[PATCH] HID: huawei/rapoo: reject non-USB transports before to_usb_interface()

[PATCH] HID: huawei/rapoo: reject non-USB transports before to_usb_interface()

[Jiale Yao]

hid-huawei's huawei_report_fixup() unconditionally calls
to_usb_interface(hdev->dev.parent) without first verifying the
device is actually a USB HID device.  When uhid spoofs bus = BUS_USB
with matching VID/PID, hdev->dev.parent points to a uhid_device,
not a usb_interface.  to_usb_interface() returns a garbage pointer,
triggering:

  BUG: KASAN: slab-out-of-bounds in huawei_report_fixup
  Read of size 8 at 1176 bytes beyond an 800-byte kmalloc-1k region
  BUG: KASAN: null-ptr-deref in huawei_report_fixup

  Call Trace:
   huawei_report_fixup
   hid_open_report
   hid_device_probe
   really_probe
   uhid_device_add_worker

hid-rapoo's rapoo_probe() guards the to_usb_interface() call with
hdev->bus == BUS_USB, but uhid can forge hdev->bus, trivially
bypassing this check and causing the same type confusion.

Fix both drivers by adding the proper hid_is_usb() guard -- a helper
that inspects the actual parent device type rather than trusting the
forgeable bus field -- before any to_usb_interface() dereference.

Fixes: e93faaca84b7 ("HID: huawei: fix CD30 keyboard report descriptor issue")
Fixes: b3b1c68fb726 ("HID: rapoo: Add support for side buttons on RAPOO 0x2015 mouse")
Assisted-by: Claude:deepseek-v4-pro
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/hid/hid-huawei.c | 7 ++++++-
 drivers/hid/hid-rapoo.c  | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-huawei.c b/drivers/hid/hid-huawei.c
index 6a616bf21b38..d2f9f15871a2 100644
--- a/drivers/hid/hid-huawei.c
+++ b/drivers/hid/hid-huawei.c
@@ -44,7 +44,12 @@ static const __u8 huawei_cd30_kbd_rdesc_fixed[] = {
 static const __u8 *huawei_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 				  unsigned int *rsize)
 {
-	struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+	struct usb_interface *intf;
+
+	if (!hid_is_usb(hdev))
+		return rdesc;
+
+	intf = to_usb_interface(hdev->dev.parent);
 
 	switch (hdev->product) {
 	case USB_DEVICE_ID_HUAWEI_CD30KBD:
diff --git a/drivers/hid/hid-rapoo.c b/drivers/hid/hid-rapoo.c
index 4c81f3086de4..5c9c396fabf7 100644
--- a/drivers/hid/hid-rapoo.c
+++ b/drivers/hid/hid-rapoo.c
@@ -36,7 +36,7 @@ static int rapoo_probe(struct hid_device *hdev, const struct hid_device_id *id)
 		return ret;
 	}
 
-	if (hdev->bus == BUS_USB) {
+	if (hid_is_usb(hdev)) {
 		struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
 
 		if (intf->cur_altsetting->desc.bInterfaceNumber != 1)
-- 
2.34.1

Re: [PATCH] HID: huawei/rapoo: reject non-USB transports before to_usb_interface()

[kernel test robot]

Hi Jiale,

kernel test robot noticed the following build errors:

[auto build test ERROR on hid/for-next]
[also build test ERROR on linus/master v7.2-rc6 next-20260731]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Jiale-Yao/HID-huawei-rapoo-reject-non-USB-transports-before-to_usb_interface/20260803-165822
base:   https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git for-next
patch link:    https://lore.kernel.org/r/20260728064302.3853953-1-yaojiale02%40163.com
patch subject: [PATCH] HID: huawei/rapoo: reject non-USB transports before to_usb_interface()
config: hexagon-randconfig-001-20260803 (https://download.01.org/0day-ci/archive/20260804/202608040101.4jtONal7-lkp@intel.com/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260804/202608040101.4jtONal7-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608040101.4jtONal7-lkp@intel.com/

All errors (new ones prefixed by >>):

>> ld.lld: error: undefined symbol: hid_is_usb
   >>> referenced by hid-rapoo.c:39 (drivers/hid/hid-rapoo.c:39)
   >>>               drivers/hid/hid-rapoo.o:(rapoo_probe) in archive vmlinux.a
   >>> referenced by hid-rapoo.c:39 (drivers/hid/hid-rapoo.c:39)
   >>>               drivers/hid/hid-rapoo.o:(rapoo_probe) in archive vmlinux.a

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] HID: huawei/rapoo: reject non-USB transports before to_usb_interface()

[kernel test robot]

Hi Jiale,

kernel test robot noticed the following build errors:

[auto build test ERROR on hid/for-next]
[also build test ERROR on linus/master v7.2-rc6 next-20260731]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Jiale-Yao/HID-huawei-rapoo-reject-non-USB-transports-before-to_usb_interface/20260803-165822
base:   https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git for-next
patch link:    https://lore.kernel.org/r/20260728064302.3853953-1-yaojiale02%40163.com
patch subject: [PATCH] HID: huawei/rapoo: reject non-USB transports before to_usb_interface()
config: x86_64-buildonly-randconfig-003-20260803 (https://download.01.org/0day-ci/archive/20260804/202608040118.PKscfqFG-lkp@intel.com/config)
compiler: gcc-13 (Debian 13.3.0-16) 13.3.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260804/202608040118.PKscfqFG-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608040118.PKscfqFG-lkp@intel.com/

All errors (new ones prefixed by >>, old ones prefixed by <<):

>> ERROR: modpost: "hid_is_usb" [drivers/hid/hid-rapoo.ko] undefined!

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki