[PATCH] HID: logitech-hidpp: fix slab-out-of-bounds write in HIDPP_FF_DESTROY_EFFECT

[PATCH] HID: logitech-hidpp: fix slab-out-of-bounds write in HIDPP_FF_DESTROY_EFFECT

[Jinmo Yang]

Add a missing bounds check in hidpp_ff_work_handler() for the
HIDPP_FF_DESTROY_EFFECT case.

When erasing a force-feedback effect that was never uploaded,
hidpp_ff_find_effect() returns 0 and this value is stored in
wd->params[0].  The handler then computes effect_ids[params[0] - 1],
i.e. effect_ids[-1], which is a slab-out-of-bounds write of -1.

The symmetric HIDPP_FF_DOWNLOAD_EFFECT case already guards the access
with `slot > 0 && slot <= data->num_effects`.  Apply the same bounds
check to HIDPP_FF_DESTROY_EFFECT.

KASAN report (on 7.0.5 with raw-gadget G920 emulation):

  BUG: KASAN: slab-out-of-bounds in hidpp_ff_work_handler+0x980/0x9d0
  Write of size 4 at addr ffff888003013afc by task kworker/u8:0/12

  The buggy address belongs to the object at ffff888003013ae0
   which belongs to the cache kmalloc-16 of size 16
  The buggy address is located 12 bytes to the right of
   allocated 16-byte region [ffff888003013ae0, ffff888003013af0)

Fixes: ff21a635dd1a ("HID: logitech-hidpp: Force feedback support for the Logitech G920")
Cc: stable@vger.kernel.org
Signed-off-by: Jinmo Yang <jinmo44.yang@gmail.com>
---
 drivers/hid/hid-logitech-hidpp.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -2525,12 +2525,14 @@
 		}
 		break;
 	case HIDPP_FF_DESTROY_EFFECT:
-		if (wd->effect_id >= 0)
-			/* regular effect destroyed */
-			data->effect_ids[wd->params[0]-1] = -1;
-		else if (wd->effect_id >= HIDPP_FF_EFFECTID_AUTOCENTER)
-			/* autocenter spring destoyed */
+		if (wd->effect_id >= 0) {
+			u8 slot = wd->params[0];
+
+			if (slot > 0 && slot <= data->num_effects)
+				data->effect_ids[slot - 1] = -1;
+		} else if (wd->effect_id >= HIDPP_FF_EFFECTID_AUTOCENTER) {
 			data->slot_autocenter = 0;
+		}
 		break;
 	case HIDPP_FF_SET_GLOBAL_GAINS:
 		data->gain = (wd->params[0] << 8) + wd->params[1];
--
2.39.2

Re: [PATCH] HID: logitech-hidpp: fix slab-out-of-bounds write in HIDPP_FF_DESTROY_EFFECT

[Greg KH]

On Sun, May 10, 2026 at 10:31:18PM +0900, Jinmo Yang wrote:
> Add a missing bounds check in hidpp_ff_work_handler() for the
> HIDPP_FF_DESTROY_EFFECT case.

As you sent this to a public list, there is no need to cc: the security
list.

Also, what about the patch series that was recently sent to the HID list
for adding bounds checking to some of the apis?  Is your patch still
needed with that series applied?

thanks,

greg k-h