[PATCH v2] usb: gadget: f_hid: reject zero report length

From: Jiaheng Zhang <[email protected]>

New configfs HID function instances leave report_length at zero until
userspace sets the attribute.  hidg_alloc() currently accepts that value
and copies it into the function state.  hidg_bind() then uses it as the
maximum packet size of the interrupt endpoint descriptors.

If userspace links the unconfigured function and enables the gadget,
hidg_set_alt() reaches usb_ep_enable() with a zero maximum packet size,
which triggers a warning.

Reject the function from hidg_alloc() when report_length is zero.  This
makes the configfs link fail before invalid endpoint descriptors can be
added while leaving configured HID functions unchanged.

Fixes: 21a9476a7ba8 ("usb: gadget: hid: add configfs support")
Reported-by: [email protected]
Closes: https://lore.kernel.org/all/[email protected]/
Assisted-by: Codex:GPT-5.6 MAX
Signed-off-by: Jiaheng Zhang <[email protected]>
---
Testing:
- syzbot reproducer: warning and panic in 2/2 runs before the fix;
  no warning in 2/2 30-second runs after the fix
- configfs/dummy_hcd regression: FAIL before the fix and PASS after it
- current usb-testing: reproducer and regression test PASS, taint 0
- GCC built-in and module builds, sparse, and x86-64/arm64 target
  builds with both supported toolchains: PASS
---
Changes in v2:
- Use the real name Jiaheng Zhang in the author and Signed-off-by fields,
  as requested.
- No code changes.
- Link to v1: https://patch.msgid.link/20260802-hid-report-length-usb-testing-v1-1-0499f99136d2@outlook.com
---
 drivers/usb/gadget/function/f_hid.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 3c6b43d06a..74a78cfd37 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -1605,6 +1605,11 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi)
 	opts = container_of(fi, struct f_hid_opts, func_inst);
 
 	mutex_lock(&opts->lock);
+	if (!opts->report_length) {
+		mutex_unlock(&opts->lock);
+		kfree(hidg);
+		return ERR_PTR(-EINVAL);
+	}
 
 	spin_lock_init(&hidg->write_spinlock);
 	spin_lock_init(&hidg->read_spinlock);

---
base-commit: 5d5fd841c34649f1b09220fe58e59dffd61c447d
change-id: 20260802-hid-report-length-usb-testing-f946f3a643da

Best regards,
--  
Jiaheng Zhang <[email protected]>