From: Benjamin Tissoires Date: Fri, 10 Apr 2026 14:03:07 +0000 (+0200) Subject: HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8b9a097eb2fc37b486afd81388c693bf3ab44466;p=thirdparty%2Fkernel%2Flinux.git HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report commit b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write") assumed that all HID devices attached to the logitech-dj driver was having an output report of DJ_SHORT. However, on the receiver itself, we have 2 other HID device we attach here: the mouse emulation and the keyboard emulation. For those devices the value of rep is NULL and we are triggered a segfault here. This is doubly required because logitech-dj also handles non DJ devices that might not have the DJ collection. Fixes: b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write") Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina --- diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c index 838c6de9a921c..695d3031009e1 100644 --- a/drivers/hid/hid-logitech-dj.c +++ b/drivers/hid/hid-logitech-dj.c @@ -1907,7 +1907,8 @@ static int logi_dj_probe(struct hid_device *hdev, output_report_enum = &hdev->report_enum[HID_OUTPUT_REPORT]; rep = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT]; - if (rep->maxfield < 1 || rep->field[0]->report_count != DJREPORT_SHORT_LENGTH - 1) { + if (rep && (rep->maxfield < 1 || + rep->field[0]->report_count != DJREPORT_SHORT_LENGTH - 1)) { hid_err(hdev, "Expected size of DJ short report is %d, but got %d", DJREPORT_SHORT_LENGTH - 1, rep->field[0]->report_count); return -EINVAL;