[PATCH] usb: gadget: f_hid: reject zero report length

[PATCH] usb: gadget: f_hid: reject zero report length

[lurenjia534 via B4 Relay]

From: lurenjia534 <lurenjia534@outlook.com>

New configfs HID function instances leave report_length at zero until
userspace sets the attribute.  hidg_alloc() currently accepts that value
and copies it into the function state.  hidg_bind() then uses it as the
maximum packet size of the interrupt endpoint descriptors.

If userspace links the unconfigured function and enables the gadget,
hidg_set_alt() reaches usb_ep_enable() with a zero maximum packet size,
which triggers a warning.

Reject the function from hidg_alloc() when report_length is zero.  This
makes the configfs link fail before invalid endpoint descriptors can be
added while leaving configured HID functions unchanged.

Fixes: 21a9476a7ba8 ("usb: gadget: hid: add configfs support")
Reported-by: syzbot+7b70c4a6021fd49c4151@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6a6cd7bd.1aa927e4.17d4bf.0004.GAE@google.com/
Assisted-by: Codex:GPT-5.6 MAX
Signed-off-by: lurenjia534 <lurenjia534@outlook.com>
---
Testing:
- syzbot reproducer: warning and panic in 2/2 runs before the fix;
  no warning in 2/2 30-second runs after the fix
- configfs/dummy_hcd regression: FAIL before the fix and PASS after it
- current usb-testing: reproducer and regression test PASS, taint 0
- GCC built-in and module builds, sparse, and x86-64/arm64 target
  builds with both supported toolchains: PASS
---
 drivers/usb/gadget/function/f_hid.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 3c6b43d06a..74a78cfd37 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -1605,6 +1605,11 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi)
 	opts = container_of(fi, struct f_hid_opts, func_inst);
 
 	mutex_lock(&opts->lock);
+	if (!opts->report_length) {
+		mutex_unlock(&opts->lock);
+		kfree(hidg);
+		return ERR_PTR(-EINVAL);
+	}
 
 	spin_lock_init(&hidg->write_spinlock);
 	spin_lock_init(&hidg->read_spinlock);

---
base-commit: 5d5fd841c34649f1b09220fe58e59dffd61c447d
change-id: 20260802-hid-report-length-usb-testing-f946f3a643da

Best regards,
--  
lurenjia534 <lurenjia534@outlook.com>

Re: [PATCH] usb: gadget: f_hid: reject zero report length

[Greg Kroah-Hartman]

On Sun, Aug 02, 2026 at 04:19:34AM +0800, lurenjia534 via B4 Relay wrote:
> From: lurenjia534 <lurenjia534@outlook.com>

We need a real name, not an email alias.

thanks,

greg k-h