From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 20AAE35BDD5 for ; Fri, 9 Jan 2026 12:41:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767962482; cv=none; b=VRFIprJKNxIJjRAWQA0lp/bC3mF2J2kKPBnxWrHS/9YuPnfqp9pcamN4qql1BXJ30Y2x0Z6O0DzNVUqwqUI+5ZGcXbdD6AMO2bA9LdIMBroEYySjXUfrPkuesmFaUioRlAhYNPqaWXmmf2n1wOZI88HTuaRo8k+3AN5qyoxJa1w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767962482; c=relaxed/simple; bh=eVOmJOpJ2g+nWNAxnyfdx6FM/mb3Dw1vCRyIVPH1Rag=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=egr6jnywY8D0zBE3q/vge3y82IRwBZqKlBzKjY8nA8iaPCnrEEUyqemXNZuSTYZklsyc9GW2ydtxCRc6E1CBH93COI4b6UwLakp250TJTvMssjvZ+0opqnCUJST4V3sjoNEfSN0gEFyfBds5ByH5xjHNZkuiZYQC49r5IXvFtiM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=qceN1F1h; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="qceN1F1h" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4775e891b5eso20061145e9.2 for ; Fri, 09 Jan 2026 04:41:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1767962479; x=1768567279; darn=vger.kernel.org; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date:from:to :cc:subject:date:message-id:reply-to; bh=OS8jAYKJTxd436S6Hg/z7BMXyNGFTQawvHyOajW7Mkc=; b=qceN1F1hDJPqJY5F4gHMRVmzOfN1y/WpGRpK6mEmPASh3hwTbM0Rc/HDpEHpuXV8Ce Sk4JjfTw9uAavOrlTNDhYr/OI7NG1QjaAUK6o5oC4P1dsAZYidhFXpFEOS8dxTOdxFph LSV7m/jXVZLHKSk8Rd9TQXGw1bWcZZ494gBpWIL1CT5Jp9NcDjIQUNKCc9MSD9TzK5ue BE+yGaT4mMa/B+kEEyhgmVRWi/weAoghJWqDqIsJaVTCFK8pgBbF0rx+eX0CBgG5Rbyq ZPhehTfc7tYvK70bXzP6K0WjVOuqP/8yLrviqIotqX9pKoZ5i+U51i6gwgSgqm75oF/Z /S8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767962479; x=1768567279; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=OS8jAYKJTxd436S6Hg/z7BMXyNGFTQawvHyOajW7Mkc=; b=juwzdvKnZKOLx4wu/iIvvmEf0QKM2VQpWBl8PzYB953G2j0N84uLNxyygwr6HDtvAE dSDdnn5HFikEhbF7EYV1MZ6H8dU9J898r5ZQ1pODt4cyGhJtvZyt53l2AhOCOx4ppguZ VI+/eYQAoC3kygAEOzG9kCwvvPFTvyMWSs40xeYvnqlbcwvlS/1zlvPQlrjZznbL6wUy 1IPfF+VlY/oNAu/nhw2lxJIJWvuQMtva1c1XEX+KXV+0Jr/vovs5lpY+eI9NqPcpuykz hYa9W4ouIH+jGQNbHd+M6RQS4/NheTyBT8S80GIfKRp8qZqg0OszbxF2d6L1wqs6LU6Y WVdw== X-Forwarded-Encrypted: i=1; AJvYcCU8vXrCbQjWLBodu5O1oCW3ccOHiHAET0VfmwxilqLrzEjLOX+NVD5XnG9hiUT/wj9uirS6YnxRcmwnx7Q=@vger.kernel.org X-Gm-Message-State: AOJu0YzRbFNKD6/CevBSD/0RymlcxLBxOeLWTi6KdGk9k3K7ven3MLM6 SQSYT6IIAQG5k+qMdbrSQCyYqnmftuw7As7b4O5jX+//4qBZJBWq1aQoL1BmnBA5Gw== X-Gm-Gg: AY/fxX5+TBoV1DXHDGwFjk5sLbOFpWEl8uCT0hJtu2Q5mM8I0+Jh9IBHsSqglxdqenl QSYoLS2D24JXjXFRv2yAaF6eK1T06NS9/ypwFOqds8VqkKNunXi5T0WGd0CzsD592PYYHvD7Upu bmpqKDnfbo6EBGTRXp2BbzoGFCIoCEjLlcTTN4GTsG2b3H+y98ZaMK3TidlDWreIhdRWGfXC1Hl aXQsJ/lksn2bP0MbgXo8OLuxRzu3RmhYMCI9fHWbm6fhkVRvLdFgd3rLBsMFiM61KucZIW/GdSv vxD2n8DVWWEzUVTVBsU0GlaqyzxskU3nCTB7nxNWvEkoMCHO/kHVoVFU34b8lLSJHO514ZsE1E0 Y6v+hbV9Q3+h9D+aWQNplRMeOMF2kYfa5vKsWVpK24+uR14HefMdyhlILmyCheReEoZLqTIgAnM oPrxoQsYn2kI2eJ+MfBjxd5etFSmgC6Ual67vKVisMwg== X-Google-Smtp-Source: AGHT+IEs1pOpkW+f39F/DRqpNCXzF0cymX5J81DrZywu+onED4ZE4gRGm1Y2kkOMoDNFz55txwy6qg== X-Received: by 2002:a05:600c:b86:b0:479:3a86:dc1e with SMTP id 5b1f17b1804b1-47d84b41007mr111442295e9.36.1767962479268; Fri, 09 Jan 2026 04:41:19 -0800 (PST) Received: from google.com ([2a00:79e0:288a:8:b844:1270:724f:f3aa]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-47d7f418538sm205252975e9.5.2026.01.09.04.41.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 09 Jan 2026 04:41:18 -0800 (PST) Date: Fri, 9 Jan 2026 13:41:13 +0100 From: =?utf-8?Q?G=C3=BCnther?= Noack To: Greg KH Cc: Filipe =?utf-8?B?TGHDrW5z?= , Bastien Nocera , Jiri Kosina , Benjamin Tissoires , stable@vger.kernel.org, linux-input@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() Message-ID: References: <20260109105912.3141960-2-gnoack@google.com> <2026010956-anteater-pungent-d5b6@gregkh> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <2026010956-anteater-pungent-d5b6@gregkh> On Fri, Jan 09, 2026 at 12:14:43PM +0100, Greg KH wrote: > On Fri, Jan 09, 2026 at 11:59:12AM +0100, Günther Noack wrote: > > Do not crash when a report has no fields. > > > > Fake USB gadgets can send their own HID report descriptors and can define report > > structures without valid fields. This can be used to crash the kernel over USB. > > > > Cc: stable@vger.kernel.org > > Signed-off-by: Günther Noack > > --- > > drivers/hid/hid-logitech-hidpp.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c > > index 9ced0e4d46ae..919ba9f50292 100644 > > --- a/drivers/hid/hid-logitech-hidpp.c > > +++ b/drivers/hid/hid-logitech-hidpp.c > > @@ -4316,6 +4316,9 @@ static int hidpp_get_report_length(struct hid_device *hdev, int id) > > if (!report) > > return 0; > > > > + if (!report->maxfield) > > + return 0; > > Combine this with the if() above this? OK, done. I sent a V2: https://lore.kernel.org/all/20260109122557.3166556-3-gnoack@google.com/ > And if we are going to be handling "malicious" USB devices, be careful, > you are just moving the target lower down, you also need to audit ALL > data coming from the device, not just the descriptors. I'm all for > this, just realize that this is a change in how Linux treats devices > (and all other operating systems as well.) Thanks. Yes, I realize that the later communication with the device is also a potential way to trigger bugs. > For now, we strongly recommend not allowing "untrusted" devices to bind > to your system if this is a threat model you care about. > > Not to reject this, or your other patch like this, just letting you > know. Acknowledged, thanks. -Günther