Re: [PATCH v2 1/4] HID: pass the buffer size to hid_report_raw_event

[Benjamin Tissoires <bentiss@kernel.org>]

On Apr 20 2026, Icenowy Zheng wrote:
> 在 2026-04-16四的 16:48 +0200，Benjamin Tissoires写道：
> > commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
> > bogus memset()") enforced the provided data to be at least the size
> > of
> > the declared buffer in the report descriptor to prevent a buffer
> > overflow. However, we can try to be smarter by providing both the
> > buffer
> > size and the data size, meaning that hid_report_raw_event() can make
> > better decision whether we should plaining reject the buffer (buffer
> > overflow attempt) or if we can safely memset it to 0 and pass it to
> > the
> > rest of the stack.
> > 
> > Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
> > bogus memset()")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
> > ---
> >  drivers/hid/bpf/hid_bpf_dispatch.c |  6 ++++--
> >  drivers/hid/hid-core.c             | 42 +++++++++++++++++++++++++---
> > ----------
> >  drivers/hid/hid-gfrm.c             |  4 ++--
> >  drivers/hid/hid-logitech-hidpp.c   |  2 +-
> >  drivers/hid/hid-multitouch.c       |  2 +-
> >  drivers/hid/hid-primax.c           |  2 +-
> >  drivers/hid/hid-vivaldi-common.c   |  2 +-
> >  drivers/hid/wacom_sys.c            |  6 +++---
> >  drivers/staging/greybus/hid.c      |  2 +-
> >  include/linux/hid.h                |  4 ++--
> >  include/linux/hid_bpf.h            | 14 ++++++++-----
> >  11 files changed, 53 insertions(+), 33 deletions(-)
> 
> ============ 8< ===================
> 
> > diff --git a/drivers/staging/greybus/hid.c
> > b/drivers/staging/greybus/hid.c
> > index 1f58c907c036..37e8605c6767 100644
> > --- a/drivers/staging/greybus/hid.c
> > +++ b/drivers/staging/greybus/hid.c
> > @@ -201,7 +201,7 @@ static void gb_hid_init_report(struct gb_hid
> > *ghid, struct hid_report *report)
> >  	 * we just need to setup the input fields, so using
> >  	 * hid_report_raw_event is safe.
> >  	 */
> > -	hid_report_raw_event(ghid->hid, report->type, ghid->inbuf,
> > size, 1);
> > +	hid_report_raw_event(ghid->hid, report->type, ghid->inbuf,
> > ghib->bufsize, size, 1);
> 
> Oops, "ghid" is misspelled here...

Damn, you're correct. Sorry.

Jiri, do you want me to send v3? Or can you fix it while applying?

> 
> Found this when building some gaint kernel with this patchset.

Thanks a lot for spotting this.

Cheers,
Benjamin

> 
> Thanks,
> Icenowy
> 
> >  }
> >  
> >  static void gb_hid_init_reports(struct gb_hid *ghid)
>