Re: [REGRESSION] amd_sfh: accelerometer broken since 6.19 ("Event data for report 1 was too short (15 vs 14)")

[Lee Jones <lee@kernel.org>]

On Fri, 09 Oct 2026, Lee Jones wrote:

> On Fri, 02 Oct 2026, Andrej Scek wrote:
> 
> > Update: this looks like it is caused by
> > 
> >   0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
> > 
> > which was backported to the 6.18.y and 6.19.y stable trees on 2026-04-11.
> > 6.18.16 predates that backport and works; 6.19.12 and 7.2.8 contain it and
> > fail. The AMD SFH sends 14-byte reports where the descriptor declares 15, and
> > those are now rejected instead of zero-padded. (This corrects my earlier note
> > that hid-core had no relevant changes; I had only checked v6.18..v6.19.)
> > 
> > The same symptom on another AMD SFH device (Legion Go S, "18 vs 14"):
> > https://github.com/ublue-os/bazzite/issues/5796
> > 
> > So AMD SFH (hid-amdsfh 1022:0001) probably needs to be covered by whatever
> > short-report quirk/fix is adopted for this.
> > 
> > #regzbot introduced: 0a3fe972a7cb
> 
> This is on my radar.  Leave it with me.

stable/linux-5.10.y:
59bfdb41a34c HID: pass the buffer size to hid_report_raw_event [5.10.259]
QUEUED: HID: core: introduce hid_safe_input_report()
QUEUED: HID: uhid: convert to hid_safe_input_report()

stable/linux-5.15.y:
a4d6cb7cf45b HID: pass the buffer size to hid_report_raw_event [5.15.210]
QUEUED: HID: core: introduce hid_safe_input_report()
QUEUED: HID: uhid: convert to hid_safe_input_report()

stable/linux-6.1.y:
121dc93ae1fc HID: pass the buffer size to hid_report_raw_event [6.1.176]
QUEUED: HID: core: introduce hid_safe_input_report()
QUEUED: HID: uhid: convert to hid_safe_input_report()

stable/linux-6.6.y:
9e36568e67f8 HID: pass the buffer size to hid_report_raw_event [6.6.143]
QUEUED: HID: core: introduce hid_safe_input_report()
QUEUED: HID: uhid: convert to hid_safe_input_report()

-- 
Lee Jones