[PATCH v2 0/8] HID: validate report size in raw_event callbacks

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

Several HID drivers access report data in their raw_event callbacks
without first verifying the buffer length. Since hid-core invokes each
driver's raw_event callback before it validates the report length in
hid_report_raw_event(), these drivers must perform their own bounds
checking to handle short reports safely.

This series adds report size validation to eight drivers whose
raw_event handlers read beyond the first byte before any length check.

Tristan Madani (8):
  HID: pxrc: validate report size in raw_event callback
  HID: alps: validate report size in raw_event callbacks
  HID: mcp2200: validate report size in raw_event callback
  HID: cougar: validate report size in raw_event callback
  HID: zydacron: validate report size in raw_event callback
  HID: oxp: validate report size in raw_event callbacks
  HID: cp2112: validate report size in raw_event callback
  HID: prodikeys: validate report size in raw_event callback

 drivers/hid/hid-alps.c      | 12 ++++++++++++
 drivers/hid/hid-cougar.c    |  3 +++
 drivers/hid/hid-cp2112.c    | 10 ++++++++++
 drivers/hid/hid-mcp2200.c   |  3 +++
 drivers/hid/hid-oxp.c       |  6 ++++++
 drivers/hid/hid-prodikeys.c |  4 ++++
 drivers/hid/hid-pxrc.c      |  3 +++
 drivers/hid/hid-zydacron.c  |  3 +++
 8 files changed, 44 insertions(+)

---
Changes v1 -> v2:
- Patch 2/8 (alps): Fixed U1_ABSOLUTE report bound from
  max_fingers * 5 + 5 to max_fingers * 5 + 3. The last byte accessed
  in the finger loop is contact[7] at data[max_fingers * 5 + 2],
  so the previous bound was two bytes too strict (reported by sashiko-bot).
- Patch 8/8 (prodikeys): Moved size checks into pcmidi_handle_report()
  with per-report-ID guards instead of a blanket size < 4 in
  pk_raw_event(). Report 0x03 (MIDI keyboard) passes size to
  pcmidi_handle_report3() which already handles variable-length
  reports; the blanket check dropped valid 3-byte single-note events
  (reported by sashiko-bot).

-- 
2.47.3