Re: [PATCH 2/9] HID: core: Fix GET_REPORT input processing for unnumbered reports

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] hid: core: uhid unnumbered GET_REPORT payload truncation
--

commit c28ca1033fab3989e7f3d67f52364f0621a32b6d
Author: Dmitry Torokhov <dmitry.torokhov@gmail.com>

HID: core: Fix GET_REPORT input processing for unnumbered reports

This commit offsets the buffer and deducts the dummy report ID from the length
when forwarding unnumbered reports to the input layer in __hid_request.

> diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
> index ec7c2860c93ef..a33e864a25f92 100644
> --- a/drivers/hid/hid-core.c
> +++ b/drivers/hid/hid-core.c
> @@ -2033,8 +2033,13 @@ int __hid_request(struct hid_device *hid, struct hid_report *report,
>  		return ret;
>  	}
>  
> -	if (reqtype == HID_REQ_GET_REPORT)
> -		hid_input_report(hid, report->type, buf, ret, 0);
> +	if (reqtype == HID_REQ_GET_REPORT) {
> +		if (report->id == 0)
> +			ret--;
> +
> +		if (ret > 0)
> +			hid_input_report(hid, report->type, data_buf, ret, 0);

[Severity: High]
Does this unconditional stripping of the first byte truncate the payload for
unnumbered reports on uhid devices?

The commit message notes that low-level transport drivers store a dummy
report ID of 0 for unnumbered reports. While true for drivers like usbhid
and i2c-hid, uhid handles this differently.

According to the uhid ABI, userspace replies to UHID_GET_REPORT via
UHID_GET_REPORT_REPLY and places the exact raw payload in req->data without
a dummy report ID.

In drivers/hid/uhid.c:uhid_hid_get_report(), the payload is copied exactly
as provided by userspace:

	ret = min3(count, (size_t)req->size, (size_t)UHID_DATA_MAX);
	memcpy(buf, req->data, ret);

Since uhid does not prepend a dummy 0 byte, decrementing ret and passing
data_buf (which was advanced by one earlier in __hid_request) to
hid_input_report() appears to strip the first byte of the actual payload,
corrupting the data.

> +	}
>  
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012-hid-core-report-validation-v1-0-e0dd5cb60b2e@gmail.com?part=2