From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D1A222571DD for ; Sat, 18 Apr 2026 02:58:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776481116; cv=none; b=kcDMifaTRKYp97Fa/jZ+qOQW1uTt3Nq2Y74dF4JrtSoR+rRMNh/o1YiH1muV3HcosJMF8lbiQNLJ0f/FPHHQ/4HBp0mdBxN+2h7a1U31hEcHEysXgr0e+4FF28zk137xQ94p5uU6Uzr/vsuq7mVlEeOLGlt2xjM5EbDbWIYkfAE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776481116; c=relaxed/simple; bh=Os3Qd2/rEF3RFRrAtbvsX0CsqiUOJRcpfnFRti8hRTE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=flmDrO6hHC3wbCLprKyD+aOHFj3uH6Ilo7ZcafLQ/WK37g2AZw57zMTTPYYv9Mz6hJF96ggcswtz2+X3eQRBrSFn/ps2dVKjOLTnu7DY0K+KPCiHVj9VPNMpdROH9k0dwzjEvrj/Vr36+RDFeu/wAJqovyUXGJAE7BdTGfmFPg8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=exponent.digital; spf=pass smtp.mailfrom=exponent.digital; dkim=pass (2048-bit key) header.d=exponent-digital.20251104.gappssmtp.com header.i=@exponent-digital.20251104.gappssmtp.com header.b=aMQq/Jz8; arc=none smtp.client-ip=209.85.210.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=exponent.digital Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=exponent.digital Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=exponent-digital.20251104.gappssmtp.com header.i=@exponent-digital.20251104.gappssmtp.com header.b="aMQq/Jz8" Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-82cebbdbdccso807215b3a.1 for ; Fri, 17 Apr 2026 19:58:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=exponent-digital.20251104.gappssmtp.com; s=20251104; t=1776481114; x=1777085914; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=wimO4t98B94X++UZm1VpEFfwrjNwlS6cYzn0ZUHBaAs=; b=aMQq/Jz8zocx4LSV0PkiQKMh2LR10TOFmWSu6Uh5tjahwZiv408BLMhKPvUmEjEGsE AyN+8mxnK8xmQLXelSD1CYfvuPj1DJ/xLWlO++TFujCPjhjVrFmGXLzrVrdpeo8HICSl qnDaeZh9PQFHSRUSxSeM55mMY0ppjlefeDwVqjBWPhLlrnZX8G22h91uBiDWy19wsF1f Vlz1hwLPXQtxbU/V6wMem+D/Tgrxm1/SMSgdeIfGDn8abgLRHUTsOfydjqHndBiDs/Mi bAcOvlPUDrb3JxSL3FOzLEz8rbQGbaq/PQtYQP7N6sI9Xl0m8RkARmMXaNm2vIRB37lx duPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776481114; x=1777085914; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=wimO4t98B94X++UZm1VpEFfwrjNwlS6cYzn0ZUHBaAs=; b=V1iplLPUYi50Mcj7hUYiGGRslB78WrozoxuvNKqPFcTjAXrc/RbYur62S9oeJ1ULqC le/0J4bAzdUWkggAvYsbwo0TMrHMm4DWxg2z9K4TNhuaSdK9voVSXHlVSfva8TTscXM5 NcxXpoESJYyaRPpY3LasZK8SxVglI9XJLdhvj8SlUKilUOW8A/Wug/oZV8fBVoa+elHh 5ipzVHf1RGYfPNAtHx/aPDNKyP8lcEYq0hTmCgEd4E6C+LAHd+4kut8L/yjLO/NwpLGT 9zr/qghaHjNKn9xiaEuCWG891+Ubzi76oh6dvNBg5j50YsH1DHp9jIC/F6g+TtYk22PV 5yzg== X-Forwarded-Encrypted: i=1; AFNElJ8SdnB/Afu3yfrCX69IcicY3Hg3rrJsyoKcxYFR7N6qHvy/fu5hzWU1DVksZG8fgK9gbGug3423kWJVtYc=@vger.kernel.org X-Gm-Message-State: AOJu0YyEkVI+UnANHJnrukXCzgyDY4P5e9SLV6OA2lbGacWPEl9b2H1n GQAfeRV4rHvyTDtjUPah6RT/L7EnRz9vQJsYrLMU7INQfes0Q0py26Rv3Q1vcgEm7x4= X-Gm-Gg: AeBDieu7gz1i36rtPWz1yUrr+jHnspvNKXV9oZKA1dJgWg5OC1wcIafI5uCFz0eyQG4 1t3NjXip8ATvcEadoorn69S32As8Lj2cLFwsxrKgae/do2CipYcUFq7a+vu5adKWP/HONJUUdHN s3KN+VDTZ8N45bBATX6bO7yEkLkq4/SnNwgqPQJYyx2JcnYNc19sL9oPGHeQwvR70UEmn2EH9Ib KUYBxkGyEBiyJsWqXUq7vW2pLMj57pT1dFS9+eeh04fvndlgypFjSvfbGQQ8at8y7tqW3aL+u0n 1WQO08lTKH9lHQP+DWDYKMoMiiOfxfLjusYzLKNDy+OrxrM0RhQyxS9iML6q3FvawEPPJc1sQq5 N5F+xgld1d1YkdmZiR0auq686yPVt2gOeRu4iz6wCg+LqbdhWOSqolTT6TrGEzlcExp1mYxJwl/ SlZxEvK0J2gXj2L1dogwkZa7hOv2d7Cri7Nsiji4FIqR0+nR+Y7CY9Yq7NxI4= X-Received: by 2002:a05:6a00:27ab:b0:82f:4725:f6d0 with SMTP id d2e1a72fcca58-82f8b5476bdmr4184949b3a.29.1776481114219; Fri, 17 Apr 2026 19:58:34 -0700 (PDT) Received: from yohji.localdomain ([101.100.136.235]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82f8e9819e5sm3524552b3a.2.2026.04.17.19.58.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Apr 2026 19:58:33 -0700 (PDT) From: Taylor Hewetson To: Jiri Kosina , Benjamin Tissoires Cc: linux-usb@vger.kernel.org, linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Taylor Hewetson Subject: [PATCH] HID: usbhid: sanitize hid->uniq against non-printable bytes Date: Sat, 18 Apr 2026 14:58:23 +1200 Message-ID: <20260418025823.21767-1-taylor@exponent.digital> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Some USB HID devices (observed on ASUS ROG Azoth via its 2.4GHz dongle, USB ID 0b05:1a85) report an iSerialNumber string whose USB string descriptor declares a longer length than the actual serial, leaving uninitialized firmware memory - including control characters such as 0x18 - appended to the returned string. These non-printable bytes propagate into hid->uniq, which in turn populates /sys/class/input/inputN/uniq. Downstream userspace components (systemd sd-device property_is_valid(), and by extension mutter input enumeration on GNOME Wayland sessions) reject devices with control characters in their uniq, rendering otherwise- functional input devices unusable in graphical sessions despite the kernel input layer correctly translating keypresses. Truncate hid->uniq at the first byte outside the printable ASCII range (0x20..0x7e) after the serial is read. Signed-off-by: Taylor Hewetson --- --- a/drivers/hid/usbhid/hid-core.c +++ b/drivers/hid/usbhid/hid-core.c @@ -1427,8 +1427,17 @@ snprintf(hid->phys + len, sizeof(hid->phys) - len, "%d", intf->altsetting[0].desc.bInterfaceNumber); - if (usb_string(dev, dev->descriptor.iSerialNumber, hid->uniq, 64) <= 0) + if (usb_string(dev, dev->descriptor.iSerialNumber, hid->uniq, 64) <= 0) { hid->uniq[0] = 0; + } else { + size_t i; + for (i = 0; i < sizeof(hid->uniq) && hid->uniq[i]; i++) { + if (hid->uniq[i] < 0x20 || hid->uniq[i] > 0x7e) { + hid->uniq[i] = 0; + break; + } + } + } usbhid = kzalloc(sizeof(*usbhid), GFP_KERNEL); if (usbhid == NULL) {