RE: [PATCH] HID: intel-thc-hid: reject oversized QuickSPI GET_REPORT responses

> -----Original Message-----
> From: Jérémy Jean <[email protected]>
> Sent: Tuesday, August 18, 2026 10:03 PM
> To: Xu, Even <[email protected]>; Sun, Xinpeng <[email protected]>
> Cc: Jiri Kosina <[email protected]>; Benjamin Tissoires <[email protected]>;
> [email protected]; [email protected]; Jérémy Jean
> <[email protected]>
> Subject: [PATCH] HID: intel-thc-hid: reject oversized QuickSPI GET_REPORT
> responses
> 
> Thread the HID core caller length into quickspi_get_report() and reject responses
> that exceed the caller-provided buffer before the final copy.
> Snapshot the completed response length once so the bound check, copy, and
> returned byte count all use the same value.
> 
> Fixes: 9d8d51735a3a ("HID: intel-thc-hid: intel-quickspi: Add HIDSPI protocol
> implementation")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <[email protected]>
> ---
>  .../intel-thc-hid/intel-quickspi/quickspi-hid.c   |  2 +-
>  .../intel-quickspi/quickspi-protocol.c            | 15 ++++++++++++---
>  .../intel-quickspi/quickspi-protocol.h            |  2 +-
>  3 files changed, 14 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
> b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
> index 91d5807b4a83..a60a0a7f16aa 100644
> --- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
> +++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
> @@ -61,7 +61,7 @@ static int quickspi_hid_raw_request(struct hid_device *hid,
> 
>  	switch (reqtype) {
>  	case HID_REQ_GET_REPORT:
> -		ret = quickspi_get_report(qsdev, rtype, reportnum, buf);
> +		ret = quickspi_get_report(qsdev, rtype, reportnum, buf, len);
>  		break;
>  	case HID_REQ_SET_REPORT:
>  		ret = quickspi_set_report(qsdev, rtype, reportnum, buf, len); diff -
> -git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
> b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
> index cb19057f1191..acc9d67c53ca 100644
> --- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
> +++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
> @@ -342,10 +342,12 @@ int reset_tic(struct quickspi_device *qsdev)  }
> 
>  int quickspi_get_report(struct quickspi_device *qsdev,
> -			u8 report_type, unsigned int report_id, void *buf)
> +			u8 report_type, unsigned int report_id,
> +			void *buf, size_t buf_len)
>  {
>  	int rep_type;
>  	int ret;
> +	u32 report_len;
> 
>  	if (report_type == HID_INPUT_REPORT) {
>  		rep_type = GET_INPUT_REPORT;
> @@ -371,10 +373,17 @@ int quickspi_get_report(struct quickspi_device *qsdev,
>  		return -ETIMEDOUT;
>  	}
>  	qsdev->get_report_cmpl = false;
> +	report_len = READ_ONCE(qsdev->report_len);
> +
> +	if (report_len > buf_len) {
> +		dev_err_once(qsdev->dev, "Get report response too large: %u
> vs %zu\n",
> +			     report_len, buf_len);
> +		return -EINVAL;
> +	}
> 
> -	memcpy(buf, qsdev->report_buf, qsdev->report_len);
> +	memcpy(buf, qsdev->report_buf, report_len);
> 
> -	return qsdev->report_len;
> +	return report_len;
>  }
> 
>  int quickspi_set_report(struct quickspi_device *qsdev, diff --git
> a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h b/drivers/hid/intel-
> thc-hid/intel-quickspi/quickspi-protocol.h
> index 775e29c1ed13..aa2c935dafe8 100644
> --- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h
> +++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h
> @@ -12,7 +12,7 @@ struct quickspi_device;
> 
>  void quickspi_handle_input_data(struct quickspi_device *qsdev, u32 buf_len);
> int quickspi_get_report(struct quickspi_device *qsdev, u8 report_type,
> -			unsigned int report_id, void *buf);
> +			unsigned int report_id, void *buf, size_t buf_len);

The same patch was already submitted here: https://lore.kernel.org/linux-input/IA1PR11MB6098C6AAD23AC33281FFD6D6F4DE2@IA1PR11MB6098.namprd11.prod.outlook.com/

>  int quickspi_set_report(struct quickspi_device *qsdev, u8 report_type,
>  			unsigned int report_id, void *buf, u32 buf_len);  int
> quickspi_get_report_descriptor(struct quickspi_device *qsdev);
> --
> 2.47.3