]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
HID: pass the buffer size to hid_report_raw_event
authorBenjamin Tissoires <bentiss@kernel.org>
Mon, 4 May 2026 08:47:22 +0000 (10:47 +0200)
committerJiri Kosina <jkosina@suse.com>
Tue, 12 May 2026 16:03:37 +0000 (18:03 +0200)
commit2c85c61d1332e1e16f020d76951baf167dcb6f7a
treee0d6bc40e0c36922e10bc72e2af8d1a136af1c4c
parentb08665fe80fab0956e64741c07d9bbcec635c34d
HID: pass the buffer size to hid_report_raw_event

commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
bogus memset()") enforced the provided data to be at least the size of
the declared buffer in the report descriptor to prevent a buffer
overflow. However, we can try to be smarter by providing both the buffer
size and the data size, meaning that hid_report_raw_event() can make
better decision whether we should plaining reject the buffer (buffer
overflow attempt) or if we can safely memset it to 0 and pass it to the
rest of the stack.

Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Acked-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
drivers/hid/bpf/hid_bpf_dispatch.c
drivers/hid/hid-core.c
drivers/hid/hid-gfrm.c
drivers/hid/hid-logitech-hidpp.c
drivers/hid/hid-multitouch.c
drivers/hid/hid-primax.c
drivers/hid/hid-vivaldi-common.c
drivers/hid/wacom_sys.c
drivers/staging/greybus/hid.c
include/linux/hid.h
include/linux/hid_bpf.h