Lee Jones af1a9b65eb HID: core: Fix OOB read in hid_get_report for numbered reports ...

When a caller passes a size of 0 to hid_report_raw_event() for a
numbered report, the function originally called hid_get_report() before
performing any size validation.

Inside hid_get_report(), if the report is numbered (report_enum->numbered
is true), it unconditionally dereferences data[0] to extract the report ID.
With a size of 0, this results in an out-of-bounds read or kernel panic.

Fix this by moving the numbered report size validation check before the
call to hid_get_report(), ensuring that size is at least 1 before
dereferencing the data pointer.

Fixes: 2c85c61d13 ("HID: pass the buffer size to hid_report_raw_event")
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>

2026-06-29 11:10:23 +02:00

..

amd-sfh-hid

Merge branch 'for-7.1/core-v2' into for-linus

2026-04-16 21:01:18 +02:00

bpf

HID: bpf: Add Huion Inspiroy Frego M button quirk

2026-05-21 17:31:14 +02:00

i2c-hid

HID: i2c-hid-of: Use named initializers for struct i2c_device_id

2026-06-01 18:26:14 +02:00

intel-ish-hid

Merge tag 'hid-for-linus-2026030601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

2026-03-06 10:00:58 -08:00

intel-thc-hid

HID: intel-thc-hid: intel-quickspi: reset touch IC on system resume

2026-06-10 22:07:19 +02:00

surface-hid

HID: intel-thc: fix CONFIG_HID dependency

2025-02-03 10:56:43 +01:00

usbhid

Merge branch 'for-7.2/core' into for-linus

2026-06-16 21:57:57 +02:00

.kunitconfig

HID: input: map battery system charging

2022-12-20 15:30:35 +01:00

hid-a4tech.c

HID: add missing MODULE_DESCRIPTION() macros

2024-06-06 10:52:48 +02:00

hid-accutouch.c

…

hid-alps.c

HID: alps: fix NULL pointer dereference in alps_raw_event()

2026-04-09 17:37:39 +02:00

hid-apple.c

Merge branch 'for-7.1/core-v2' into for-linus

2026-04-16 21:01:18 +02:00

hid-appleir.c

HID: appleir: fix UAF on pending key_up_timer in remove()

2026-06-29 10:44:12 +02:00

hid-appletb-bl.c

HID: hid-appletb-bl: fix incorrect error message for default brightness

2025-02-18 22:01:54 +01:00

hid-appletb-kbd.c

HID: appletb-kbd: run inactivity autodim from workqueues

2026-05-12 17:57:35 +02:00

hid-asus.c

Merge branch 'for-7.1/asus' into for-linus

2026-04-16 21:11:19 +02:00

hid-aureal.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-axff.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-belkin.c

HID: hid-belkin: clean up usage of 'driver_data'

2026-06-01 18:28:41 +02:00

hid-betopff.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-bigbenff.c

HID: bigbenff: constify fixed up report descriptor

2024-09-05 16:20:56 +02:00

hid-cherry.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-chicony.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-cmedia.c

Merge tag 'hid-for-linus-2026030601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

2026-03-06 10:00:58 -08:00

hid-core.c

HID: core: Fix OOB read in hid_get_report for numbered reports

2026-06-29 11:10:23 +02:00

hid-corsair-void.c

HID: corsair-void: Use %pe for printing PTR_ERR

2025-11-18 18:03:48 +01:00

hid-corsair.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-cougar.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-cp2112.c

HID: cp2112: Configure I2C bus speed from firmware

2026-06-10 17:34:39 +02:00

hid-creative-sb0540.c

HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them

2026-02-19 18:58:39 +01:00

hid-cypress.c

HID: hid-cypress: clean up usage of 'driver_data'

2026-06-01 18:28:41 +02:00

hid-debug.c

Merge branch 'for-7.1/core-v2' into for-linus

2026-04-16 21:01:18 +02:00

hid-dr.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-elan.c

HID: elan: Add support for ELAN SB974D touchpad

2026-04-28 18:30:02 +02:00

hid-elecom.c

HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK

2026-01-23 13:53:25 +01:00

hid-elo.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-emsff.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-evision.c

HID: evision: Fix Report Descriptor for Evision Wireless Receiver 320f:226f

2025-11-26 17:17:53 +01:00

hid-ezkey.c

HID: add missing MODULE_DESCRIPTION() macros

2024-06-06 10:52:48 +02:00

hid-ft260.c

HID: ft260: validate i2c input report length

2026-04-28 18:24:52 +02:00

hid-gaff.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-gembird.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-generic.c

drivers: hid: renegotiate resolution multipliers with device after reset

2025-11-26 17:21:48 +01:00

hid-gfrm.c

HID: hid-gfrm: clean up usage of 'driver_data'

2026-06-01 18:28:41 +02:00

hid-glorious.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-goodix-spi.c

HID: hid-goodix-spi: validate report size to prevent stack buffer overflow

2026-06-10 18:34:56 +02:00

hid-google-hammer.c

HID: google: hammer: stop hardware on devres action failure

2026-05-12 18:01:05 +02:00

hid-google-stadiaff.c

HID: add missing MODULE_DESCRIPTION() macros

2024-06-06 10:52:48 +02:00

hid-gt683r.c

HID: gt683r: add missing MODULE_DEVICE_TABLE

2021-05-27 15:40:34 +02:00

hid-gyration.c

HID: add missing MODULE_DESCRIPTION() macros

2024-06-06 10:52:48 +02:00

hid-haptic.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

hid-haptic.h

HID: multitouch: add haptic multitouch support

2025-09-15 14:32:55 +02:00

hid-holtek-kbd.c

HID: holtek-kbd: constify fixed up report descriptor

2024-09-05 16:20:56 +02:00

hid-holtek-mouse.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-holtekff.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-huawei.c

HID: huawei: fix CD30 keyboard report descriptor issue

2026-04-09 17:56:46 +02:00

hid-hyperv.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-icade.c

…

hid-ids.h

Merge branch 'for-7.2/core' into for-linus

2026-06-16 21:57:57 +02:00

hid-input-test.c

HID: input: Introduce struct hid_battery and refactor battery code

2026-03-19 15:52:45 +01:00

hid-input.c

Merge branch 'for-7.2/core' into for-linus

2026-06-16 21:57:57 +02:00

hid-ite.c

HID: hid-ite: clean up usage of 'driver_data'

2026-06-01 18:28:41 +02:00

hid-jabra.c

…

hid-kensington.c

HID: Fix spelling mistakes "Kensigton" -> "Kensington"

2024-07-12 18:28:03 +02:00

hid-keytouch.c

HID: keytouch: constify fixed up report descriptor

2024-09-05 16:20:56 +02:00

hid-kye.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

hid-kysona.c

HID: Kysona: Add support for VXE Dragonfly R1 Pro

2026-03-27 15:51:05 +01:00

hid-lcpower.c

HID: add more missing MODULE_DESCRIPTION() macros

2024-07-10 09:11:27 +02:00

hid-led.c

HID: hid-led: fix maximum brightness for Dream Cheeky

2022-04-21 10:28:49 +02:00

hid-lenovo-go-s.c

HID: lenovo-go: drop dead NULL check on to_usb_interface()

2026-05-21 17:12:54 +02:00

hid-lenovo-go.c

HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()

2026-06-03 14:18:18 +02:00

hid-lenovo.c

HID: lenovo: Use KEY_PERFORMANCE capability for ThinkPad X12 Tab Gen 2

2026-06-10 17:38:39 +02:00

hid-letsketch.c

HID: letsketch: fix UAF on inrange_timer at driver unbind

2026-06-29 10:43:23 +02:00

hid-lg2ff.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-lg3ff.c

HID: hid-lg3ff: remove unused struct lg3ff_device

2024-02-13 11:43:55 +01:00

hid-lg4ff.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-lg4ff.h

…

hid-lg-g15.c

HID: hid-lg-g15: Add hw_brightness_changed support for the G510 keyboard

2025-10-14 11:50:25 +02:00

hid-lg.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-lg.h

…

hid-lgff.c

…

hid-logitech-dj.c

Merge branch 'for-7.1/core-v2' into for-linus

2026-04-16 21:01:18 +02:00

hid-logitech-hidpp.c

Merge branch 'for-7.2/logitech' into for-linus

2026-06-16 21:52:56 +02:00

hid-macally.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-magicmouse.c

HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID

2026-05-12 17:49:18 +02:00

hid-maltron.c

HID: maltron: constify fixed up report descriptor

2024-09-05 16:20:56 +02:00

hid-mcp2200.c

treewide: rename GPIO set callbacks back to their original names

2025-08-07 10:07:06 +02:00

hid-mcp2221.c

HID: mcp2221: fix OOB write in mcp2221_raw_event()

2026-05-12 17:48:16 +02:00

hid-megaworld.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-mf.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-microsoft.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-monterey.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-multitouch.c

Merge branch 'for-7.2/multitouch' into for-linus

2026-06-16 21:52:21 +02:00

hid-nintendo.c

Merge tag 'hid-for-linus-2026061601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

2026-06-18 14:20:39 -07:00

hid-nti.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-ntrig.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-nvidia-shield.c

treewide: Switch/rename to timer_delete[_sync]()

2025-04-05 10:30:12 +02:00

hid-ortek.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-oxp.c

HID: hid-oxp: Add Vibration Intensity Attribute

2026-05-12 17:55:57 +02:00

hid-penmount.c

…

hid-petalynx.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-picolcd_backlight.c

HID: picoLCD: Use backlight power constants

2024-09-05 10:55:15 +02:00

hid-picolcd_cir.c

media: rc: fix race between unregister and urb/irq callbacks

2026-03-17 14:43:56 +01:00

hid-picolcd_core.c

HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()

2026-06-29 10:46:13 +02:00

hid-picolcd_debugfs.c

kernel.h: drop hex.h and update all hex.h users

2026-01-20 19:44:19 -08:00

hid-picolcd_fb.c

Merge tag 'backlight-next-6.13' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight

2024-11-22 16:29:57 -08:00

hid-picolcd_lcd.c

HID: picoLCD: Replace check_fb in favor of struct fb_info.lcd_dev

2024-09-30 16:49:42 +01:00

hid-picolcd_leds.c

…

hid-picolcd.h

…

hid-pl.c

HID: pl: eliminate private debug macro

2026-03-12 14:20:57 +01:00

hid-plantronics.c

HID: hid-plantronics: Add mic mute mapping and generalize quirks

2025-02-03 11:09:05 +01:00

hid-playstation.c

Merge branch 'for-7.2/playstation' into for-linus

2026-06-16 21:50:20 +02:00

hid-primax.c

HID: pass the buffer size to hid_report_raw_event

2026-05-12 18:03:37 +02:00

hid-prodikeys.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-pxrc.c

HID: pxrc: constify fixed up report descriptor

2024-09-05 16:20:57 +02:00

hid-quirks.c

HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse

2026-05-21 16:51:30 +02:00

hid-rakk.c

HID: rakk: add support for Rakk Dasig X side buttons

2026-05-12 17:28:52 +02:00

hid-rapoo.c

HID: rapoo: Add support for side buttons on RAPOO 0x2015 mouse

2026-01-10 09:52:37 +01:00

hid-razer.c

HID: add missing MODULE_DESCRIPTION() macros

2024-06-06 10:52:48 +02:00

hid-redragon.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-retrode.c

HID: add missing MODULE_DESCRIPTION() macros

2024-06-06 10:52:48 +02:00

hid-rmi.c

HID: rmi: remove #ifdef CONFIG_PM

2023-10-25 18:33:42 +02:00

hid-roccat-arvo.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-roccat-arvo.h

…

hid-roccat-common.c

…

hid-roccat-common.h

sysfs: treewide: switch back to bin_attribute::read()/write()

2025-06-17 10:44:13 +02:00

hid-roccat-isku.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-roccat-isku.h

…

hid-roccat-kone.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-roccat-kone.h

HID: roccat: Use struct_group() to zero kone_mouse_event

2021-09-25 08:20:48 -07:00

hid-roccat-koneplus.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-roccat-koneplus.h

…

hid-roccat-konepure.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-roccat-kovaplus.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-roccat-kovaplus.h

…

hid-roccat-lua.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-roccat-lua.h

…

hid-roccat-pyra.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-roccat-pyra.h

…

hid-roccat-ryos.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-roccat-savu.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-roccat-savu.h

…

hid-roccat.c

Merge branch 'for-7.1/core-v2' into for-linus

2026-04-16 21:01:18 +02:00

hid-saitek.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-samsung.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-semitek.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-sensor-custom.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-sensor-hub.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

hid-sigmamicro.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-sjoy.c

HID: hid-sjoy: race between init and usage

2026-05-12 17:23:08 +02:00

hid-sony.c

Merge branch 'for-7.2/sony' into for-linus

2026-06-16 21:49:20 +02:00

hid-speedlink.c

HID: add missing MODULE_DESCRIPTION() macros

2024-06-06 10:52:48 +02:00

hid-steam.c

HID: hid-steam: Use new BTN_GRIP* buttons

2025-08-06 10:02:28 -07:00

hid-steelseries.c

HID: steelseries: Fix STEELSERIES_SRWS1 handling in steelseries_remove()

2025-09-12 16:27:35 +02:00

hid-sunplus.c

HID: change return type of report_fixup() to const

2024-08-27 16:29:55 +02:00

hid-thrustmaster.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-tivo.c

HID: add missing MODULE_DESCRIPTION() macros

2024-06-06 10:52:48 +02:00

hid-tmff.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-topre.c

HID: topre: Fix n-key rollover on Realforce R3S TKL boards

2025-02-03 22:59:42 +01:00

hid-topseed.c

HID: add missing MODULE_DESCRIPTION() macros

2024-06-06 10:52:48 +02:00

hid-twinhan.c

HID: add missing MODULE_DESCRIPTION() macros

2024-06-06 10:52:48 +02:00

hid-u2fzero.c

HID: u2fzero: free allocated URB on probe errors

2026-05-21 15:47:17 +02:00

hid-uclogic-core-test.c

HID: uclogic: Fix a work->entry not empty bug in __queue_work()

2023-10-25 16:25:47 +02:00

hid-uclogic-core.c

HID: uclogic: Fix regression of input name assignment

2026-04-28 18:37:01 +02:00

hid-uclogic-params-test.c

HID: uclogic: Fix user-memory-access bug in uclogic_params_ugee_v2_init_event_hooks()

2023-10-25 16:25:47 +02:00

hid-uclogic-params.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-uclogic-params.h

HID: uclogic: Add support for the XP-PEN Artist 24 Pro

2025-10-14 12:01:34 +02:00

hid-uclogic-rdesc-test.c

module: Convert symbol namespace to string literal

2024-12-02 11:34:44 -08:00

hid-uclogic-rdesc.c

HID: uclogic: Add support for the XP-PEN Artist 24 Pro

2025-10-14 12:01:34 +02:00

hid-uclogic-rdesc.h

HID: uclogic: Add support for the XP-PEN Artist 24 Pro

2025-10-14 12:01:34 +02:00

hid-udraw-ps3.c

…

hid-universal-pidff.c

HID: universal-pidff: clang-format pass

2025-08-15 15:58:10 +02:00

hid-viewsonic.c

HID: viewsonic: constify fixed up report descriptor

2024-09-05 16:20:57 +02:00

hid-vivaldi-common.c

HID: pass the buffer size to hid_report_raw_event

2026-05-12 18:03:37 +02:00

hid-vivaldi-common.h

HID: vivaldi: convert to use dev_groups

2022-08-25 11:37:21 +02:00

hid-vivaldi.c

HID: vivaldi: convert to use dev_groups

2022-08-25 11:37:21 +02:00

hid-vrc2.c

HID: vrc2: constify fixed up report descriptor

2024-09-05 16:20:57 +02:00

hid-waltop.c

HID: waltop: constify fixed up report descriptor

2024-09-05 16:20:57 +02:00

hid-wiimote-core.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-wiimote-debug.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-wiimote-modules.c

HID: wiimote: Fix table layout and whitespace errors

2026-06-01 18:25:08 +02:00

hid-wiimote.h

HID: wiimote: Add support for the DJ Hero turntable

2022-11-04 09:57:16 +01:00

hid-winwing.c

HID: winwing: Enable rumble effects

2026-04-09 18:09:15 +02:00

hid-xiaomi.c

HID: xiaomi: constify fixed up report descriptor

2024-09-05 16:20:57 +02:00

hid-xinmo.c

HID: add missing MODULE_DESCRIPTION() macros

2024-06-06 10:52:48 +02:00

hid-zpff.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hid-zydacron.c

HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them

2026-02-19 18:58:39 +01:00

hidraw.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

Kconfig

Merge branch 'for-7.2/oxp' into for-linus

2026-06-16 21:50:58 +02:00

Makefile

Merge branch 'for-7.2/oxp' into for-linus

2026-06-16 21:50:58 +02:00

uhid.c

HID: uhid: convert to hid_safe_input_report()

2026-06-10 20:32:07 +02:00

wacom_sys.c

HID: wacom: stop hardware after post-start probe failures

2026-06-10 17:48:55 +02:00

wacom_wac.c

HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

2026-03-09 19:34:12 +01:00

wacom_wac.h

HID: wacom: Fix OOB write in wacom_hid_set_device_mode()

2026-05-28 17:43:16 +02:00

wacom.h

HID: wacom: Improve behavior of non-standard LED brightness values

2025-01-09 09:58:28 +01:00