From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
To: Marcel Holtmann <marcel@holtmann.org>,
Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
David Rheinsberg <david@readahead.eu>,
Frank Praznik <frank.praznik@oh.rr.com>,
Jiri Kosina <jikos@kernel.org>,
Benjamin Tissoires <bentiss@kernel.org>,
Even Xu <even.xu@intel.com>, Xinpeng Sun <xinpeng.sun@intel.com>,
Roderick Colenbrander <roderick.colenbrander@sony.com>
Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-input@vger.kernel.org,
Shashikirana H K <shashikiranah@chromium.org>
Subject: [PATCH 0/9] HID: Hardening report validation and unnumbered report handling
Date: Mon, 12 Oct 2026 20:42:16 -0700 [thread overview]
Message-ID: <20261012-hid-core-report-validation-v1-0-e0dd5cb60b2e@gmail.com> (raw)
This series improves validation and consistency across HID core,
transport drivers, and individual device drivers for numbered and
unnumbered reports.
Bluetooth HIDP and HID core report retrieval handling are updated to
properly respect the kernel convention where raw report request buffers
reserve the first byte for the report ID, using 0 for unnumbered
reports.
Report descriptors mixing numbered and unnumbered reports within the
same report enumeration are rejected in accordance with the HID
specification.
Report ID verification for successful report retrieval transfers is
centralized in the HID core, with a new device quirk to accommodate
buggy firmware (such as the ASUS ROG Flow Z13 touchpad). Redundant
report ID checks are removed across the I2C-HID, Goodix SPI, Intel
QuickI2C, multitouch, and PlayStation drivers.
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
Dmitry Torokhov (9):
Bluetooth: HIDP: Fix GET_REPORT and SET_REPORT for unnumbered reports
HID: core: Fix GET_REPORT input processing for unnumbered reports
HID: core: Reject mixing numbered and unnumbered reports
HID: core: Validate GET_REPORT report ID centrally
HID: i2c-hid: Drop redundant report ID validation
HID: goodix-spi: Drop redundant report ID validation
HID: intel-thc-hid: Drop redundant report ID validation in quicki2c
HID: multitouch: Drop redundant report ID validation in mt_get_feature
HID: playstation: Drop redundant report ID validation in ps_get_report
drivers/hid/hid-core.c | 26 ++++++++++++++++--
drivers/hid/hid-goodix-spi.c | 5 ----
drivers/hid/hid-multitouch.c | 32 ----------------------
drivers/hid/hid-playstation.c | 5 ----
drivers/hid/hid-quirks.c | 2 ++
drivers/hid/i2c-hid/i2c-hid-core.c | 7 -----
.../intel-quicki2c/quicki2c-protocol.c | 6 ++--
include/linux/hid.h | 2 ++
net/bluetooth/hidp/core.c | 29 ++++++++++++++++----
9 files changed, 53 insertions(+), 61 deletions(-)
---
base-commit: b018686719706a781c45a874ed51374a2dc4b767
change-id: 20261012-hid-core-report-validation-8ca85d385ca7
Thanks.
--
Dmitry
next reply other threads:[~2026-10-13 3:42 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-13 3:42 Dmitry Torokhov [this message]
2026-10-13 3:42 ` [PATCH 1/9] Bluetooth: HIDP: Fix GET_REPORT and SET_REPORT for unnumbered reports Dmitry Torokhov
2026-10-13 3:57 ` sashiko-bot
2026-10-13 3:42 ` [PATCH 2/9] HID: core: Fix GET_REPORT input processing " Dmitry Torokhov
2026-10-13 4:00 ` sashiko-bot
2026-10-13 3:42 ` [PATCH 3/9] HID: core: Reject mixing numbered and " Dmitry Torokhov
2026-10-13 3:42 ` [PATCH 4/9] HID: core: Validate GET_REPORT report ID centrally Dmitry Torokhov
2026-10-13 4:00 ` sashiko-bot
2026-10-13 3:42 ` [PATCH 5/9] HID: i2c-hid: Drop redundant report ID validation Dmitry Torokhov
2026-10-13 3:42 ` [PATCH 6/9] HID: goodix-spi: " Dmitry Torokhov
2026-10-13 3:42 ` [PATCH 7/9] HID: intel-thc-hid: Drop redundant report ID validation in quicki2c Dmitry Torokhov
2026-10-13 3:57 ` sashiko-bot
2026-10-13 3:42 ` [PATCH 8/9] HID: multitouch: Drop redundant report ID validation in mt_get_feature Dmitry Torokhov
2026-10-13 3:42 ` [PATCH 9/9] HID: playstation: Drop redundant report ID validation in ps_get_report Dmitry Torokhov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261012-hid-core-report-validation-v1-0-e0dd5cb60b2e@gmail.com \
--to=dmitry.torokhov@gmail.com \
--cc=bentiss@kernel.org \
--cc=david@readahead.eu \
--cc=even.xu@intel.com \
--cc=frank.praznik@oh.rr.com \
--cc=jikos@kernel.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luiz.dentz@gmail.com \
--cc=marcel@holtmann.org \
--cc=roderick.colenbrander@sony.com \
--cc=shashikiranah@chromium.org \
--cc=xinpeng.sun@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox