Re: [PATCH 2/2] HID: Intel-thc-hid: Intel-quickspi: Use hid_safe_input_report()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] hid: intel-thc-hid: heap OOB write and report rejection due to incorrect buf_size
--

commit 89b3a4008ccfc5430514595b9a4bdb1131455535
Author: Even Xu <even.xu@intel.com>

    HID: Intel-thc-hid: Intel-quickspi: Use hid_safe_input_report()
    
    Replace the deprecated hid_input_report() with
    hid_safe_input_report(), which takes the allocated size of the input
    report buffer and allows hid-core to validate the reported data length
    against the actual buffer size.
    
    Track the allocated size of qsdev->input_buf in the new input_len
    field and pass it through quickspi_hid_send_report() to
    hid_safe_input_report() to prevent potential out-of-bounds reads.

> diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
> index 847c5ec55569a..0df33c44fbffe 100644
> --- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
> +++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
> @@ -240,7 +240,7 @@ void quickspi_handle_input_data(struct quickspi_device *qsdev, u32 buf_len)
>  		input_len = sizeof(body_hdr->content_id) + input_len;
>  		input_report = input_body->content - sizeof(body_hdr->content_id);
>  
> -		ret = quickspi_hid_send_report(qsdev, input_report, input_len);
> +		ret = quickspi_hid_send_report(qsdev, input_report, qsdev->input_len, input_len);

[Severity: High]
Does passing qsdev->input_len as the buf_size here overstate the available
buffer space?

In quickspi_handle_input_data(), input_report is calculated as an offset into
the allocated buffer:

    input_report = input_body->content - sizeof(body_hdr->content_id);

This offsets the pointer by 3 bytes into the qsdev->input_buf allocation.
However, qsdev->input_len represents the total allocation size, not the
remaining space from the input_report pointer.

When this overstated size reaches hid_safe_input_report(), if a short report
requires padding, hid_report_raw_event() in the HID core could write up to
3 bytes past the end of the qsdev->input_buf allocation via memset(), causing
a heap out-of-bounds write.

Additionally, if a maximum-sized report is received, the data length will
strictly exceed the stated buf_size, causing the HID core to falsely reject
the report with -EINVAL.

Should the buf_size passed to quickspi_hid_send_report() account for the
offset into the buffer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922025437.940072-1-even.xu@intel.com?part=2