kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/hid
History
HyeongJun An 1215febd64 HID: logitech-dj: Fix maxfield check in DJ short report validation 
commit 590cc4d782 upstream.

Commit b6a5791285 ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT
related user initiated OOB write") added validation for the DJ short
output report, but the error path dereferences rep->field[0] even when
rep->maxfield is zero.

Commit 8b9a097eb2 ("HID: logitech-dj: fix wrong detection of bad
DJ_SHORT output report") made the check conditional on rep being present,
but a crafted descriptor can still create report ID 0x20 with only padding
output items. hid-core registers the report, ignores the padding field,
and leaves rep->maxfield as zero.

In that case the validation enters the rep->maxfield < 1 branch and then
dereferences rep->field[0]->report_count while printing the error message,
causing a NULL pointer dereference during probe. This is reproducible with
uhid by emulating a Logitech receiver with a padding-only DJ short output
report:

  BUG: KASAN: null-ptr-deref in logi_dj_probe+0xb1/0x754 [hid_logitech_dj]
  Read of size 4 at addr 0000000000000028 by task kworker/4:1/129
  ...
  Call Trace:
   logi_dj_probe+0xb1/0x754 [hid_logitech_dj]
   hid_device_probe+0x329/0x3f0 [hid]
   really_probe+0x162/0x570
   __device_attach+0x137/0x2c0
   bus_probe_device+0x38/0xc0
   device_add+0xa56/0xce0
   hid_add_device+0x19c/0x280 [hid]
   uhid_device_add_worker+0x2c/0xb0 [uhid]

Reject the zero-field report before printing the field report_count.

Fixes: b6a5791285 ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-08-19 17:14:12 +02:00
..
amd-sfh-hid HID: amd_sfh: Switch to device-managed dmam_alloc_coherent() 2024-10-17 15:11:59 +02:00
i2c-hid HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up 2024-05-02 16:24:50 +02:00
intel-ish-hid HID: intel-ish-hid: Reset enum_devices_done before enumeration 2026-02-11 13:35:29 +01:00
surface-hid HID: surface-hid: Allow driver matching for target ID 1 devices 2021-11-18 19:15:59 +01:00
usbhid HID: usbhid: fix deadlock in hid_post_reset() 2026-06-01 17:35:35 +02:00
hid-a4tech.c HID: a4tech: use A4_2WHEEL_MOUSE_HACK_B8 for A4TECH NB-95 2021-05-05 14:29:13 +02:00
hid-accutouch.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-alps.c HID: alps: fix NULL pointer dereference in alps_raw_event() 2026-06-01 17:35:04 +02:00
hid-apple.c HID: apple: Add 2021 magic keyboard FN key mapping 2024-02-23 08:54:55 +01:00
hid-appleir.c HID: appleir: fix UAF on pending key_up_timer in remove() 2026-07-24 15:52:00 +02:00
hid-asus.c HID: asus: do not abort probe when not necessary 2026-06-01 17:35:34 +02:00
hid-aureal.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
hid-axff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-belkin.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-betopff.c HID: betop: check shape of output reports 2023-02-01 08:27:13 +01:00
hid-bigbenff.c hid: bigben_probe(): validate report count 2023-03-10 09:39:31 +01:00
hid-cherry.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-chicony.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-cmedia.c HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them 2026-04-18 10:33:08 +02:00
hid-core.c HID: core: Fix OOB read in hid_get_report for numbered reports 2026-07-24 15:51:43 +02:00
hid-corsair.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-cougar.c HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup 2024-09-12 11:07:49 +02:00
hid-cp2112.c hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip 2023-11-20 11:08:23 +01:00
hid-creative-sb0540.c HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them 2026-04-18 10:33:08 +02:00
hid-cypress.c HID: cypress: Support Varmilo Keyboards' media hotkeys 2020-10-23 13:23:44 +02:00
hid-debug.c HID: fix HID device resource race between HID core and debugging support 2023-12-03 07:31:22 +01:00
hid-dr.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-elan.c HID: elan: Fix potential double free in elan_input_configured 2022-06-09 10:22:47 +02:00
hid-elecom.c HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK 2026-03-04 07:20:06 -05:00
hid-elo.c HID: elo: Revert USB reference counting 2022-03-16 14:23:35 +01:00
hid-emsff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-ezkey.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-ft260.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-gaff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-gembird.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-generic.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-gfrm.c HID: pass the buffer size to hid_report_raw_event 2026-06-19 13:33:31 +02:00
hid-glorious.c HID: glorious: fix Glorious Model I HID report 2023-12-20 15:17:40 +01:00
hid-google-hammer.c HID: google: fix unused variable warning under !CONFIG_ACPI 2025-03-13 12:51:04 +01:00
hid-gt683r.c HID: gt683r: add missing MODULE_DEVICE_TABLE 2021-05-27 15:40:34 +02:00
hid-gyration.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-holtek-kbd.c HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event 2023-10-25 11:59:00 +02:00
hid-holtek-mouse.c HID: holtek: fix mouse probing 2021-12-29 12:28:37 +01:00
hid-holtekff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-hyperv.c HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() 2025-06-27 11:05:34 +01:00
hid-icade.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-ids.h HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 2026-06-01 17:35:01 +02:00
hid-input.c HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen 2026-01-19 13:09:45 +01:00
hid-ite.c HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 2022-12-14 11:37:21 +01:00
hid-jabra.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-kensington.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-keytouch.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-kye.c HID: hid-kye: Fix incorrect function name for kye_tablet_enable() 2021-04-07 18:46:20 +02:00
hid-lcpower.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-led.c HID: hid-led: fix maximum brightness for Dream Cheeky 2022-06-09 10:22:47 +02:00
hid-lenovo.c HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 2025-07-17 18:30:54 +02:00
hid-lg-g15.c HID: lg-g15: cancel pending work on remove to fix a use-after-free 2026-07-24 15:51:22 +02:00
hid-lg.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-lg.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
hid-lg2ff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-lg3ff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-lg4ff.c HID: hid-lg4ff: Add check for empty lbuf 2022-12-14 11:37:21 +01:00
hid-lg4ff.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
hid-lgff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-logitech-dj.c HID: logitech-dj: Fix maxfield check in DJ short report validation 2026-08-19 17:14:12 +02:00
hid-logitech-hidpp.c HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter 2026-07-24 15:51:37 +02:00
hid-macally.c HID: macally: Constify macally_id_table 2020-08-17 11:38:49 +02:00
hid-magicmouse.c HID: magicmouse: avoid memory leak in magicmouse_report_fixup() 2026-04-18 10:33:23 +02:00
hid-maltron.c Support for Maltron L90 keyboard media keys 2019-01-14 20:11:01 +01:00
hid-mcp2221.c HID: mcp2221: cancel last I2C command on read error 2026-04-18 10:33:23 +02:00
hid-mf.c HID: mf: add support for 0079:1846 Mayflash/Dragonrise USB Gamecube Adapter 2020-11-25 14:30:33 +01:00
hid-microsoft.c HID: microsoft: Add rumble support to latest xbox controllers 2024-09-04 13:23:36 +02:00
hid-monterey.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-multitouch.c HID: multitouch: fix out-of-bounds bit access on mt_io_flags 2026-07-24 15:52:00 +02:00
hid-nti.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-ntrig.c HID: hid-ntrig: Prevent memory leak in ntrig_report_version() 2025-12-07 06:09:29 +09:00
hid-ortek.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-penmount.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-petalynx.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-picolcd.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-picolcd_backlight.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-picolcd_cir.c media: rc: harmonize infrared durations to microseconds 2020-09-03 16:18:55 +02:00
hid-picolcd_core.c HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() 2026-07-24 15:51:43 +02:00
hid-picolcd_debugfs.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-picolcd_fb.c fbdev: Rename pagelist to pagereflist for deferred I/O 2024-02-23 08:55:13 +01:00
hid-picolcd_lcd.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-picolcd_leds.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-pl.c HID: hid-pl: handle probe errors 2026-03-04 07:20:26 -05:00
hid-plantronics.c HID: hid-plantronics: Add mic mute mapping and generalize quirks 2025-04-10 14:31:55 +02:00
hid-playstation.c HID: playstation: Add missing check for input_ff_create_memless 2026-03-04 07:19:32 -05:00
hid-primax.c HID: pass the buffer size to hid_report_raw_event 2026-06-19 13:33:31 +02:00
hid-prodikeys.c HID: prodikeys: Check presence of pm->input_ep82 2026-03-04 07:20:26 -05:00
hid-quirks.c HID: quirks: really enable the intended work around for appledisplay 2026-06-01 17:35:50 +02:00
hid-redragon.c HID: redragon: fix num lock and caps lock LEDs 2018-06-25 15:23:40 +02:00
hid-retrode.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-rmi.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2020-10-23 16:16:31 -07:00
hid-roccat-arvo.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-arvo.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-common.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-common.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-isku.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-isku.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-kone.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-kone.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-koneplus.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-koneplus.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-konepure.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-kovaplus.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-kovaplus.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-lua.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-lua.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-pyra.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-pyra.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-ryos.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-savu.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-savu.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat.c HID: roccat: fix use-after-free in roccat_report_event 2026-06-01 17:35:01 +02:00
hid-saitek.c HID: saitek: add madcatz variant of MMO7 mouse device ID 2022-11-10 18:15:34 +01:00
hid-samsung.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-semitek.c HID: semitek: new driver for GK6X series keyboards 2021-05-05 14:21:08 +02:00
hid-sensor-custom.c HID: hid-sensor-custom: set fixed size for custom attributes 2022-12-31 13:14:11 +01:00
hid-sensor-hub.c HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads 2026-07-24 15:51:22 +02:00
hid-sjoy.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
hid-sony.c HID: sony: remove duplicate NULL check before calling usb_free_urb() 2023-10-10 21:59:08 +02:00
hid-speedlink.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-steam.c HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report 2022-09-05 10:30:06 +02:00
hid-steelseries.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-sunplus.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-thrustmaster.c HID: thrustmaster: Add sparco wheel and fix array length 2022-09-05 10:30:08 +02:00
hid-tivo.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-tmff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-topseed.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-twinhan.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 178 2019-05-30 11:29:19 -07:00
hid-u2fzero.c HID: add hid_is_usb() function to make it simpler for USB detection 2021-12-14 10:57:05 +01:00
hid-uclogic-core.c HID: uclogic: Add NULL check in uclogic_input_configured() 2026-02-06 16:42:05 +01:00
hid-uclogic-params.c HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad 2022-01-27 11:03:55 +01:00
hid-uclogic-params.h HID: uclogic: Support Gray-coded rotary encoders 2019-02-21 12:00:54 +01:00
hid-uclogic-rdesc.c HID: hid-uclogic-rdesc: Kernel-doc is for functions and structs 2021-04-07 18:46:20 +02:00
hid-uclogic-rdesc.h HID: uclogic: Add support for Ugee G5 2019-02-21 12:00:54 +01:00
hid-udraw-ps3.c HID: udraw-ps3: Replace HTTP links with HTTPS ones 2020-07-20 12:24:41 +02:00
hid-viewsonic.c HID: viewsonic: Support PD1011 signature pad 2019-02-21 12:00:53 +01:00
hid-vivaldi.c HID: pass the buffer size to hid_report_raw_event 2026-06-19 13:33:31 +02:00
hid-waltop.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-wiimote-core.c HID: wiimote: remove h from printk format specifier 2021-01-07 10:14:58 +01:00
hid-wiimote-debug.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-wiimote-modules.c HID: Wiimote: Treat the d-pad as an analogue stick 2020-06-19 14:17:22 +02:00
hid-wiimote.h HID: Wiimote: Treat the d-pad as an analogue stick 2020-06-19 14:17:22 +02:00
hid-xinmo.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-zpff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-zydacron.c HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them 2026-04-18 10:33:08 +02:00
hidraw.c HID: hidraw: fix memory leak in hidraw_release() 2022-09-05 10:30:07 +02:00
Kconfig HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK 2026-03-04 07:20:06 -05:00
Makefile HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER 2025-04-10 14:31:58 +02:00
uhid.c HID: uhid: Use READ_ONCE()/WRITE_ONCE() for ->running 2024-04-10 16:19:42 +02:00
wacom.h HID: wacom: remove the battery when the EKR is off 2023-09-06 21:28:38 +01:00
wacom_sys.c HID: wacom: stop hardware after post-start probe failures 2026-07-24 15:51:22 +02:00
wacom_wac.c HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq 2026-04-18 10:33:29 +02:00
wacom_wac.h HID: wacom: Fix OOB write in wacom_hid_set_device_mode() 2026-06-19 13:33:28 +02:00