[PATCH v2 0/2] HID: lenovo-go: clean up USB assumption

[PATCH v2 0/2] HID: lenovo-go: clean up USB assumption

[Louis Clinckx]

These drivers' id_tables only match HID_USB_DEVICE() entries and the
code freely assumes a USB transport (to_usb_interface() on hdev->dev.parent,
endpoint access in raw_event). Make the assumption explicit at probe and
drop a NULL check that the compiler-level definition of to_usb_interface()
makes unreachable.

No functional change for the supported (USB) devices.

Louis Clinckx (2):
  HID: lenovo-go: reject non-USB transports in probe
  HID: lenovo-go: drop dead NULL check on to_usb_interface()

 drivers/hid/hid-lenovo-go-s.c | 11 ++++++-----
 drivers/hid/hid-lenovo-go.c   |  6 +++---
 2 files changed, 9 insertions(+), 8 deletions(-)

---
Changes since v1:
 - Resubmitted on linux-input as a quality fix per Benjamin's review of v1
   (sent to security@kernel.org; the HID_USB_DEVICE() id_table already
    filters BUS_USB, so no exploitable path).
 - Added patch 2 to remove the dead NULL check, at Derek's suggestion.

base-commit: 50897c955902c93ae71c38698abb910525ebdc89
--
2.39.5

[PATCH v2 1/2] HID: lenovo-go: reject non-USB transports in probe

[Louis Clinckx]

These drivers only match HID_USB_DEVICE() entries and assume the
underlying bus is USB. Make that explicit at probe by rejecting any
non-USB hdev, following the pattern used by other HID drivers.

Signed-off-by: Louis Clinckx <clinckx.louis@gmail.com>
---
 drivers/hid/hid-lenovo-go-s.c | 3 +++
 drivers/hid/hid-lenovo-go.c   | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/drivers/hid/hid-lenovo-go-s.c b/drivers/hid/hid-lenovo-go-s.c
index 01c7bdd4f..abf477e68 100644
--- a/drivers/hid/hid-lenovo-go-s.c
+++ b/drivers/hid/hid-lenovo-go-s.c
@@ -1432,6 +1432,9 @@ static int hid_gos_probe(struct hid_device *hdev,
 {
 	int ret, ep;
 
+	if (!hid_is_usb(hdev))
+		return -EINVAL;
+
 	ret = hid_parse(hdev);
 	if (ret) {
 		hid_err(hdev, "Parse failed\n");
diff --git a/drivers/hid/hid-lenovo-go.c b/drivers/hid/hid-lenovo-go.c
index d4d26c783..3fa1fe83f 100644
--- a/drivers/hid/hid-lenovo-go.c
+++ b/drivers/hid/hid-lenovo-go.c
@@ -2419,6 +2419,9 @@ static int hid_go_probe(struct hid_device *hdev, const struct hid_device_id *id)
 {
 	int ret, ep;
 
+	if (!hid_is_usb(hdev))
+		return -EINVAL;
+
 	hdev->quirks |= HID_QUIRK_INPUT_PER_APP | HID_QUIRK_MULTI_INPUT;
 
 	ret = hid_parse(hdev);
-- 
2.39.5

[PATCH v2 2/2] HID: lenovo-go: drop dead NULL check on to_usb_interface()

[Louis Clinckx]

to_usb_interface() is a container_of_const() macro: it performs
pointer arithmetic and never returns NULL. The if (!intf) and if
(intf) tests in get_endpoint_address() can never fire. Remove them
in both drivers.

No functional change.

Suggested-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Louis Clinckx <clinckx.louis@gmail.com>
---
 drivers/hid/hid-lenovo-go-s.c | 8 +++-----
 drivers/hid/hid-lenovo-go.c   | 3 ---
 2 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/drivers/hid/hid-lenovo-go-s.c b/drivers/hid/hid-lenovo-go-s.c
index abf477e68..f44aeb2c1 100644
--- a/drivers/hid/hid-lenovo-go-s.c
+++ b/drivers/hid/hid-lenovo-go-s.c
@@ -382,11 +382,9 @@ static int get_endpoint_address(struct hid_device *hdev)
 	struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
 	struct usb_host_endpoint *ep;
 
-	if (intf) {
-		ep = intf->cur_altsetting->endpoint;
-		if (ep)
-			return ep->desc.bEndpointAddress;
-	}
+	ep = intf->cur_altsetting->endpoint;
+	if (ep)
+		return ep->desc.bEndpointAddress;
 
 	return -ENODEV;
 }
diff --git a/drivers/hid/hid-lenovo-go.c b/drivers/hid/hid-lenovo-go.c
index 3fa1fe83f..e0c9d5ec9 100644
--- a/drivers/hid/hid-lenovo-go.c
+++ b/drivers/hid/hid-lenovo-go.c
@@ -641,9 +641,6 @@ static int get_endpoint_address(struct hid_device *hdev)
 	struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
 	struct usb_host_endpoint *ep;
 
-	if (!intf)
-		return -ENODEV;
-
 	ep = intf->cur_altsetting->endpoint;
 	if (!ep)
 		return -ENODEV;
-- 
2.39.5

Re: [PATCH v2 0/2] HID: lenovo-go: clean up USB assumption

[Derek J. Clark]

On May 15, 2026 7:57:38 AM PDT, Louis Clinckx <clinckx.louis@gmail.com> wrote:
>These drivers' id_tables only match HID_USB_DEVICE() entries and the
>code freely assumes a USB transport (to_usb_interface() on hdev->dev.parent,
>endpoint access in raw_event). Make the assumption explicit at probe and
>drop a NULL check that the compiler-level definition of to_usb_interface()
>makes unreachable.
>
>No functional change for the supported (USB) devices.
>
>Louis Clinckx (2):
>  HID: lenovo-go: reject non-USB transports in probe
>  HID: lenovo-go: drop dead NULL check on to_usb_interface()
>
> drivers/hid/hid-lenovo-go-s.c | 11 ++++++-----
> drivers/hid/hid-lenovo-go.c   |  6 +++---
> 2 files changed, 9 insertions(+), 8 deletions(-)
>
>---
>Changes since v1:
> - Resubmitted on linux-input as a quality fix per Benjamin's review of v1
>   (sent to security@kernel.org; the HID_USB_DEVICE() id_table already
>    filters BUS_USB, so no exploitable path).
> - Added patch 2 to remove the dead NULL check, at Derek's suggestion.
>
>base-commit: 50897c955902c93ae71c38698abb910525ebdc89
>--
>2.39.5
>

Thanks for the quick turnaround on this. I've already tested these changes, so for the series:
Reviewed-by: Derek J. Clark <derekjoh.clark@gmail.com>
Tested-by: Derek J. Clark <derekjohn.clark@gmail.com>

Thanks,
Derek