[v2] HID: rate-limit hid_warn to prevent log flooding

[PATCH v2] HID: rate-limit hid_warn to prevent log flooding

Posted by Li Chen 3 months, 3 weeks ago

From: Li Chen <chenl311@chinatelecom.cn>

Syzkaller can create many uhid devices that trigger
repeated warnings like:

  "hid-generic xxxx: unknown main item tag 0x0"

These messages can flood the system log, especially if a crash occurs
(e.g., with a slow UART console, leading to soft lockups). To mitigate
this, convert `hid_warn()` to use `dev_warn_ratelimited()`.

This helps reduce log noise and improves system stability under fuzzing
or faulty device scenarios.

Signed-off-by: Li Chen <chenl311@chinatelecom.cn>
---
Changelog:

v2: Introduce hid_warn_ratelimited to rate-limit the specified log.

 drivers/hid/hid-core.c | 2 +-
 include/linux/hid.h    | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index b348d0464314c..aaba7164a8c9a 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -661,7 +661,7 @@ static int hid_parser_main(struct hid_parser *parser, struct hid_item *item)
 			item->tag <= HID_MAIN_ITEM_TAG_RESERVED_MAX)
 			hid_warn(parser->device, "reserved main item tag 0x%x\n", item->tag);
 		else
-			hid_warn(parser->device, "unknown main item tag 0x%x\n", item->tag);
+			hid_warn_ratelimited(parser->device, "unknown main item tag 0x%x\n", item->tag);
 		ret = 0;
 	}
 
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 568a9d8c749bc..7f260e0e20498 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -1239,6 +1239,8 @@ void hid_quirks_exit(__u16 bus);
 	dev_notice(&(hid)->dev, fmt, ##__VA_ARGS__)
 #define hid_warn(hid, fmt, ...)				\
 	dev_warn(&(hid)->dev, fmt, ##__VA_ARGS__)
+#define hid_warn_ratelimited(hid, fmt, ...)				\
+	dev_warn_ratelimited(&(hid)->dev, fmt, ##__VA_ARGS__)
 #define hid_info(hid, fmt, ...)				\
 	dev_info(&(hid)->dev, fmt, ##__VA_ARGS__)
 #define hid_dbg(hid, fmt, ...)				\
-- 
2.49.0

Re: [PATCH v2] HID: rate-limit hid_warn to prevent log flooding

Posted by Jiri Kosina 3 months, 2 weeks ago

On Fri, 20 Jun 2025, Li Chen wrote:

> From: Li Chen <chenl311@chinatelecom.cn>
> 
> Syzkaller can create many uhid devices that trigger
> repeated warnings like:
> 
>   "hid-generic xxxx: unknown main item tag 0x0"
> 
> These messages can flood the system log, especially if a crash occurs
> (e.g., with a slow UART console, leading to soft lockups). To mitigate
> this, convert `hid_warn()` to use `dev_warn_ratelimited()`.
> 
> This helps reduce log noise and improves system stability under fuzzing
> or faulty device scenarios.
> 
> Signed-off-by: Li Chen <chenl311@chinatelecom.cn>
> ---
> Changelog:
> 
> v2: Introduce hid_warn_ratelimited to rate-limit the specified log.
> 
>  drivers/hid/hid-core.c | 2 +-
>  include/linux/hid.h    | 2 ++
>  2 files changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
> index b348d0464314c..aaba7164a8c9a 100644
> --- a/drivers/hid/hid-core.c
> +++ b/drivers/hid/hid-core.c
> @@ -661,7 +661,7 @@ static int hid_parser_main(struct hid_parser *parser, struct hid_item *item)
>  			item->tag <= HID_MAIN_ITEM_TAG_RESERVED_MAX)
>  			hid_warn(parser->device, "reserved main item tag 0x%x\n", item->tag);
>  		else
> -			hid_warn(parser->device, "unknown main item tag 0x%x\n", item->tag);
> +			hid_warn_ratelimited(parser->device, "unknown main item tag 0x%x\n", item->tag);
>  		ret = 0;

While I agree in principle that we shouldn't be flooding dmesg in case the 
report descriptor is completely bogus, I think we should be more 
consistent then.

I am pretty sure syzkaller produce report descriptors that will emit flood 
of "reserved main item tag", but you don't seem to be addresing that case?

Thanks,

-- 
Jiri Kosina
SUSE Labs

Re: [PATCH v2] HID: rate-limit hid_warn to prevent log flooding

Posted by Li Chen 3 months, 2 weeks ago

Hi Jiri

 ---- On Fri, 20 Jun 2025 15:09:37 +0800  Jiri Kosina <jikos@kernel.org> wrote --- 
 > On Fri, 20 Jun 2025, Li Chen wrote:
 > 
 > > From: Li Chen <chenl311@chinatelecom.cn>
 > > 
 > > Syzkaller can create many uhid devices that trigger
 > > repeated warnings like:
 > > 
 > >   "hid-generic xxxx: unknown main item tag 0x0"
 > > 
 > > These messages can flood the system log, especially if a crash occurs
 > > (e.g., with a slow UART console, leading to soft lockups). To mitigate
 > > this, convert `hid_warn()` to use `dev_warn_ratelimited()`.
 > > 
 > > This helps reduce log noise and improves system stability under fuzzing
 > > or faulty device scenarios.
 > > 
 > > Signed-off-by: Li Chen <chenl311@chinatelecom.cn>
 > > ---
 > > Changelog:
 > > 
 > > v2: Introduce hid_warn_ratelimited to rate-limit the specified log.
 > > 
 > >  drivers/hid/hid-core.c | 2 +-
 > >  include/linux/hid.h    | 2 ++
 > >  2 files changed, 3 insertions(+), 1 deletion(-)
 > > 
 > > diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
 > > index b348d0464314c..aaba7164a8c9a 100644
 > > --- a/drivers/hid/hid-core.c
 > > +++ b/drivers/hid/hid-core.c
 > > @@ -661,7 +661,7 @@ static int hid_parser_main(struct hid_parser *parser, struct hid_item *item)
 > >              item->tag <= HID_MAIN_ITEM_TAG_RESERVED_MAX)
 > >              hid_warn(parser->device, "reserved main item tag 0x%x\n", item->tag);
 > >          else
 > > -            hid_warn(parser->device, "unknown main item tag 0x%x\n", item->tag);
 > > +            hid_warn_ratelimited(parser->device, "unknown main item tag 0x%x\n", item->tag);
 > >          ret = 0;
 > 
 > While I agree in principle that we shouldn't be flooding dmesg in case the 
 > report descriptor is completely bogus, I think we should be more 
 > consistent then.
 > 
 > I am pretty sure syzkaller produce report descriptors that will emit flood 
 > of "reserved main item tag", but you don't seem to be addresing that case?

Thanks for the suggestion. Perhaps the shorter "reserved main item tag" didn't corrupt my system, 
so I didn't notice. I'll ratelimit it in v3.

Regards,
Li