[PATCH] HID: sensor-hub: fix out-of-bounds access in sensor_hub_get_feature()

[PATCH] HID: sensor-hub: fix out-of-bounds access in sensor_hub_get_feature()

[Shengzhuo Wei]

sensor_hub_get_feature() copies each field value with
memcpy(..., report->field[...]->report_size / 8), a size taken only
from the descriptor and bounded neither to the caller buffer nor to the
field->value[] array.

When report_size exceeds the remaining buffer (e.g. a 64-bit power-state
field into a 4-byte int) the copy overflows the caller's stack on the
first iteration; when report_size > 32 it also reads past field->value[]
(one __s32 per logical value) into slab, leaking bytes to userspace via
callers that expose the buffer (hid-sensor-custom show_value over sysfs).
Reachable from an untrusted USB or Bluetooth HID device with no local
privileges.

Bound the per-iteration copy to min(report_size/8,
(report_count-i)*sizeof(__s32), buffer_size - buffer_index).

Fixes: 5459ada2b3cd ("HID: sensor-hub: Fix packing of result buffer for feature report")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
---
 drivers/hid/hid-sensor-hub.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 34f710c465b80a0c46cc207e3d99a07c5767f291..978335db71b09617c87e879911b8e75b6bfdebb8 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -270,11 +270,18 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
 
 	val_ptr = (u8 *)report->field[field_index]->value;
 	for (i = 0; i < report->field[field_index]->report_count; ++i) {
+		int copy = report->field[field_index]->report_size / 8;
+		int src_remaining = (report->field[field_index]->report_count - i) *
+				    sizeof(__s32);
+
 		if (buffer_index >= ret)
 			break;
 
-		memcpy(&((u8 *)buffer)[buffer_index], val_ptr,
-		       report->field[field_index]->report_size / 8);
+		if (copy > src_remaining)
+			copy = src_remaining;
+		if (copy > buffer_size - buffer_index)
+			copy = buffer_size - buffer_index;
+		memcpy(&((u8 *)buffer)[buffer_index], val_ptr, copy);
 		val_ptr += sizeof(__s32);
 		buffer_index += (report->field[field_index]->report_size / 8);
 	}

---
base-commit: bf0a94fb2b59542f9dd6fea4eec67336f1ccfa56
change-id: 20260806-hid-sensor-hub-oob-f316fd015b76

Best regards,
-- 
Shengzhuo Wei <me@cherr.cc>

Re: [PATCH] HID: sensor-hub: fix out-of-bounds access in sensor_hub_get_feature()

[srinivas pandruvada]

On Thu, 2026-08-06 at 00:38 +0800, Shengzhuo Wei wrote:
> sensor_hub_get_feature() copies each field value with
> memcpy(..., report->field[...]->report_size / 8), a size taken only
> from the descriptor and bounded neither to the caller buffer nor to
> the
> field->value[] array.
> 
> When report_size exceeds the remaining buffer (e.g. a 64-bit power-
> state
> field into a 4-byte int) the copy overflows the caller's stack on the
> first iteration; when report_size > 32 it also reads past field-
> >value[]
> (one __s32 per logical value) into slab, leaking bytes to userspace
> via
> callers that expose the buffer (hid-sensor-custom show_value over
> sysfs).
> Reachable from an untrusted USB or Bluetooth HID device with no local
> privileges.
> 
> Bound the per-iteration copy to min(report_size/8,
> (report_count-i)*sizeof(__s32), buffer_size - buffer_index).
> 

There was a patch posted "PATCH v2] HID: sensor-hub: Fix out-of-bounds
write in sensor_hub_get_feature"
and I did ACK. But checked it didn't have correct CC list.

"
Fixes: 5459ada2b3cd69 ("HID: sensor-hub: Fix packing of result buffer
for feature report")
Cc: stable@kernel.org
Assisted-by: OpenAI:GPT-5.5-Cyber
Signed-off-by: Xingrui Li <baka9@bakabaka9.tech>
"

Xingrui, Please resend to all in this list here.

Thanks,
Srinivas





> Fixes: 5459ada2b3cd ("HID: sensor-hub: Fix packing of result buffer
> for feature report")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shengzhuo Wei <me@cherr.cc>
> ---
>  drivers/hid/hid-sensor-hub.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-
> hub.c
> index
> 34f710c465b80a0c46cc207e3d99a07c5767f291..978335db71b09617c87e879911b
> 8e75b6bfdebb8 100644
> --- a/drivers/hid/hid-sensor-hub.c
> +++ b/drivers/hid/hid-sensor-hub.c
> @@ -270,11 +270,18 @@ int sensor_hub_get_feature(struct
> hid_sensor_hub_device *hsdev, u32 report_id,
>  
>  	val_ptr = (u8 *)report->field[field_index]->value;
>  	for (i = 0; i < report->field[field_index]->report_count;
> ++i) {
> +		int copy = report->field[field_index]->report_size /
> 8;
> +		int src_remaining = (report->field[field_index]-
> >report_count - i) *
> +				    sizeof(__s32);
> +
>  		if (buffer_index >= ret)
>  			break;
>  
> -		memcpy(&((u8 *)buffer)[buffer_index], val_ptr,
> -		       report->field[field_index]->report_size / 8);
> +		if (copy > src_remaining)
> +			copy = src_remaining;
> +		if (copy > buffer_size - buffer_index)
> +			copy = buffer_size - buffer_index;
> +		memcpy(&((u8 *)buffer)[buffer_index], val_ptr,
> copy);
>  		val_ptr += sizeof(__s32);
>  		buffer_index += (report->field[field_index]-
> >report_size / 8);
>  	}
> 
> ---
> base-commit: bf0a94fb2b59542f9dd6fea4eec67336f1ccfa56
> change-id: 20260806-hid-sensor-hub-oob-f316fd015b76
> 
> Best regards,