki2c_device *qcdev)
 		if (qcdev->state != QUICKI2C_ENABLED)
 			continue;
 
-		quicki2c_hid_send_report(qcdev, pkt->data,
+		quicki2c_hid_send_report(qcdev, pkt->data, qcdev->input_len,
 					 HIDI2C_DATA_LEN(le16_to_cpu(pkt->len)));
 	}
 
@@ -611,6 +611,8 @@ static int quicki2c_alloc_report_buf(struct quicki2c_device *qcdev)
 	if (!qcdev->input_buf)
 		return -ENOMEM;
 
+	qcdev->input_len = max_report_len;
+
 	if (!le16_to_cpu(qcdev->dev_desc.max_output_len))
 		qcdev->dev_desc.max_output_len = cpu_to_le16(SZ_4K);
 
diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h
index 6d25a846153e..e9ff0440fb54 100644
--- a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h
+++ b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h
@@ -181,6 +181,7 @@ struct acpi_device;
  * @low_power_ltr_val: THC low power LTR value
  * @report_descriptor: Store a copy of device report descriptor
  * @input_buf: Store a copy of latest input report data
+ * @input_len: The data size of the input report buffer
  * @report_buf: Store a copy of latest input/output report packet from set/get feature
  * @report_len: The length of input/output report packet
  * @reset_ack_wq: Workqueue for waiting reset response from device
@@ -212,6 +213,7 @@ struct quicki2c_device {
 
 	u8 *report_descriptor;
 	u8 *input_buf;
+	size_t input_len;
 	u8 *report_buf;
 	size_t report_len;
 
diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c
index 8075992e8732..1a220a50d934 100644
--- a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c
+++ b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c
@@ -157,16 +157,18 @@ void quicki2c_hid_remove(struct quicki2c_device *qcdev)
  *
  * @qcdev: point to quicki2c device
  * @data: point to input report data buffer
+ * @buf_size: the allocated size of the input report data buffer
  * @data_len: the length of input report data
  *
  * Return: 0 on success, non zero on error.
  */
 int quicki2c_hid_send_report(struct quicki2c_device *qcdev,
-			     void *data, size_t data_len)
+			     void *data, size_t buf_size, size_t data_len)
 {
 	int ret;
 
-	ret = hid_input_report(qcdev->hid_dev, HID_INPUT_REPORT, data, data_len, 1);
+	ret = hid_safe_input_report(qcdev->hid_dev, HID_INPUT_REPORT, data,
+				    buf_size, data_len, 1);
 	if (ret)
 		dev_err(qcdev->dev, "Failed to send HID input report, ret = %d.\n", ret);
 
diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h
index e80df5f339fe..4c6757eca18e 100644
--- a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h
+++ b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.h
@@ -7,7 +7,7 @@
 struct quicki2c_device;
 
 int quicki2c_hid_send_report(struct quicki2c_device *qcdev,
-			     void *data, size_t data_size);
+			     void *data, size_t buf_size, size_t data_size);
 int quicki2c_hid_probe(struct quicki2c_device *qcdev);
 void quicki2c_hid_remove(struct quicki2c_device *qcdev);
 
-- 
2.43.0

[PATCH 2/2] HID: Intel-thc-hid: Intel-quickspi: Use hid_safe_input_report()

[Even Xu]

Replace the deprecated hid_input_report() with
hid_safe_input_report(), which takes the allocated size of the input
report buffer and allows hid-core to validate the reported data length
against the actual buffer size.

Track the allocated size of qsdev->input_buf in the new input_len
field and pass it through quickspi_hid_send_report() to
hid_safe_input_report() to prevent potential out-of-bounds reads.

Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")

Signed-off-by: Even Xu <even.xu@intel.com>
---
 drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c     | 2 ++
 drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h     | 2 ++
 drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c     | 6 ++++--
 drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h     | 2 +-
 .../hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c    | 2 +-
 5 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
index ad676fde211b..53023e30cf8d 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
@@ -557,6 +557,8 @@ static int quickspi_alloc_report_buf(struct quickspi_device *qsdev)
 	if (!qsdev->input_buf)
 		return -ENOMEM;
 
+	qsdev->input_len = max_input_len;
+
 	max_report_len = max(le16_to_cpu(qsdev->dev_desc.max_output_len),
 			     le16_to_cpu(qsdev->dev_desc.max_input_len));
 
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h
index dc67a39ad546..fe51ff51d8c0 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h
@@ -113,6 +113,7 @@ struct acpi_device;
  * @low_power_ltr_val: THC low power LTR value
  * @report_descriptor: store a copy of device report descriptor
  * @input_buf: store a copy of latest input report data
+ * @input_len: the data size of the input report buffer
  * @report_buf: store a copy of latest input/output report packet from set/get feature
  * @report_len: the length of input/output report packet
  * @reset_ack_wq: workqueue for waiting reset response from device
@@ -159,6 +160,7 @@ struct quickspi_device {
 
 	u8 *report_descriptor;
 	u8 *input_buf;
+	u32 input_len;
 	u8 *report_buf;
 	u32 report_buf_size;
 	u32 report_len;
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
index a60a0a7f16aa..ed1c40b8c4fa 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
@@ -148,16 +148,18 @@ void quickspi_hid_remove(struct quickspi_device *qsdev)
  *
  * @qsdev: point to quickspi device
  * @data: point to input report data buffer
+ * @buf_size: the allocated size of the input report data buffer
  * @data_len: the length of input report data
  *
  * Return: 0 on success, non zero on error.
  */
 int quickspi_hid_send_report(struct quickspi_device *qsdev,
-			     void *data, size_t data_len)
+			     void *data, size_t buf_size, size_t data_len)
 {
 	int ret;
 
-	ret = hid_input_report(qsdev->hid_dev, HID_INPUT_REPORT, data, data_len, 1);
+	ret = hid_safe_input_report(qsdev->hid_dev, HID_INPUT_REPORT, data,
+				    buf_size, data_len, 1);
 	if (ret)
 		dev_err(qsdev->dev, "Failed to send HID input report, ret = %d.\n", ret);
 
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h
index f640fa876a40..61b7c6be6c51 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.h
@@ -7,7 +7,7 @@
 struct quickspi_device;
 
 int quickspi_hid_send_report(struct quickspi_device *qsdev,
-			     void *data, size_t data_size);
+			     void *data, size_t buf_size, size_t data_size);
 int quickspi_hid_probe(struct quickspi_device *qsdev);
 void quickspi_hid_remove(struct quickspi_device *qsdev);
 
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
index 847c5ec55569..0df33c44fbff 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
@@ -240,7 +240,7 @@ void quickspi_handle_input_data(struct quickspi_device *qsdev, u32 buf_len)
 		input_len = sizeof(body_hdr->content_id) + input_len;
 		input_report = input_body->content - sizeof(body_hdr->content_id);
 
-		ret = quickspi_hid_send_report(qsdev, input_report, input_len);
+		ret = quickspi_hid_send_report(qsdev, input_report, qsdev->input_len, input_len);
 		if (ret)
 			dev_err_once(qsdev->dev, "Failed to send HID input report: %d\n", ret);
 
-- 
2.43.0

Re: [PATCH 1/2] HID: Intel-thc-hid: Intel-quicki2c: Use hid_safe_input_report()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] hid: intel-quicki2c: OOB memory access due to unadjusted buffer size in hid_safe_input_report()
--

commit fd2fb2220e67b32415f7045570713d7e64755020
Author: Even Xu <even.xu@intel.com>

HID: Intel-thc-hid: Intel-quicki2c: Use hid_safe_input_report()

This commit replaces the deprecated hid_input_report() with
hid_safe_input_report(). It tracks the allocated size of the input buffer and
passes it along to allow hid-core to validate the reported data length against
the actual buffer size.

> diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
> index 0d2ad7bc3648a..6cf19dac8e181 100644
> --- a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
> +++ b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
> @@ -315,7 +315,7 @@ static int handle_input_report(struct quicki2c_device *qcdev)
>  		if (qcdev->state != QUICKI2C_ENABLED)
>  			continue;
>  
> -		quicki2c_hid_send_report(qcdev, pkt->data,
> +		quicki2c_hid_send_report(qcdev, pkt->data, qcdev->input_len,
>  					 HIDI2C_DATA_LEN(le16_to_cpu(pkt->len)));

[Severity: High]
Does this code pass the unadjusted buffer size when pkt->data is offset by 2
bytes from the start of the buffer?

The buffer qcdev->input_buf is dynamically allocated to qcdev->input_len
bytes.

Since pkt is mapped to qcdev->input_buf, pkt->data is offset by
HIDI2C_LENGTH_LEN (2 bytes) from the start of the allocation.

Passing the full qcdev->input_len overstates the remaining capacity for
pkt->data by 2 bytes.

[ ... ]

> diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c
> index 8075992e8732e..1a220a50d934c 100644
> --- a/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c
> +++ b/drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c
[ ... ]
> @@ -157,16 +157,18 @@ void quicki2c_hid_remove(struct quicki2c_device *qcdev)
>   *
>   * @qcdev: point to quicki2c device
>   * @data: point to input report data buffer
> + * @buf_size: the allocated size of the input report data buffer
>   * @data_len: the length of input report data
>   *
>   * Return: 0 on success, non zero on error.
>   */
>  int quicki2c_hid_send_report(struct quicki2c_device *qcdev,
> -			     void *data, size_t data_len)
> +			     void *data, size_t buf_size, size_t data_len)
>  {
>  	int ret;
>  
> -	ret = hid_input_report(qcdev->hid_dev, HID_INPUT_REPORT, data, data_len, 1);
> +	ret = hid_safe_input_report(qcdev->hid_dev, HID_INPUT_REPORT, data,
> +				    buf_size, data_len, 1);

[Severity: High]
Can passing this unadjusted buf_size to hid_safe_input_report() lead to an
out-of-bounds access?

If a device sends a pkt->len such that HIDI2C_DATA_LEN(pkt->len) equals
qcdev->input_len, hid_safe_input_report() will trust the data length since it
does not exceed the provided buf_size.

This would neutralize the core's bounds checks, allowing the core to read or
zero-pad 2 bytes past the end of the qcdev->input_buf allocation.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922025437.940072-1-even.xu@intel.com?part=1

Re: [PATCH 2/2] HID: Intel-thc-hid: Intel-quickspi: Use hid_safe_input_report()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] hid: intel-thc-hid: heap OOB write and report rejection due to incorrect buf_size
--

commit 89b3a4008ccfc5430514595b9a4bdb1131455535
Author: Even Xu <even.xu@intel.com>

    HID: Intel-thc-hid: Intel-quickspi: Use hid_safe_input_report()
    
    Replace the deprecated hid_input_report() with
    hid_safe_input_report(), which takes the allocated size of the input
    report buffer and allows hid-core to validate the reported data length
    against the actual buffer size.
    
    Track the allocated size of qsdev->input_buf in the new input_len
    field and pass it through quickspi_hid_send_report() to
    hid_safe_input_report() to prevent potential out-of-bounds reads.

> diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
> index 847c5ec55569a..0df33c44fbffe 100644
> --- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
> +++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
> @@ -240,7 +240,7 @@ void quickspi_handle_input_data(struct quickspi_device *qsdev, u32 buf_len)
>  		input_len = sizeof(body_hdr->content_id) + input_len;
>  		input_report = input_body->content - sizeof(body_hdr->content_id);
>  
> -		ret = quickspi_hid_send_report(qsdev, input_report, input_len);
> +		ret = quickspi_hid_send_report(qsdev, input_report, qsdev->input_len, input_len);

[Severity: High]
Does passing qsdev->input_len as the buf_size here overstate the available
buffer space?

In quickspi_handle_input_data(), input_report is calculated as an offset into
the allocated buffer:

    input_report = input_body->content - sizeof(body_hdr->content_id);

This offsets the pointer by 3 bytes into the qsdev->input_buf allocation.
However, qsdev->input_len represents the total allocation size, not the
remaining space from the input_report pointer.

When this overstated size reaches hid_safe_input_report(), if a short report
requires padding, hid_report_raw_event() in the HID core could write up to
3 bytes past the end of the qsdev->input_buf allocation via memset(), causing
a heap out-of-bounds write.

Additionally, if a maximum-sized report is received, the data length will
strictly exceed the stated buf_size, causing the HID core to falsely reject
the report with -EINVAL.

Should the buf_size passed to quickspi_hid_send_report() account for the
offset into the buffer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922025437.940072-1-even.xu@intel.com?part=2

Re: [PATCH 0/2] HID: Intel-thc-hid: Use hid_safe_input_report()

[Jiri Kosina]

On Tue, 22 Sep 2026, Even Xu wrote:

> This patch set replace the legacy hid_input_report() with new
> hid_safe_input_report() in quicki2c and quickspi drivers.

Applied, thanks.

-- 
Jiri Kosina
SUSE Labs

RE: [PATCH 0/2] HID: Intel-thc-hid: Use hid_safe_input_report()

[Xu, Even]

Thanks Jiri!

Best Regards,
Even Xu

> -----Original Message-----
> From: Jiri Kosina <jikos@kernel.org>
> Sent: Thursday, September 24, 2026 12:51 AM
> To: Xu, Even <even.xu@intel.com>
> Cc: bentiss@kernel.org; srinivas.pandruvada@linux.intel.com; linux-
> input@vger.kernel.org; linux-kernel@vger.kernel.org
> Subject: Re: [PATCH 0/2] HID: Intel-thc-hid: Use hid_safe_input_report()
> 
> On Tue, 22 Sep 2026, Even Xu wrote:
> 
> > This patch set replace the legacy hid_input_report() with new
> > hid_safe_input_report() in quicki2c and quickspi drivers.
> 
> Applied, thanks.
> 
> --
> Jiri Kosina
> SUSE Labs